Bump BouncyCastle to 1.69
[odlparent.git] / docs / NEWS.rst
index 7f98ab284cc1c92adf0b7286caa4b4e107f3d4f9..e7aa879258359ecc87762d54d2ba14d47135ce82 100644 (file)
@@ -2,6 +2,404 @@
 ODL Parent release notes
 ========================
 
+Version 9.0.2
+-------------
+This is a minor upgrade from version 9.0.1.
+
+Bug fixes
+~~~~~~~~~
+* The upgrade to Karaf 4.3.0 caused a slight misalignment of ``org.apache.felix.metatype``
+  and ``org.osgi.service.event`` versions, leading to an unnecessary rewiring of the container
+  most notably during Single Feature Test. This has now been corrected.
+  See `ODLPARENT-253 <https://jira.opendaylight.org/browse/ODLPARENT-253>`__ for more information.
+
+* ``stax-utils`` component has a default dependency on ``com.bea.xml:jsr174-ri``, which is not
+  resolvable from Maven Central. This artifact is not needed with modern JRE versions, hence add
+  an explicit exclusion.
+
+Third-party dependencies
+~~~~~~~~~~~~~~~~~~~~~~~~
+* Jetty 9.4.38.v20210224 → 9.4.40.v20210413, release notes:
+  * `9.4.39.v20210325 <https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.39.v20210325>`__
+  * `9.4.40.v20210413 <https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.40.v20210413>`__
+
+* Karaf `4.3.1 → 4.3.2 <https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311140&version=12349968>`__
+
+* Netty `4.1.63 → 4.1.65 <https://netty.io/news/2021/05/19/4-1-65-Final.html>`__
+
+Version 9.0.1
+-------------
+This is a minor upgrade from version 9.0.0.
+
+Bug fixes
+~~~~~~~~~
+The upgrade of ``duplicate-finder-maven-plugin`` ended up triggering build failures on ``.api_description``
+files packaged in artifacts. This regression has now been fixed.
+
+Third-party dependencies
+~~~~~~~~~~~~~~~~~~~~~~~~
+* Checkstyle `8.41 → 8.42 <https://checkstyle.org/releasenotes.html#Release_8.42>`__.
+
+* Dropwizard Metrics 4.1.19 → 4.1.21, release notes:
+  * `4.1.20 <https://github.com/dropwizard/metrics/releases/tag/v4.1.20>`__
+  * `4.1.21 <https://github.com/dropwizard/metrics/releases/tag/v4.1.21>`__
+
+* LMAX Disruptor 3.4.2 → 3.4.4, release notes:
+  * `3.4.3 <https://github.com/LMAX-Exchange/disruptor/releases/tag/3.4.3>`__
+  * `3.4.3 <https://github.com/LMAX-Exchange/disruptor/releases/tag/3.4.4>`__
+
+* Woodstox `6.2.5 → 6.2.6 <https://github.com/FasterXML/woodstox/milestone/23?closed=1>`__
+
+* XBean finder `4.18 → 4.19 <https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310312&version=12348824>`__
+
+Plugin upgrades
+~~~~~~~~~~~~~~~
+* maven-bundle-plugin 4.2.1 → 5.1.2, release notes:
+  * `5.1.1 <https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310100&version=12346016>`__
+  * `5.1.2 <https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310100&version=12350026>`__
+
+Version 9.0.0
+-------------
+This is a major upgrade from version 8, with breaking changes; downstream projects may need to make changes to upgrade
+to this version.
+
+Upstream version removals
+~~~~~~~~~~~~~~~~~~~~~~~~~
+The following upstream dependencies have been removed from dependency management:
+
+* ``javax.inject:javax.inject``. This dependency should be provided by target runtime. Furthermore we provide the same
+  functionality via ``com.guicedee.services:javax.inject``, which is properly declared and is a JPMS module. See
+  `ODLPARENT-246 <https://jira.opendaylight.org/browse/ODLPARENT-246>`__ for more information.
+
+Improvements
+~~~~~~~~~~~~
+* The configuration of ``maven-compiler-plugin`` has been updated to expand ``javac`` warning options to include almost
+  all of them.
+* The default description in parent ``pom.xml`` has been updated to only include ``${project.artifactId}``, not a generic
+  blurb. See `ODLPARENT-244 <https://jira.opendaylight.org/browse/ODLPARENT-244>`__ for more information.
+* The ``single-feature-test`` substrate has been updated to allow Java Flight Recorder to be enabled during testing runs.
