Log Message:
Pullup ticket #6518 - requested by wiz
devel/apache-maven: security fix

Revisions pulled up:
- devel/apache-maven/Makefile                                   1.18
- devel/apache-maven/PLIST                                      1.12
- devel/apache-maven/distinfo                                   1.20
- devel/apache-maven/patches/patch-bin_mvn                      1.9

---
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Fri Oct  8 15:08:21 UTC 2021

   Modified Files:
   	pkgsrc/devel/apache-maven: Makefile PLIST distinfo
   	pkgsrc/devel/apache-maven/patches: patch-bin_mvn

   Log Message:
   apache-maven: update to 3.8.3.

   3.8.3

   ** Bug
        * [MNG-7045] - Drop CDI API from Maven
        * [MNG-7214] - Bad transitive dependency parent from CDI API
        * [MNG-7215] - [Regression] Maven Site Plugin cannot resolve parent site \ 
descriptor without locale
        * [MNG-7216] - Revert MNG-7170
        * [MNG-7218] - [Regression] o.a.m.model.Build.getSourceDirectory() \ 
incorrectly returns absolute dir on 3.8.2
        * [MNG-7219] - [Regression] plexus-cipher missing from transitive \ 
dependencies
        * [MNG-7220] - [REGRESSION] test-classpath incorrectly resolved
        * [MNG-7251] - Fix threadLocalArtifactsHolder leaking into cloned project
        * [MNG-7253] - Relocation message is never shown

   ** New Feature
        * [MNG-7164] - Add constructor MojoExecutionException(Throwable)

   ** Improvement
        * [MNG-7235] - Speed improvements when calculating the sorted project graph
        * [MNG-7236] - The DefaultPluginVersionResolver should cache results for \ 
the session

   ** Task
        * [MNG-7252] - Fix warnings issued by dependency:analyze
        * [MNG-7254] - Expand Windows native libraries for Jansi due to \ 
JDK-8195129 (workaround)

   3.8.2

   ** Sub-task
        * [MNG-6281] - ArrayIndexOutOfBoundsException caused by pom.xml with \ 
invalid/duplicate XML

   ** Bug
        * [MNG-4706] - Multithreaded building can create bad files for \ 
downloaded artifacts in local repository
        * [MNG-5307] - NPE during resolution of dependencies - parallel mode
        * [MNG-5315] - Artifact resolution sporadically fails in parallel builds
        * [MNG-5838] - Maven on No-File-Lock Systems
        * [MNG-5868] - Adding serval times the same artifact via \ 
MavenProjectHelper (attachArtifact) keep adding to the List duplicate artifacts
        * [MNG-6071] - GetResource ('/) returns 'null' if build is started with -f
        * [MNG-6216] - ArrayIndexOutOfBoundsException when parsing POM
        * [MNG-6239] - Jansi messes up System.err and System.out
        * [MNG-6380] - Option -Dstyle.color=always doesn't force color output
        * [MNG-6604] - Intermittent failures while downloading GAVs from Nexus
        * [MNG-6648] - 'mavenrc_pre' script does not receive arguments like \ 
mavenrc in Bourne shell does
        * [MNG-6719] - mvn color output escape keys w/ "| tee xxx.log" \ 
on Win with git/bash
        * [MNG-6737] - StackOverflowError when version ranges are unsolvable and \ 
graph contains a cycle
        * [MNG-6767] - Plugin with ${project.groupId} resolved improperly
        * [MNG-6819] - NullPointerException for \ 
DefaultArtifactDescriptorReader.loadPom
        * [MNG-6828] - DependencyResolutionException breaks serialization
        * [MNG-6842] - ProjectBuilderTest uses Guava, but Guava is not defined \ 
in dependencies
        * [MNG-6843] - Parallel build fails due to missing JAR artifacts in \ 
compilePath
        * [MNG-6850] - Prevent printing the EXEC_DIR when it's just a disk letter
        * [MNG-6921] - Maven compile with properties ${artifactId} and \ 
${project.build.finalName} occurs java.lang.NullPointerException
        * [MNG-6937] - StringSearchModelInterpolatorTest fails on symlinked paths
        * [MNG-6964] - Maven version sorting is internally inconsistent
        * [MNG-6983] - Plugin key can get out of sync with artifactId and groupId
        * [MNG-7000] - metadata.mdo contains invalid link to schema
        * [MNG-7032] - Option -B still showing formatting when used with --version
        * [MNG-7034] - StackOverflowError thrown if a cycle exists in BOM imports
        * [MNG-7090] - mvnDebug does not work on Java 11+
        * [MNG-7127] - NullPointerException in MavenCliTest.testStyleColors in JDK 16
        * [MNG-7155] - make sources jar reproducible (upgrade \ 
maven-source-plugin to 3.2.1)
        * [MNG-7161] - Error thrown during uninstalling of JAnsi

