Log message:
Update to 3.8.6. From the changelog:

3.8.6:

** Bug

  * [[MNG-7432](https://issues.apache.org/jira/browse/MNG-7432)] - [REGRESSION] \ 
Resolver session contains non-MavenWorkspaceReader
  * [[MNG-7433](https://issues.apache.org/jira/browse/MNG-7433)] - [REGRESSION] \ 
Multiple maven instances working on same source tree can lock each other
  * [[MNG-7441](https://issues.apache.org/jira/browse/MNG-7441)] - Update \ 
Version of (optional) Logback to Address CVE-2021-42550
  * [[MNG-7448](https://issues.apache.org/jira/browse/MNG-7448)] - Don't ignore \ 
bin/ otherwise bin/ in apache-maven module cannot be readded
  * [[MNG-7455](https://issues.apache.org/jira/browse/MNG-7455)] - [REGRESSION] \ 
IllegalStateException in SessionScope during guice injection in multithreaded \ 
build
  * [[MNG-7459](https://issues.apache.org/jira/browse/MNG-7459)] - Revert \ 
MNG-7347 (SessionScoped beans should be singletons for a given session)
  * [[MNG-7467](https://issues.apache.org/jira/browse/MNG-7467)] - [REGRESSION] \ 
Compilation failure with relocated transitive dependency
  * [[MNG-7487](https://issues.apache.org/jira/browse/MNG-7487)] - Fix deadlock \ 
during forked lifecycle executions
  * [[MNG-7493](https://issues.apache.org/jira/browse/MNG-7493)] - [REGRESSION] \ 
Resolving dependencies between submodules fails

** New Feature

  * [[MNG-7486](https://issues.apache.org/jira/browse/MNG-7486)] - Create a \ 
multiline message helper for boxed log messages

** Improvement

  * [[MNG-7445](https://issues.apache.org/jira/browse/MNG-7445)] - to refactor \ 
some useless code
  * [[MNG-7476](https://issues.apache.org/jira/browse/MNG-7476)] - Display a \ 
warning when an aggregator mojo is locking other mojo executions

** Task

  * [[MNG-7466](https://issues.apache.org/jira/browse/MNG-7466)] - Align \ 
Assembly Descriptor NS versions

** Dependency upgrade

  * [[MNG-7488](https://issues.apache.org/jira/browse/MNG-7488)] - Upgrade SLF4J \ 
to 1.7.36
  * [[MNG-7489](https://issues.apache.org/jira/browse/MNG-7489)] - Upgrade JUnit \ 
to 4.13.2
  * [[MNG-7490](https://issues.apache.org/jira/browse/MNG-7490)] - Upgrade \ 
Plexus Utils to 3.3.1

3.8.5:

** Bug

  * [[MNG-5180](https://issues.apache.org/jira/browse/MNG-5180)] - Versioning's \ 
snapshot version list is not included in metadata merge
  * [[MNG-5561](https://issues.apache.org/jira/browse/MNG-5561)] - Plugin \ 
relocation loses configuration
  * [[MNG-5982](https://issues.apache.org/jira/browse/MNG-5982)] - The POM for \ 
... is invalid, transitive dependencies ... while property was overriden
  * [[MNG-6326](https://issues.apache.org/jira/browse/MNG-6326)] - Build \ 
continues when core extensions aren't found
  * [[MNG-6727](https://issues.apache.org/jira/browse/MNG-6727)] - Using version \ 
range in parent and CI Friendly Version fails
  * [[MNG-6802](https://issues.apache.org/jira/browse/MNG-6802)] - \ 
FileProfileActivator changes FileProfileActivator.exists which lets flattened \ 
resolveCiFriendliesOnly depending fail activating profile
  * [[MNG-7156](https://issues.apache.org/jira/browse/MNG-7156)] - Parallel \ 
build can cause issues between clean and forked goals
  * [[MNG-7335](https://issues.apache.org/jira/browse/MNG-7335)] - [Regression] \ 
Parallel build fails due to missing JAR artifacts in compilePath
  * [[MNG-7347](https://issues.apache.org/jira/browse/MNG-7347)] - SessionScoped \ 
beans should be singletons for a given session
  * [[MNG-7357](https://issues.apache.org/jira/browse/MNG-7357)] - All Maven \ 
Core JARs have unusual entry order
  * [[MNG-7362](https://issues.apache.org/jira/browse/MNG-7362)] - \ 
DefaultArtifactResolver has spurious "Failure detected" INFO log
  * [[MNG-7374](https://issues.apache.org/jira/browse/MNG-7374)] - Mutating \ 
RelocatedArtifact does not retain type
  * [[MNG-7386](https://issues.apache.org/jira/browse/MNG-7386)] - \ 
ModelMerger$MergingList is not serializable
  * [[MNG-7402](https://issues.apache.org/jira/browse/MNG-7402)] - \ 
BuildListCalculator never detaches the classloader
  * [[MNG-7417](https://issues.apache.org/jira/browse/MNG-7417)] - Several \ 
classes do not set properties properly for building requests

