From 4f04add4b2f54131cc439ba486d45ca649d1a0ed Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 19 Oct 2026 09:24:57 +0000
Subject: [PATCH 1/2] Bump the maven-dependencies group across 1 directory with
 2 updates

Bumps the maven-dependencies group with 2 updates in the / directory: [org.codehaus.mojo:versions-maven-plugin](https://github.com/mojohaus/versions) and [org.sonatype.central:central-publishing-maven-plugin](https://github.com/sonatype-nexus-community/central-publishing-maven-plugin).


Updates `org.codehaus.mojo:versions-maven-plugin` from 2.22.0 to 2.23.0
- [Release notes](https://github.com/mojohaus/versions/releases)
- [Changelog](https://github.com/mojohaus/versions/blob/master/ReleaseNotes.md)
- [Commits](https://github.com/mojohaus/versions/compare/2.22.0...2.23.0)

Updates `org.sonatype.central:central-publishing-maven-plugin` from 0.11.0 to 0.12.0
- [Release notes](https://github.com/sonatype-nexus-community/central-publishing-maven-plugin/releases)
- [Commits](https://github.com/sonatype-nexus-community/central-publishing-maven-plugin/commits/release-0.12.0)

---
updated-dependencies:
- dependency-name: org.codehaus.mojo:versions-maven-plugin
  dependency-version: 2.23.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.sonatype.central:central-publishing-maven-plugin
  dependency-version: 0.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 pom.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index f2821cf..378bac2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -329,7 +329,7 @@
                 <plugin>
                     <groupId>org.codehaus.mojo</groupId>
                     <artifactId>versions-maven-plugin</artifactId>
-                    <version>2.22.0</version>
+                    <version>2.23.0</version>
                 </plugin>
                 <!-- Run the japicmp engine directly. The Maven report wrapper pulls
                      obsolete site/reporting libraries into the build-only graph. -->
@@ -374,7 +374,7 @@
                 <plugin>
                     <groupId>org.sonatype.central</groupId>
                     <artifactId>central-publishing-maven-plugin</artifactId>
-                    <version>0.11.0</version>
+                    <version>0.12.0</version>
                 </plugin>
             </plugins>
         </pluginManagement>

From ed058b1b14ea34966c74f72724b31a806100f51a Mon Sep 17 00:00:00 2001
From: Jim Manico <jim@manico.net>
Date: Tue, 20 Oct 2026 09:31:17 +0200
Subject: [PATCH 2/2] Clarify publisher 0.12 bundle validation and retained
 overrides

---
 RELEASING.md | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/RELEASING.md b/RELEASING.md
index 882eef3..6f8c8ae 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -125,9 +125,15 @@ The assembler verifies all thirteen signatures against that expected fingerprint
 checks the signed POMs match the source POMs, excludes the optional WAR, generates
 four checksum types and refuses to overwrite an existing bundle. It never builds,
 signs or uploads. Do **not** use `skipPublishing=true` as a bundle-generation
-command: despite upstream documentation, 0.11.0 filters out every artifact before
-bundling. It also requires a `central` server settings entry even in that mode;
-the isolated validation used dummy values and confirmed no upload occurred.
+command: it excludes artifacts from publication. The historical 0.11.0 validation
+filtered out every artifact and required a `central` settings entry even in that
+mode; that test used dummy values and confirmed no upload occurred.
+The current publisher, 0.12.0, adds `skipUpload=true` to build a bundle without
+uploading it. With `ignorePublishedComponents=false`, it needs no Central
+credentials. A separate unsigned POM-only fixture validated that mode under
+JDK 17/Maven 3.10.0 on 2026-10-20; it did not validate production signing or
+Central authentication. Keep using the signature-verifying assembler above for
+production bundles.
 The publisher extension loads only in the signing profile. The current POM uses
 `autoPublish=false`: deployment stages the release and does not publish it.
 Inspect the deployment in Central Portal and resolve validation errors before
@@ -228,7 +234,12 @@ annotations 2.22, HttpClient 5.6.5 and HttpCore/httpcore5-h2 5.4.4. The upstream
 0.11.0 dependency versions matched OSV advisories in the dated
 [September validation](docs/archive/maintenance-2026-09/batch-04-validation.md#release-plugin-dependency-follow-up-187).
 That check used HttpClient 5.6.4; the current 5.6.5 pin arrived later and is not
-covered by that historical advisory result. Local signed bundle validation
+covered by that historical advisory result. The 2026-10-20 publisher update
+compared the published 0.11.0 and 0.12.0 direct dependency declarations, which
+are unchanged, and retained all seven existing overrides. The isolated 0.12.0
+bundle-only fixture resolved those exact overrides and excluded Maven 3.10
+bookkeeping files from its ZIP. This was a linkage/bundling check, not a new
+advisory scan or a signed release rehearsal. Local signed bundle validation
 exercises the overridden plugin. This is not an audit of every plugin dependency
 or a claim that the plugin's live Central HTTP path has been tested. Jim's Portal
 namespace access and exact 1.4.1 publication are now [verified](releases/1.4.1-central-publication.md).