+  This feature has falled into disrepair as the JFR facility has been productized.
+* Configuration of various components has been updated to be deactivated when executing with JDK versions newer than 11,
+  so that odlparent infrastructure works out of the box with JDK 16, albeit sacrificing some validation. Most notably
+  ``SpotBugs`` and ``Single Feature Test`` are disabled, with corresponding notices displayed.
+* We now expose the ability to check dependency declaration consistency via ``maven-dependency-plugin``'s ``analyze-only``
+  goal. This functionality is enabled by default, but does not cause the build to fail when inconsistencies are found. It
+  can be disabled by on a per-artifact basis by definining ``odlparent.dependency.skip`` property to ``true``. It can also
+  be configured to fail the build on a per-artifact basis by defining ``odlparent.dependency.enforce`` property to ``true``.
+
+Third-party dependencies
+~~~~~~~~~~~~~~~~~~~~~~~~
+* Antlr 4.8-1 → 4.9.2, release notes:
+  * `4.9 <https://github.com/antlr/antlr4/releases/tag/4.9>`__
+  * `4.9.1 <https://github.com/antlr/antlr4/releases/tag/4.9.1>`__
+  * `4.9.2 <https://github.com/antlr/antlr4/releases/tag/4.9.2>`__
+
+* Checkstyle 8.39.0 → 8.41.1, release notes:
+  * `8.40.0 <https://checkstyle.org/releasenotes.html#Release_8.40.0>`__
+  * `8.41.0 <https://checkstyle.org/releasenotes.html#Release_8.41.0>`__
+  * `8.41.1 <https://checkstyle.org/releasenotes.html#Release_8.41.1>`__
+
+* commons-lang3 `3.11 → 3.12 <https://commons.apache.org/proper/commons-lang/changes-report.html#a3.12>`__
+
+* Dropwizard Metrics 4.1.12.1 → 4.1.19, release notes:
+  * `4.1.13 <https://github.com/dropwizard/metrics/releases/tag/v4.1.13>`__
+  * `4.1.14 <https://github.com/dropwizard/metrics/releases/tag/v4.1.14>`__
+  * `4.1.15 <https://github.com/dropwizard/metrics/releases/tag/v4.1.15>`__
+  * `4.1.16 <https://github.com/dropwizard/metrics/releases/tag/v4.1.16>`__
+  * `4.1.17 <https://github.com/dropwizard/metrics/releases/tag/v4.1.17>`__
+  * `4.1.18 <https://github.com/dropwizard/metrics/releases/tag/v4.1.18>`__
+  * `4.1.19 <https://github.com/dropwizard/metrics/releases/tag/v4.1.19>`__
+
+* Enunciate `2.13.2 → 2.13.3 <https://github.com/stoicflame/enunciate/releases/tag/v2.13.3>`__
+
+* Google Truth 1.1 → 1.1.2, release notes:
+  * `1.1.1 <https://github.com/google/truth/releases/tag/release_1_1_1>`__
+  * `1.1.2 <https://github.com/google/truth/releases/tag/release_1_1_2>`__
+
+* Guava 29.0 → 30.1.1, release notes:
+  * `30.0 <https://github.com/google/guava/releases/tag/v30.0>`__
+  * `30.1 <https://github.com/google/guava/releases/tag/v30.1>`__
+  * `30.1.1 <https://github.com/google/guava/releases/tag/v30.1.1>`__
+
+* JUnit `4.13.1 → 4.13.2 <https://github.com/junit-team/junit4/blob/HEAD/doc/ReleaseNotes4.13.2.md>`__
+
+* Karaf `4.3.0 → 4.3.1 <https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311140&version=12348818>`__
+
+* Log4J 2.13.3 → 2.14.1, release notes:
+  * `2.14.0 <https://logging.apache.org/log4j/2.x/changes-report.html#a2.14.0>`__
+  * `2.14.1 <https://logging.apache.org/log4j/2.x/changes-report.html#a2.14.1>`__
+
+* Netty 4.1.59 → 4.1.63, release notes:
+  * `4.1.60 <https://netty.io/news/2021/03/09/4-1-60-Final.html>`__
+  * `4.1.61 <https://netty.io/news/2021/03/30/4-1-61-Final.html>`__
+  * `4.1.62 <https://netty.io/news/2021/03/31/4-1-62-Final.html>`__
