Bump the commons group across 1 directory with 4 updates

Bumps the commons group with 4 updates in the / directory: [commons-net:commons-net](https://github.com/apache/commons-net), [commons-codec:commons-codec](https://github.com/apache/commons-codec), commons-io:commons-io and org.apache.commons:commons-lang3.


Updates `commons-net:commons-net` from 3.10.0 to 3.13.0
- [Changelog](https://github.com/apache/commons-net/blob/master/RELEASE-NOTES.txt)
- [Commits](https://github.com/apache/commons-net/compare/rel/commons-net-3.10.0...rel/commons-net-3.13.0)

Updates `commons-codec:commons-codec` from 1.17.1 to 1.22.0
- [Changelog](https://github.com/apache/commons-codec/blob/master/RELEASE-NOTES.txt)
- [Commits](https://github.com/apache/commons-codec/compare/rel/commons-codec-1.17.1...rel/commons-codec-1.22.0)

Updates `commons-io:commons-io` from 2.17.0 to 2.22.0

Updates `org.apache.commons:commons-lang3` from 3.18.0 to 3.20.0

---
updated-dependencies:
- dependency-name: commons-codec:commons-codec
  dependency-version: 1.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: commons
- dependency-name: commons-io:commons-io
  dependency-version: 2.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: commons
- dependency-name: commons-net:commons-net
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: commons
- dependency-name: org.apache.commons:commons-lang3
  dependency-version: 3.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: commons
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/dependabot.yml

@@ -0,0 +1,48 @@
+version: 2
+registries:
+  maven-alfresco-internal:
+    type: maven-repository
+    url: https://artifacts.alfresco.com/nexus/content/groups/internal
+    username: ${{secrets.NEXUS_USERNAME}}
+    password: ${{secrets.NEXUS_PASSWORD}}
+updates:
+  - package-ecosystem: "maven"
+    directory: "/"
+    registries:
+      - maven-alfresco-internal
+    schedule:
+      interval: "daily"
+      time: "22:00"
+      timezone: "Europe/London"
+    open-pull-requests-limit: 10
+    allow:
+      - dependency-type: "direct"
+    ignore:
+      - dependency-name: "org.alfresco.maven:*"
+      - dependency-name: "org.alfresco.maven.plugin:*"
+      - dependency-name: "org.alfresco.maven.archetype:*"
+    groups:
+      spring:
+        patterns:
+          - "org.springframework*"
+      alfresco:
+        patterns:
+          - "org.alfresco*"
+      apache-maven:
+        patterns:
+          - "org.apache.maven*"
+      commons:
+        patterns:
+          - "commons-*"
+          - "org.apache.commons*"
+      slf4j:
+        patterns:
+          - "org.slf4j*"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -19,7 +19,6 @@ env:
   MAVEN_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
   MAVEN_CENTRAL_USERNAME: ${{ secrets.OSS_SONATYPE_USERNAME }}
   MAVEN_CENTRAL_PASSWORD: ${{ secrets.OSS_SONATYPE_PASSWORD }}
-  GPG_SIGNING_PASSPHRASE: ${{ secrets.GPG_SIGNING_PASSPHRASE }}
   GITHUB_ACTIONS_DEPLOY_TIMEOUT: 90
 
 jobs:
@@ -35,7 +34,7 @@ jobs:
       github.ref_name == 'master' ||
       github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v15.7.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v15.7.1
         with:
@@ -56,7 +55,7 @@ jobs:
       MAVEN_CLI_OPTS: >
         -B -q -e -fae -V -DinstallAtEnd=true -U
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v15.7.1
         with:
           java-version: ${{ env.JAVA_VERSION }}
@@ -84,6 +83,12 @@ jobs:
           - name: "26.1 Community Java 21"
             java-version: 21
             suite: -Pcommunity-261-tests
+          - name: "25.4 Enterprise Java 17"
+            java-version: 17
+            suite: -Penterprise-254-tests
+          - name: "25.4 Community Java 17"
+            java-version: 17
+            suite: -Pcommunity-254-tests
           - name: "25.2 Enterprise Java 17"
             java-version: 17
             suite: -Penterprise-252-tests
@@ -136,18 +141,18 @@ jobs:
             java-version: 11
             suite: -Pcommunity-74-tests
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v15.7.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v15.7.1
         with:
           java-version: ${{ matrix.java-version }}
       - name: "Login to Docker Hub"
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: "Login to Quay.io"
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: quay.io
           username: ${{ secrets.QUAY_USERNAME }}
@@ -164,7 +169,7 @@ jobs:
     outputs:
         is_ga: ${{ steps.publish_version.outputs.is_ga }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v15.7.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v15.7.1
         with:
@@ -187,8 +192,10 @@ jobs:
     needs: [tests, check_version]
     if: >
       contains(github.event.head_commit.message, '[publish]') && needs.check_version.outputs.is_ga == 'true'
+    env:
+      GPG_SIGNING_PASSPHRASE: ${{ secrets.GPG_SIGNING_PASSPHRASE }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v15.7.1
       - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v15.7.1
         with:

