[dependabot]

Bumps org.codehaus.mojo:license-maven-plugin from 2.7.0 to 2.8.0.

Release notes

Sourced from org.codehaus.mojo:license-maven-plugin's releases.

2.8.0

License Maven Plugin 2.8.0 improves the speed, reliability, and configurability of license downloads and third-party license reports. It requires Maven 3.9.0 or later and Java 8 or later.

✨ Highlights

• Bundled well-known license texts (download-licenses, test-download-licenses): Common plain-text license URLs — including Apache 2.0, EPL 2.0, and the GNU GPL (1.0, 2.0, 3.0), LGPL (2.0, 2.1, 3.0), AGPL (3.0), and FDL (1.1, 1.2, 1.3) families — are now written directly from texts bundled with the plugin instead of being downloaded over the network on every build (#781).
• License classification in third-party-report: You can now classify third-party licenses using <forbiddenLicenses>, <problematicLicenses>, and <okLicenses> so the generated report highlights compliance status (Forbidden, Warning, OK, Unknown) as plain text without relying on external skin images (#731, #777).
• Configurable license summary ordering: Added the <orderBy> parameter to download-licenses (name by default, gav, or license) to control the ordering of entries in licenses.xml (#730).
• Authenticated license downloads: download-licenses can now authenticate against protected license hosts using credentials configured in Maven's settings.xml via <loginServerId> (#717).
• More resilient license downloads and filtering:
  • Restored support for Windows file: URLs (such as file:/C:/... and file://C:/...) in license URLs (#778).
  • When a license host returns HTTP 429 Too Many Requests or 503 Service Unavailable, the plugin stops querying that host for the rest of the execution instead of repeatedly failing or timing out (#771).
  • Requests now include a plugin-specific User-Agent header so servers that block default Java HTTP clients accept requests (#728).
  • License names in <includedLicenses>, <excludedLicenses>, and pipe-separated license lists now have surrounding whitespace trimmed consistently (#734, #737).
  • Fixed a NullPointerException when excluding transitive dependencies with a null dependency trail (#739) and a ConcurrentModificationException when multiple dependencies declare multiple licenses (#706).

🚨 Removed

• Require Maven 3.9.0 (#757) @​slachiewicz

🚀 New features and improvements

• Write well-known licenses from bundled texts instead of downloading them (#781) @​slachiewicz
• Show report status as text instead of skin images (#777) @​slachiewicz
• Classify licenses as forbidden, problematic or ok (#731) @​slachiewicz
• Order the license summary by name, GAV or license (#730) @​slachiewicz
• Feat: Allow using Authentication when downloading License Texts (#717) @​MrBanana05

🐛 Bug Fixes

• Accept file: URLs with a Windows path again (#778) @​slachiewicz
• Stop requesting a license host after it answers 429 or 503 (#771) @​slachiewicz
• Skip null dependency trail when excluding transitives #310 (#739) @​AzazelSensei
• Fixed license name splitting (#737) @​Master-Code-Programmer
• Trim the license names in includedLicenses and excludedLicenses (#734) @​slachiewicz
• Send a plugin-specific User-Agent when downloading licenses (#728) @​slachiewicz
• fix a ConcurrentModificationException (#706) @​wuwu2000

📝 Documentation updates

• Add AGENTS.md (#760) @​slachiewicz

👻 Maintenance

• Keep Dependabot on Apache POI 5.x (#782) @​slachiewicz
• Declare org.eclipse.sisu.inject at the version of org.eclipse.sisu.plexus (#775) @​slachiewicz
• Keep the remaining Maven artifacts on 3.9.x in Dependabot (#770) @​slachiewicz
• Declare the Maven artifacts the code uses (#765) @​slachiewicz
• Remove redundant mojo.java.target property (#766) @​slachiewicz
• Apply the JUnit 5 best practices to the tests (#763) @​slachiewicz

... (truncated)

Commits

• 6f23905 [maven-release-plugin] prepare release 2.8.0
• accfc93 Keep Dependabot on Apache POI 5.x
• 49d6f10 Write well-known licenses from bundled texts instead of downloading
• 26bf56a Add a table of license URLs with bundled texts
• 34fc912 Stay on maven-reporting-api 4.0.0
• bf571d4 Show report status as text instead of skin images
• 3c71f58 Accept file: URLs with a Windows path again
• 2b833ba Bump the maven group across 1 directory with 5 updates
• e74305c Declare org.eclipse.sisu.inject at the version of org.eclipse.sisu.plexus
• 44d4b66 Keep Dependabot on maven-archiver 3.x
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)