+  * `4.1.63 <https://netty.io/news/2021/04/01/4-1-63-Final.html>`__
+
+* Sevntu `1.38.0 → 1.39.0 <https://sevntu-checkstyle.github.io/sevntu.checkstyle/#1.39.0>`__
+
+* ThreeTen `1.5.0 → 1.6.0 <https://www.threeten.org/threeten-extra/changes-report.html#a1.6.0>`__
+
+* Woodstox `6.2.4 → 6.2.5 <https://github.com/FasterXML/woodstox/milestone/22?closed=1>`__
+
+* Xtend `2.24.0 → 2.25.0 <https://www.eclipse.org/xtend/releasenotes.html#/releasenotes/2021/03/02/version-2-25-0>`__
+
+Plugin upgrades
+~~~~~~~~~~~~~~~
+* Asciidoctor 1.5.7.1 → 2.1.0 (with related AsciidoctorJ upgrades)
+  * `2.0.0 <https://github.com/asciidoctor/asciidoctor-maven-plugin/releases/tag/asciidoctor-maven-plugin-2.0.0>`__
+  * `2.1.0 <https://github.com/asciidoctor/asciidoctor-maven-plugin/releases/tag/asciidoctor-maven-plugin-2.1.0>`__
+
+* git-commit-id-plugin 3.0.1 → 4.0.4, release notes:
+  * `4.0.0 <https://github.com/git-commit-id/git-commit-id-maven-plugin/releases/tag/v4.0.0>`__
+  * `4.0.1 <https://github.com/git-commit-id/git-commit-id-maven-plugin/releases/tag/v4.0.1>`__
+  * `4.0.2 <https://github.com/git-commit-id/git-commit-id-maven-plugin/releases/tag/v4.0.2>`__
+  * `4.0.3 <https://github.com/git-commit-id/git-commit-id-maven-plugin/releases/tag/v4.0.3>`__
+  * `4.0.4 <https://github.com/git-commit-id/git-commit-id-maven-plugin/releases/tag/v4.0.4>`__
+
+* modernizer-maven-plugin `2.1.0 → 2.2.0 <https://github.com/gaul/modernizer-maven-plugin/releases/tag/modernizer-maven-plugin-2.2.0>`__
+
+Version 8.1.1
+-------------
+This is a minor upgrade from version 8.1.0.
+
+Improvements
+~~~~~~~~~~~~
+* Support for building a `static Karaf distribution <https://karaf.apache.org/manual/latest/#_instances_and_distributions_goals>`__
+  has been added. It is driven by a new parent pom.xml, ``karaf-dist-static``. For more information
+  see Karaf documentation and `ODLPARENT-251 <https://jira.opendaylight.org/browse/ODLPARENT-251>`__.
+* Support for `improved documentation tags <https://bugs.openjdk.java.net/browse/JDK-8068562>`__ has
+  been added to default ``maven-javadoc-plugin`` configuration. See
+  `ODLPARENT-252 <https://jira.opendaylight.org/browse/ODLPARENT-252>`__ for more information.
+* Version declaration for ``osgi.annotation`` has been added.
+
+Third-party dependencies
+~~~~~~~~~~~~~~~~~~~~~~~~
+* commons-net `3.7.2 → 3.8.0 <https://commons.apache.org/proper/commons-net/changes-report.html#a3.8.0>`__
+
+* Netty `4.1.58 → 4.1.59 <https://netty.io/news/2021/02/08/4-1-59-Final.html>`__
+
+* Woodstox `6.2.3 → 6.2.4 <https://github.com/FasterXML/woodstox/milestone/21?closed=1>`__
+
+Plugin upgrades
+~~~~~~~~~~~~~~~
+* maven-checkstyle-plugin `3.1.1 → 3.1.2 <https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12317223&version=12347024>`__
+
+* maven-invoker-plugin `3.2.1 → 3.2.2 <https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12317525&version=12346157>`__
+
+Version 8.1.0
+-------------
+This is a minor upgrade from version 8.0.1, with some potentially-breaking
+changes.
+
+The most prominent is the upgrade to Karaf 4.3.0, which brings in a host of
+updates to related components -- including OSGi Release 7 and Jackson 2.11.x.
+
+Feature updates
+~~~~~~~~~~~~~~~
+* The ``odl-jackson-2.10`` feature and artifact were renamed to ``odl-jackson-2.11``
+  to reflect the bump in Jackson version.