.github/workflows/dependency-graph.yml

@@ -0,0 +1,27 @@
+name: "Load Dependency Graph"
+
+on:
+  push:
+    branches:
+      - "master"
+  schedule:
+    - cron: '0 6 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  scan-dependencies:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: Alfresco/alfresco-build-tools/.github/actions/maven-dependency-scan@v17.0.0
+        with:
+          java-version: '21'
+          maven-version: '3.9.9'
+          maven-args: -Dscopes=compile,runtime
+          maven-username: ${{ secrets.NEXUS_USERNAME }}
+          maven-password: ${{ secrets.NEXUS_PASSWORD }}
+          maven-settings-path: ".ci.settings.xml"

README.md

@@ -14,6 +14,7 @@ This project is released under the [Apache License, Version 2.0](http://www.apac
 If you are an Enterprise customer check the [Support](#alfresco-enterprise-customers-and-partners-support) section.
 
 ## News
+- 2026-03: Alfresco SDK 4.15.0 released
 - 2026-03: Alfresco SDK 4.14.0 released
 - 2026-01: Alfresco SDK 4.13.0 released
 - 2025-07: Alfresco SDK 4.12.0 released
@@ -84,7 +85,7 @@ the `alfresco.log` file has also been moved to a more appropriate location (Tomc
 
 In Q4 2020, Alfresco Platform has undergone a major structural refactoring.
 
-Depending on the Platform version desired, you might need to use SDK 4.1, 4.3, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10, 4.11, 4.12, 4.13 instead of SDK 4.14.0.
+Depending on the Platform version desired, you might need to use SDK 4.1, 4.3, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10, 4.11, 4.12, 4.13, 4.14 instead of SDK 4.15.0.
 
 - For Enterprise and Community versions of 7.x, SDK 4.4 or higher must be used
 - For Enterprise versions of 6.0.x, 6.1.x, 6.2.x newer than November 2020, SDK 4.3 must be used
@@ -105,6 +106,7 @@ To get started with **Alfresco SDK 4.14.x** (latest) visit the [Alfresco Documen
 #### Documentation about Previous Versions
 | SDK Version |                                         Alfresco Enterprise Version                                          |                                          Alfresco Community Version                                          | Documentation                                                                                                                                                                                                     |
 |-------------|:------------------------------------------------------------------------------------------------------------:|:------------------------------------------------------------------------------------------------------------:|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| SDK 4.15.0  | Alfresco 7.0.x / 7.1.x / 7.2.x / 7.3.x / 7.4.x / 23.1.x/ 23.2.x / 23.3.x / 23.4.x / 25.1.x / 25.2.x / 26.1.x | Alfresco 7.0.x / 7.1.x / 7.2.x / 7.3.x / 7.4.x / 23.1.x/ 23.2.x / 23.3.x / 23.4.x / 25.1.x / 25.2.x / 26.1.x | https://github.com/Alfresco/alfresco-sdk/tree/master/docs/README.md                                                                                                                                               |
 | SDK 4.14.0  | Alfresco 7.0.x / 7.1.x / 7.2.x / 7.3.x / 7.4.x / 23.1.x/ 23.2.x / 23.3.x / 23.4.x / 25.1.x / 25.2.x / 26.1.x | Alfresco 7.0.x / 7.1.x / 7.2.x / 7.3.x / 7.4.x / 23.1.x/ 23.2.x / 23.3.x / 23.4.x / 25.1.x / 25.2.x / 26.1.x | https://github.com/Alfresco/alfresco-sdk/tree/master/docs/README.md                                                                                                                                               |
 | SDK 4.13.0  |     Alfresco 7.0.x / 7.1.x / 7.2.x / 7.3.x / 7.4.x / 23.1.x/ 23.2.x / 23.3.x / 23.4.x / 25.1.x / 25.2.x      |     Alfresco 7.0.x / 7.1.x / 7.2.x / 7.3.x / 7.4.x / 23.1.x/ 23.2.x / 23.3.x / 23.4.x / 25.1.x / 25.2.x      | https://github.com/Alfresco/alfresco-sdk/tree/master/docs/README.md                                                                                                                                               |
 | SDK 4.12.0  |     Alfresco 7.0.x / 7.1.x / 7.2.x / 7.3.x / 7.4.x / 23.1.x/ 23.2.x / 23.3.x / 23.4.x / 25.1.x / 25.2.x      |     Alfresco 7.0.x / 7.1.x / 7.2.x / 7.3.x / 7.4.x / 23.1.x/ 23.2.x / 23.3.x / 23.4.x / 25.1.x / 25.2.x      | https://github.com/Alfresco/alfresco-sdk/tree/master/docs/README.md                                                                                                                                               |
@@ -174,7 +176,7 @@ To test new unreleased (unsupported) features, you can use the following snippet
 See the [Developers Wiki page](https://github.com/Alfresco/alfresco-sdk/wiki/Developer-Wiki).
 