   ** New Feature
        * [MNG-7149] - Introduce MAVEN_DEBUG_ADDRESS in mvnDebug scripts

   ** Improvement
        * [MNG-2802] - Concurrent-safe access to local Maven repository
        * [MNG-6471] - Parallel builder should use  the module name as thread name
        * [MNG-6754] - Set the same timestamp in multi module builds
        * [MNG-6810] - Remove profiles in maven-model
        * [MNG-6811] - Remove unnecessary filtering configuration
        * [MNG-6816] - Prefer System.lineSeparator() over system properties
        * [MNG-6827] - Replace deprecated StringUtils#defaultString() from \ 
Plexus Utils
        * [MNG-6837] - Simplify detection of the MAVEN_HOME and make it fully \ 
qualified on Windows
        * [MNG-6844] - Use StandardCharsets and remove outdated @SuppressWarnings
        * [MNG-6853] - Don't box primitives where it's not needed
        * [MNG-6859] - Build not easily reproducible when built from source \ 
release archive
        * [MNG-6873] - Inconsistent library versions notice
        * [MNG-6967] - Improve the command line output from maven-artifact
        * [MNG-6987] - Reorder groupId before artifactId when writing an \ 
exclusion using maven-model
        * [MNG-7010] - Omit "NB: JAVA_HOME should point to a JDK not a \ 
JRE" except when that is the problem
        * [MNG-7064] - Use HTTPS for schema location in global settings.xml
        * [MNG-7080] - Add a --color option
        * [MNG-7170] - Allow to associate pomFile/${basedir} with \ 
DefaultProjectBuilder.build(ModelSource, ...)
        * [MNG-7180] - Make --color option behave more like BSD/GNU grep's \ 
--color option
        * [MNG-7181] - Make --version support -q
        * [MNG-7185] - Describe explicit and recommended version for \ 
VersionRange.createFromVersionSpec()
        * [MNG-7190] - Load mavenrc from /usr/local/etc also in Bourne shell script

   ** Task
        * [MNG-6598] - Maven 3.6.0 and Surefire problem
        * [MNG-6884] - Cleanup POM File after version upgrade
        * [MNG-7172] - Remove expansion of Jansi native libraries
        * [MNG-7184] - document .mavenrc/maven_pre.bat|cmd scripts and
   MAVEN_SKIP_RC environment variable

   3.8.1

   This release with CVE fixes is a result based on the findings and feedback of \ 
Jonathan Leitschuh
   and Olaf Flebbe.

   One of the changes that might impact your builds is the way custom \ 
repositories defined in
   dependency POMs will be handled.
   By default external insecure repositories will now be blocked (localhost over \ 
HTTP will still
   work).
   Configuration can be adjusted via the conf/settings.xml.

   Release Notes - Maven - Version 3.8.1

   ** Bug

       * [MNG-7128] - improve error message when blocked repository defined in \ 
build POM

   ** New Feature

       * [MNG-7116] - Add support for mirror selector on external:http:*
       * [MNG-7117] - Add support for blocking mirrors
       * [MNG-7118] - Block external HTTP repositories by default

   ** Dependency upgrade
       * [MNG-7119] - Upgrade Maven Wagon to 3.4.3
       * [MNG-7123] - Upgrade Maven Resolver to 1.6.2