+
+Third-party dependencies
+~~~~~~~~~~~~~~~~~~~~~~~~
+* Bouncy Castle `1.66 → 1.68 <https://www.bouncycastle.org/releasenotes.html>`__
+
+* Checkstyle 8.36.1 → 8.39.0, release notes:
+  * `8.36.2 <https://checkstyle.org/releasenotes.html#Release_8.36.2>`__
+  * `8.37.0 <https://checkstyle.org/releasenotes.html#Release_8.37.0>`__
+  * `8.38.0 <https://checkstyle.org/releasenotes.html#Release_8.38.0>`__
+  * `8.39.0 <https://checkstyle.org/releasenotes.html#Release_8.39.0>`__
+
+* commons-net 3.7 → 3.7.2, release notes:
+  * `3.7.1 <https://commons.apache.org/proper/commons-net/changes-report.html#a3.7.1>`__
+  * `3.7.2 <https://commons.apache.org/proper/commons-net/changes-report.html#a3.7.2>`__
+
+* enunciate `2.13.1 → 2.13.2 <https://github.com/stoicflame/enunciate/releases/tag/v2.13.2>`__
+
+* Jackson 2.10.5 → 2.11.4, release notes:
+  * `2.11.0 <https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.11>`__
+  * `2.11.1 <https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.11.1>`__
+  * `2.11.2 <https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.11.2>`__
+  * `2.11.3 <https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.11.3>`__
+  * `2.11.4 <https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.11.4>`__
+
+* Karaf `4.2.10 → 4.3.0 <https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311140&version=12343304>`__
+
+* Netty 4.1.53 → 4.1.58, release notes:
+  * `4.1.54 <https://netty.io/news/2020/11/11/4-1-54-Final.html>`__
+  * `4.1.55 <https://netty.io/news/2020/12/08/4-1-55-Final.html>`__
+  * `4.1.56 <https://netty.io/news/2020/12/17/4-1-56-Final.html>`__
+  * `4.1.57 <https://netty.io/news/2021/01/12/4-1-57-Final.html>`__
+  * `4.1.58 <https://netty.io/news/2021/01/13/4-1-58-Final.html>`__
+
+* Google Truth `1.0.1 → 1.1 <https://github.com/google/truth/releases/tag/release_1_1>`__
+
+* Powermock 2.0.7 → 2.0.9, release notes:
+  * `2.0.8 <https://github.com/powermock/powermock/blob/release/2.x/docs/release-notes/official.md#208>`__
+  * `2.0.9 <https://github.com/powermock/powermock/blob/release/2.x/docs/release-notes/official.md#209>`__
+
+* Sevntu `1.37.1 → 1.38.0 <https://sevntu-checkstyle.github.io/sevntu.checkstyle/#1.38.0>`__
+
+* XBean finder `4.17 → 4.18 <https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12310312&version=12348171>`__
+
+* xmlunit 2.7.0 → 2.8.2, release notes:
+  * `2.8.0 <https://github.com/xmlunit/xmlunit/releases/tag/v2.8.0>`__
+  * `2.8.1 <https://github.com/xmlunit/xmlunit/releases/tag/v2.8.1>`__
+  * `2.8.2 <https://github.com/xmlunit/xmlunit/releases/tag/v2.8.2>`__
+
+* Xtend `2.23.0 → 2.24.0 <https://www.eclipse.org/xtend/releasenotes.html#/releasenotes/2020/12/01/version-2-24-0>`__
+
+Plugin upgrades
+~~~~~~~~~~~~~~~
+* build-helper-maven-plugin `3.1.0 → 3.2.0 <https://github.com/mojohaus/build-helper-maven-plugin/issues?q=is%3Aissue+milestone%3A3.1.0+is%3Aclosed>`__
+
+* duplicate-finder-maven-plugin `1.4.0 → 1.5.0 <https://github.com/basepom/duplicate-finder-maven-plugin/releases/tag/duplicate-finder-maven-plugin-1.5.0>`__
+
+* exec-maven-plugin `1.6.0 → 3.0.0 <https://github.com/mojohaus/exec-maven-plugin/releases/tag/exec-maven-plugin-3.0.0>`__
+
+* maven-pmd-plugin `3.13.0 → 3.14.0 <https://www.mail-archive.com/announce@maven.apache.org/msg00978.html>`__
+
+* maven-resource-plugin `3.9.0 → 3.9.1 <https://www.mail-archive.com/announce@maven.apache.org/msg00972.html>`__
+
+* maven-site-plugin `3.9.0 → 3.9.1 <https://www.mail-archive.com/announce@maven.apache.org/msg00966.html>`__
+
+* versions-maven-plugin `2.7 → 2.8.1 <https://github.com/mojohaus/versions-maven-plugin/releases/tag/versions-maven-plugin-2.8.1>`__
+
+
+Version 8.0.1
+-------------
+This is a minor big-fix/enhancement update from verision 8.0.0.