** New Feature

  * [[MNG-7395](https://issues.apache.org/jira/browse/MNG-7395)] - Support \ 
interpolation in extensions.xml
  * [[MNG-7407](https://issues.apache.org/jira/browse/MNG-7407)] - Introduce a \ 
ModelVersionProcessor component to make CI Friendly Versions pluggable

** Improvement

  * [[MNG-6960](https://issues.apache.org/jira/browse/MNG-6960)] - Use \ 
RuntimeInformation instead of reading properties
  * [[MNG-7349](https://issues.apache.org/jira/browse/MNG-7349)] - Limit \ 
relocation warning message to direct dependencies only
  * [[MNG-7380](https://issues.apache.org/jira/browse/MNG-7380)] - Don't log \ 
non-threadsafe warning if only building a single module
  * [[MNG-7381](https://issues.apache.org/jira/browse/MNG-7381)] - Shorten \ 
parallel builder thread name to artifactId, conditionally with groupId
  * [[MNG-7385](https://issues.apache.org/jira/browse/MNG-7385)] - Improve \ 
documentation on repository metadata
  * [[MNG-7400](https://issues.apache.org/jira/browse/MNG-7400)] - Allow more \ 
WorkspaceReaders to participate
  * [[MNG-7408](https://issues.apache.org/jira/browse/MNG-7408)] - Explain \ 
reporting plugin version automatic selection (in Maven 3)

** Dependency upgrade

  * [[MNG-7370](https://issues.apache.org/jira/browse/MNG-7370)] - Upgrade Maven \ 
Wagon to 3.5.1
  * [[MNG-7384](https://issues.apache.org/jira/browse/MNG-7384)] - Upgrade Maven \ 
JAR Plugin to 3.2.2
  * [[MNG-7428](https://issues.apache.org/jira/browse/MNG-7428)] - Upgrade Maven \ 
Parent to 35

3.8.4:

** Bug

  * [[MNG-7270](https://issues.apache.org/jira/browse/MNG-7270)] - Maven startup \ 
script (init) calls which(1) which is an external command
  * [[MNG-7285](https://issues.apache.org/jira/browse/MNG-7285)] - [Regression] \ 
MavenProject.getArtifacts() not returning correct value across multiple threads
  * [[MNG-7300](https://issues.apache.org/jira/browse/MNG-7300)] - [Regression] \ 
Reloading web application (Enter) fails due to java.lang.ClassNotFoundException

** Task

  * [[MNG-7312](https://issues.apache.org/jira/browse/MNG-7312)] - Revert \ 
ThreadLocal approach from MNG-6843 and MNG-7251

** Dependency upgrade

  * [[MNG-7331](https://issues.apache.org/jira/browse/MNG-7331)] - Upgrade Jansi \ 
to 2.4.0

Log message:
archivers: Replace RMD160 checksums with BLAKE2s checksums

All checksums have been double-checked against existing RMD160 and
SHA512 hashes

Could not be committed due to merge conflict:
devel/py-traitlets/distinfo

The following distfiles were unfetchable (note: some may be only fetched
conditionally):

./devel/pvs/distinfo pvs-3.2-solaris.tgz
./devel/eclipse/distinfo eclipse-sourceBuild-srcIncluded-3.0.1.zip

Log message:
apache-maven: update to 3.8.3.

