SUSE-SU-2026:21608-1

This update for ongres-scram, ongres-stringprep, plexus-testing, maven, maven-doxia, mojo-parent, sisu fixes the following issues:

Changes in ongres-scram:

• Version 3.2

  • Fix Timing Attack Vulnerability in SCRAM Authentication (bsc#1250399, CVE-2025-59432)
  • Updated dependencies and maven plugins
  • Use central-publishing-maven-plugin to deploy to Maven Central.

• Do not create multirelease jar if the only Java 9+ class file is module-info.class

Changes in ongres-stringprep:

• Do not create multirelease jar if the only Java 9+ class file is module-info.class

Changes in plexus-testing:

• The build without tests does not need the full junit5; the junit5-minimal (built with ant) is enough

Changes in maven:

• Upgrade to upstream version 3.9.14

  • Bug Fixes

    • plexus-testing dependencies should be used in test scope

• Upgrade to upstream version 3.9.13

  • Bug Fixes

    • Bug: SecDispatcher is managed by legacy Plexus DI
    • [3.9.x] MavenPluginJavaPrerequisiteChecker: Handle 8/1.8 Java version in ranges as well

  • Maintenance

    • Update Maven plugin versions in default-bindings.xml
    • Migrate to JUnit 5 - avoid using TestCase

Changes in maven-doxia:

Upgrade to upstream version 2.1.0:

• New features and improvements

  • Distinguish between linebreaks for formatting markup and linebreaks in output
  • Return SinkEventAttributes instead of super class MutableAttributeSet for filterAttributes
  • Optionally leave fragments of internal links untouched Support strikethrough for Markdown sink
  • DOXIA-770: Only escape when necessary
  • DOXIA-760: Clarify table justification semantics and introduce new "JUSTIFY_DEFAULT" alignment
  • DOXIA-756: Allow to customize macro execution
  • DOXIA-759: Support anchors in MarkdownSink

• Bug Fixes

  • MarkdownSink: Fix verbatim inside table cell
  • Make sure to emit metadata prior everything else
  • Convert all globally available attributes to HTML5 compliant ones
  • Html5BaseSink: Convert non-compliant HTML5 attributes to compliant ones
  • Support "name" attribute in "a" element still in XHTML5
  • Never emit Markdown inside HTML context
  • Use JSoup to convert HTML to XHTML after parsing with Flexmark
  • DOXIA-764: Strip leading newline after
  • DOXIA-763: Distinguish between verbatim source and non-source in MarkdownSink
  • DOXIA-758: Consider emitComments flag in MarkdownSink
  • DOXIA-757: Don't strip leading "#" from link names
  • DOXIA-753: Do not end lists with a blank line
  • DOXIA-751: Linked inline code must be emitted in right order
  • DOXIA-749: Correctly indent and separate blocks inside list items
  • DOXIA-750: Properly apply inlines inside HTML blocks
  • DOXIA-747: Emit headings at beginning of line for Markdown

• Documentation updates

  • Site: Convert APT to Markdown
  • Improve documentation of supported extensions
  • (doc) Fix missing references in JavaDocs

• Maintenance

  • Cleanup tests
  • JUnit Jupiter best practices
  • Remove commons-lang3 and commons-text dependencies
  • feat: enable prevent branch protection rules
  • Cleanup pom, remove redundant dependencies
  • Drop almost all usages of plexus-utils
  • Remove not used and outdated clirr-maven-plugin
  • Enable Github Issues
  • DOXIA-772: Deprecate Sink.sectionTitle() and sectionTitle_()
  • DOXIA-754: Clarify method order for nested lists

Changes in mojo-parent:

• Do not import junit-bom in the parent. This creates unnecessary build cycles with junit5.