+
+Improvements
+~~~~~~~~~~~~
+* ``javax.inject`` is now provided by the artifact from `GuicedEE <https://guicedee.com/>`__.
+  This improves things a lot, as it is a proper jar (not MANIFEST.MF warning), it also is
+  a JPMS module, hence can be used for linkage. This dependency is properly ``scope=provided``,
+  so it should not leak into runtimes where it should not be.
+  See `ODLPARENT-247 <https://jira.opendaylight.org/browse/ODLPARENT-247>`__ for details.
+
+* Transitive dependencies of Guava are now mostly filtered from runtime, so that we do not
+  require ``wrap`` for them. We still retain checker-qual, as we are actively using those
+  and it is a proper bundle.
+  See `ODLPARENT-248 <https://jira.opendaylight.org/browse/ODLPARENT-248>`__ for details.
+
+Third-party dependencies
+~~~~~~~~~~~~~~~~~~~~~~~~
+* Jackson `2.10.4 → 2.10.5 <https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.10.5>`__
+
+* JaCoCo `0.8.5 → 0.8.6 <https://github.com/jacoco/jacoco/releases/tag/v0.8.6>`__
+
+* JUnit `4.13.0 → 4.13.1 <https://github.com/junit-team/junit4/blob/HEAD/doc/ReleaseNotes4.13.1.md>`__
+
+* Karaf `4.2.9 → 4.2.10 <https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311140&version=12348288>`__
+
+* Netty `4.1.52 → 4.1.53 <https://netty.io/news/2020/10/13/4-1-53-Final.html>`__
+
+* Pax-Exam `4.13.3 → 4.13.4 <https://ops4j1.jira.com/secure/ReleaseNote.jspa?projectId=10170&version=24393>`__
+
+* Woodstox 6.2.1 → 6.2.3, fixed issues:
+  * `6.2.2 <https://github.com/FasterXML/woodstox/issues/112>`__
+  * `6.2.3 <https://github.com/FasterXML/woodstox/issues/117>`__
+
+
+Version 8.0.0
+-------------
+This is a major upgrade from version 7, with breaking changes; downstream projects may need to make changes to upgrade
+to this version.
+
+Improvements
+~~~~~~~~~~~~
+* ``modernizer-maven-plugin`` configuration has been updated to issue warnings for constructs
+  improved in all Java versions up to and including Java 11.
+
+* ``modernizer-maven-plugin`` is configured by default to fail the build when it issues any
+  warnings. This behavior can be opted-out of on a per-artifact basis by defining
+  ``odlparent.modernizer.enforce`` property to ``false``.
+
+Upstream version removals
+~~~~~~~~~~~~~~~~~~~~~~~~~
+The following upstream dependencies have been removed from dependency management:
+
+* ``javax.json``. This dependency is used only in Neutron project, hence this version is best
+  maintained there. See `ODLPARENT-238 <https://jira.opendaylight.org/browse/ODLPARENT-238>`__
+  for details.
+
+* All ``org.eclipse.persistence`` artifacts. These dependencies are only used in Neutron,
+  which actually duplicates the declarations, hence they are best maintained there.
+  See `ODLPARENT-237 <https://jira.opendaylight.org/browse/ODLPARENT-237>`__ for details.
+
+* All ``org.apache.sshd`` and ``net.i2p.crypto`` artifacts. Overriding versions does not play
+  nice with Karaf's versions during ``feature:install``, causing issues when the installing
+  over an SSH connection. NETCONF project is providing a repackaged version in OpenDaylight
+  namespace. See `ODLPARENT-233 <https://jira.opendaylight.org/browse/ODLPARENT-233>`__ for
+  details.
+
+* ``jettison``. This dependency is used only in LISP Flow Mapping project for integration
+  tests, hence this version is best maintained there.
+  See `ODLPARENT-239 <https://jira.opendaylight.org/browse/ODLPARENT-239>`__ for details.
+
+* All ``com.typesafe``, ``io.aeron``, ``org.agrona``, ``org.scala-lang`` declarations. Akka is
+  removing their support for OSGi, with no working releases in their current ``2.6.x.`` branch.
+  Since dealing with these requires quite a bit of dance, which needs to sit outside of odlparent POM,
+  the controller project will package Akka to the extent it needs.