3.8.3

** Bug
     * [MNG-7045] - Drop CDI API from Maven
     * [MNG-7214] - Bad transitive dependency parent from CDI API
     * [MNG-7215] - [Regression] Maven Site Plugin cannot resolve parent site \ 
descriptor without locale
     * [MNG-7216] - Revert MNG-7170
     * [MNG-7218] - [Regression] o.a.m.model.Build.getSourceDirectory() \ 
incorrectly returns absolute dir on 3.8.2
     * [MNG-7219] - [Regression] plexus-cipher missing from transitive dependencies
     * [MNG-7220] - [REGRESSION] test-classpath incorrectly resolved
     * [MNG-7251] - Fix threadLocalArtifactsHolder leaking into cloned project
     * [MNG-7253] - Relocation message is never shown

** New Feature
     * [MNG-7164] - Add constructor MojoExecutionException(Throwable)

** Improvement
     * [MNG-7235] - Speed improvements when calculating the sorted project graph
     * [MNG-7236] - The DefaultPluginVersionResolver should cache results for \ 
the session

** Task
     * [MNG-7252] - Fix warnings issued by dependency:analyze
     * [MNG-7254] - Expand Windows native libraries for Jansi due to JDK-8195129 \ 
(workaround)

3.8.2

** Sub-task
     * [MNG-6281] - ArrayIndexOutOfBoundsException caused by pom.xml with \ 
invalid/duplicate XML

** Bug
     * [MNG-4706] - Multithreaded building can create bad files for downloaded \ 
artifacts in local repository
     * [MNG-5307] - NPE during resolution of dependencies - parallel mode
     * [MNG-5315] - Artifact resolution sporadically fails in parallel builds
     * [MNG-5838] - Maven on No-File-Lock Systems
     * [MNG-5868] - Adding serval times the same artifact via MavenProjectHelper \ 
(attachArtifact) keep adding to the List duplicate artifacts
     * [MNG-6071] - GetResource ('/) returns 'null' if build is started with -f
     * [MNG-6216] - ArrayIndexOutOfBoundsException when parsing POM
     * [MNG-6239] - Jansi messes up System.err and System.out
     * [MNG-6380] - Option -Dstyle.color=always doesn't force color output
     * [MNG-6604] - Intermittent failures while downloading GAVs from Nexus
     * [MNG-6648] - 'mavenrc_pre' script does not receive arguments like mavenrc \ 
in Bourne shell does
     * [MNG-6719] - mvn color output escape keys w/ "| tee xxx.log" on \ 
Win with git/bash
     * [MNG-6737] - StackOverflowError when version ranges are unsolvable and \ 
graph contains a cycle
     * [MNG-6767] - Plugin with ${project.groupId} resolved improperly
     * [MNG-6819] - NullPointerException for DefaultArtifactDescriptorReader.loadPom
     * [MNG-6828] - DependencyResolutionException breaks serialization
     * [MNG-6842] - ProjectBuilderTest uses Guava, but Guava is not defined in \ 
dependencies
     * [MNG-6843] - Parallel build fails due to missing JAR artifacts in compilePath
     * [MNG-6850] - Prevent printing the EXEC_DIR when it's just a disk letter
     * [MNG-6921] - Maven compile with properties ${artifactId} and \ 
${project.build.finalName} occurs java.lang.NullPointerException
     * [MNG-6937] - StringSearchModelInterpolatorTest fails on symlinked paths
     * [MNG-6964] - Maven version sorting is internally inconsistent
     * [MNG-6983] - Plugin key can get out of sync with artifactId and groupId
     * [MNG-7000] - metadata.mdo contains invalid link to schema
     * [MNG-7032] - Option -B still showing formatting when used with --version
     * [MNG-7034] - StackOverflowError thrown if a cycle exists in BOM imports
     * [MNG-7090] - mvnDebug does not work on Java 11+
     * [MNG-7127] - NullPointerException in MavenCliTest.testStyleColors in JDK 16
     * [MNG-7155] - make sources jar reproducible (upgrade maven-source-plugin \ 
to 3.2.1)
     * [MNG-7161] - Error thrown during uninstalling of JAnsi