+  See `ODLPARENT-243 <https://jira.opendaylight.org/browse/ODLPARENT-243>`__ for details.
+
+* ``org.apache.felix.dependencymanager`` and ``org.apache.felix.dependencymanager.shell``. These
+  components are ancient, having been replaced by either Blueprint or Declarative Services. The only
+  project using these is AAA, hence it is best to maintain these declarations there.
+
+Feature removals
+~~~~~~~~~~~~~~~~
+* ``odl-apache-sshd`` feature has been removed, mirroring the removal of related dependency
+  declarations. See `ODLPARENT-233 <https://jira.opendaylight.org/browse/ODLPARENT-233>`__ for details.
+
+* ``odl-akka-all``, ``odl-akka-scala-2.13``, ``odl-akka-system-2.5``, ``odl-akka-clustering-2.5``
+  and ``odl-akka-persistence-2.5`` features. mirroring the removal of related dependency declarations.
+  See `ODLPARENT-243 <https://jira.opendaylight.org/browse/ODLPARENT-243>`__ for details.
+
+Third-party dependencies
+~~~~~~~~~~~~~~~~~~~~~~~~
+* awaitility `3.0.0 → 4.0.3 <https://github.com/awaitility/awaitility/wiki/ReleaseNotes40>`__
+
+* checkstyle 8.34 → 8.36.1, release notes:
+  * `8.35 <https://checkstyle.org/releasenotes.html#Release_8.35>`__
+  * `8.36 <https://checkstyle.org/releasenotes.html#Release_8.36>`__
+  * `8.36.1 <https://checkstyle.org/releasenotes.html#Release_8.36.1>`__
+
+* commons-codec `1.14 → 1.15 <https://commons.apache.org/proper/commons-codec/changes-report.html#a1.15>`__
+
+* commons-io `2.7 → 2.8.0 <https://commons.apache.org/proper/commons-io/changes-report.html#a2.8.0>`__
+
+* commons-net `3.6 → 3.7 <https://commons.apache.org/proper/commons-net/changes-report.html#a3.7>`__
+
+* dropwizard-metrics 4.1.9 → 4.1.12.1, release notes:
+  * `4.1.10 <https://github.com/dropwizard/metrics/releases/tag/v4.1.10>`__
+  * `4.1.10.1 <https://github.com/dropwizard/metrics/releases/tag/v4.1.10.1>`__
+  * `4.1.11 <https://github.com/dropwizard/metrics/releases/tag/v4.1.11>`__
+  * `4.1.12 <https://github.com/dropwizard/metrics/releases/tag/v4.1.12>`__
+  * `4.1.12.1 <https://github.com/dropwizard/metrics/releases/tag/v4.1.12.1>`__
+
+* Guava `28.2 → 29.0 <https://github.com/google/guava/releases/tag/v29.0>`__
+
+* immutables.org → 2.8.8, release notes:
+  * `2.8.0 <https://github.com/immutables/immutables/releases/tag/2.8.0>`__
+  * `2.8.1 <https://github.com/immutables/immutables/releases/tag/2.8.1>`__
+  * `2.8.2 <https://github.com/immutables/immutables/releases/tag/2.8.2>`__
+  * `2.8.3 <https://github.com/immutables/immutables/releases/tag/2.8.3>`__
+  * `2.8.4 <https://github.com/immutables/immutables/releases/tag/2.8.4>`__
+  * `2.8.8 <https://github.com/immutables/immutables/releases/tag/2.8.8>`__
+
+* mockito `3.3.3 → 3.5.11 <https://github.com/mockito/mockito/blob/release/3.x/doc/release-notes/official.md>`__
+
+* Netty `4.1.51 → 4.1.52 <https://netty.io/news/2020/09/08/4-1-52-Final.html>`__
+
+* Xtend `2.22.0 → 2.23.0 <https://www.eclipse.org/xtend/releasenotes.html#/releasenotes/2020/09/01/version-2-23-0>`__
+
+Plugin upgrades
+~~~~~~~~~~~~~~~
+* maven-archetype-plugin `3.1.2 → 3.2.0 <https://blogs.apache.org/maven/entry/apache-maven-archetype-plugin-version1>`__
+
+* project-info-reports-plugin `3.1.0 → 3.1.1 <https://blogs.apache.org/maven/entry/apache-maven-project-info-reports1>`__
+
 Version 7.0.5
 -------------
 This is a bug-fix upgrade from version 7.0.4.