** New Feature
     * [MNG-7149] - Introduce MAVEN_DEBUG_ADDRESS in mvnDebug scripts

** Improvement
     * [MNG-2802] - Concurrent-safe access to local Maven repository
     * [MNG-6471] - Parallel builder should use  the module name as thread name
     * [MNG-6754] - Set the same timestamp in multi module builds
     * [MNG-6810] - Remove profiles in maven-model
     * [MNG-6811] - Remove unnecessary filtering configuration
     * [MNG-6816] - Prefer System.lineSeparator() over system properties
     * [MNG-6827] - Replace deprecated StringUtils#defaultString() from Plexus Utils
     * [MNG-6837] - Simplify detection of the MAVEN_HOME and make it fully \ 
qualified on Windows
     * [MNG-6844] - Use StandardCharsets and remove outdated @SuppressWarnings
     * [MNG-6853] - Don't box primitives where it's not needed
     * [MNG-6859] - Build not easily reproducible when built from source release \ 
archive
     * [MNG-6873] - Inconsistent library versions notice
     * [MNG-6967] - Improve the command line output from maven-artifact
     * [MNG-6987] - Reorder groupId before artifactId when writing an exclusion \ 
using maven-model
     * [MNG-7010] - Omit "NB: JAVA_HOME should point to a JDK not a \ 
JRE" except when that is the problem
     * [MNG-7064] - Use HTTPS for schema location in global settings.xml
     * [MNG-7080] - Add a --color option
     * [MNG-7170] - Allow to associate pomFile/${basedir} with \ 
DefaultProjectBuilder.build(ModelSource, ...)
     * [MNG-7180] - Make --color option behave more like BSD/GNU grep's --color \ 
option
     * [MNG-7181] - Make --version support -q
     * [MNG-7185] - Describe explicit and recommended version for \ 
VersionRange.createFromVersionSpec()
     * [MNG-7190] - Load mavenrc from /usr/local/etc also in Bourne shell script

** Task
     * [MNG-6598] - Maven 3.6.0 and Surefire problem
     * [MNG-6884] - Cleanup POM File after version upgrade
     * [MNG-7172] - Remove expansion of Jansi native libraries
     * [MNG-7184] - document .mavenrc/maven_pre.bat|cmd scripts and
MAVEN_SKIP_RC environment variable

3.8.1

This release with CVE fixes is a result based on the findings and feedback of \ 
Jonathan Leitschuh
and Olaf Flebbe.

One of the changes that might impact your builds is the way custom repositories \ 
defined in
dependency POMs will be handled.
By default external insecure repositories will now be blocked (localhost over \ 
HTTP will still
work).
Configuration can be adjusted via the conf/settings.xml.

Release Notes - Maven - Version 3.8.1

** Bug

    * [MNG-7128] - improve error message when blocked repository defined in build POM

** New Feature

    * [MNG-7116] - Add support for mirror selector on external:http:*
    * [MNG-7117] - Add support for blocking mirrors
    * [MNG-7118] - Block external HTTP repositories by default

** Dependency upgrade
    * [MNG-7119] - Upgrade Maven Wagon to 3.4.3
    * [MNG-7123] - Upgrade Maven Resolver to 1.6.2

Log message:
devel: Remove SHA1 hashes for distfiles

Log message:
Update apache-maven to 3.6.3. Closes PR pkg/55221.
The patch is provided by Vicente Chaves. Thank you!

Changes from Maven 3.6.2 to 3.6.3

* This is a regression release to fix some critical issues shipped with 3.6.2.
* Some license issues on binary distribution have been fixed.
* This Maven distribution is now Reproducible: if you download Maven source
  archive (apache-maven-3.6.3-src.zip or .tar.gz), build it on Windows with
  JDK 8 using following command:

See https://maven.apache.org/docs/3.6.3/release-notes.html for the detailed \ 
issue list.

Changes from Maven 3.6.1 to 3.6.2

* This release focuses mostly performance improvements, better memory footprint,
  and less CPU usage.
* We are continuing to convert Maven Core to use JSR 330 annotations instead of
  Plexus (still not finished, see MNG-5577).
* New support for 'release' qualifier (see MNG-6655).
* The toolchain.xml file supports environment variables (see MNG-6665).

See https://maven.apache.org/docs/3.6.2/release-notes.html for the detailed \ 
issue list.

Changes from Maven 3.6.0 to 3.6.1

* An issue has been fixed causing multiple executions of plugin goals, related
  to using parallel build options like mvn plugin:goal -T 4. This resulted in
  duplicated executions of phases. This has been fixed with MNG-5965.
* NullPointerException related to call in parallel build like mvn -T 1C clean
  javadoc:aggregate MNG-5705
* A performance issue related to artifact transfer has been found related to
  WAGON-537. It has been solved via the update to Maven Wagon 3.3.1.
* There had been issues related calling Maven script like this: mvn -f ..
* Having parentheses within the path, which has been fixed with MNG-6346.
* Script can break having special characters as part of the path, which has been
  solved with MNG-6256.
* Issue related to the Maven Resolver API which broke some IDEs (for example
  https://youtrack.jetbrains.com/issue/IDEA-201282); this has been fixed by MNG-6538.
* Issue related to missing event for ToolchainsBuildingResult on EventSpy MNG-6558.
* Issue related to support Java 9+ ClassLoader.findClass(String moduleName,
  String name) in Mojos. This has been fixed with MNG-6543.
* Improvement about the memory consumption has been done with MNG-6571.
* Issue related to relative parent POM resolution failing in 3.5.0 with complex
  multimodule builds has been fixed with MNG-6261.
* Missing export for org.slf4j.event.Level has been done with MNG-6618

See https://maven.apache.org/docs/3.6.1/release-notes.html for the detailed \ 
issue list.

# Changes from Maven 3.5.4 to 3.6.0

* There had been issues related to the project discoverytime which has been
  increased in previous version which influenced some of our users. This should
  have been fixed MNG-6311, MNG-6383 and MNG-6412.
* The output in the reactor summary has been improved MNG-6391 cause it confused
  people.
* There was an issue related to the classpath ordering MNG-6415 in Maven which
  can cause issues which has been fixed.
See https://maven.apache.org/docs/3.6.0/release-notes.html for the detailed \ 
issue list.

Log message:
apache-maven: darwin needs to be initialised to false.

Log message:
all: migrate several HOMEPAGEs to https

pkglint --only "https instead of http" -r -F

With manual adjustments afterwards since pkglint 19.4.4 fixed a few
indentations in unrelated lines.

This mainly affects projects hosted at SourceForce, as well as
freedesktop.org, CTAN and GNU.

Log message:
Update apache-maven to 3.5.4

Overview about the changes

   This release is primarily aimed to resolve the two regressions
   introduced in the 3.5.3 release, specifically MNG-6372 and MNG-6388.

   There are some additional minor improvements, the most notable of which
   is:
     * The Maven Super POM changes the default execution of the
       maven-source-plugin jar goal into jar-no-fork which should resolve
       some issues complex projects had running releases.

The detailed issue list

Bugs

     * MNG-6370 ConcurrencyDependencyGraph#getNumberOfBuilds() does not
       remove finished projects from unfinished ones
     * MNG-6372 On Windows Maven can output spurious ANSI escapes such as
       [0m [0m
     * MNG-6382 JANSI fails frequently with NumberFormatException when
       building in parallel
     * MNG-6386 ${project.baseUri} is not a valid URI (according to RFC
       3986)
     * MNG-6388 Error Fetching Artifacts: “[B cannot be cast to
       java.lang.String”
     * MNG-6403 Artifact#VERSION_FILE_PATTERN does not escape period
       between date and time
     * MNG-6410 Add groupId to --resume-from suggestion if artifactId is
       not unique in reactor

Improvements

     * MNG-5756 Java home output in mvn -v is misleading
     * MNG-5940 Change the maven-source-plugin jar goal into jar-no-fork
       in Maven Super POM
     * MNG-6362 Add documentation information for GitHub
     * MNG-6363 Remove secret thread configuration property from code
     * MNG-6364 Enhanced Jenkinsfile to test Core with JDK 9
     * MNG-6411 Improve readability of project list returned when
       --resume-from option value is invalid

Tasks

     * MNG-6377 switch from Git-WIP to Gitbox

Dependency upgrades

     * MNG-6344 Upgrade Guice to 4.2.0
     * MNG-6423 Upgrade to Wagon 3.1.0

https://maven.apache.org/docs/3.5.4/release-notes.html