 ## Publishing the release on Maven Central
-- Manually change the version from SNAPSHOT to final (eg. when releasing SDK 4.15.0, replacing all the occurrences of 4.15.0-SNAPSHOT with 4.15.0)
+- Manually change the version from SNAPSHOT to final (eg. when releasing SDK 4.16.0, replacing all the occurrences of 4.16.0-SNAPSHOT with 4.16.0)
 
 - Commit and push changes to GitHub with the commit message [publish], then it will automatically publish your artifacts to maven central
 - Only GA versions is published to maven central, there is a check in the CI pipeline (called "check_version") to check if the version is non-GA or not, and if it's not, it will skip the "publish" step. Therefore, only "number.number.number" versions will be published to maven central, and any version with a suffix (eg. -Ax, -SNAPSHOT, -RC1, -beta-1) will not be published to maven central.
@@ -183,6 +185,6 @@ At this point, we need to manually proceed with the remaining steps:
 
 1- Manually create a release tag on GitHub
 
-2- Manually change the version from final to next SNAPSHOT (eg. replacing all the occurrences of 4.14.0-SNAPSHOT with 4.15.0 (in pom.xml, not in READMEs - if not needed)
+2- Manually change the version from final to next SNAPSHOT (eg. replacing all the occurrences of 4.15.0-SNAPSHOT with 4.16.0 (in pom.xml, not in READMEs - if not needed)
 
 3- Commit and push on GitHub

archetypes/alfresco-allinone-archetype/pom.xml

@@ -11,7 +11,7 @@
   <parent>
     <groupId>org.alfresco.maven</groupId>
     <artifactId>alfresco-sdk-aggregator</artifactId>
-    <version>4.14.0</version>
+    <version>4.16.0-A2</version>
     <relativePath>../../pom.xml</relativePath>
   </parent>
 

archetypes/alfresco-allinone-archetype/src/main/resources/archetype-resources/pom.xml

@@ -5,8 +5,8 @@
     <groupId>${groupId}</groupId>
     <artifactId>${artifactId}</artifactId>
     <version>${version}</version>
-    <name>AIO - SDK 4.14.0</name>
+    <name>AIO - SDK 4.16.0-A2</name>
-    <description>All-In-One (AIO) project for SDK 4.14.0</description>
+    <description>All-In-One (AIO) project for SDK 4.16.0-A2</description>
     <packaging>pom</packaging>
 
     <prerequisites>

archetypes/alfresco-platform-jar-archetype/pom.xml

@@ -12,7 +12,7 @@
   <parent>
     <groupId>org.alfresco.maven</groupId>
     <artifactId>alfresco-sdk-aggregator</artifactId>
-    <version>4.14.0</version>
+    <version>4.16.0-A2</version>
     <relativePath>../../pom.xml</relativePath>
   </parent>
 

archetypes/alfresco-share-jar-archetype/pom.xml

@@ -14,7 +14,7 @@
     <parent>
         <groupId>org.alfresco.maven</groupId>
         <artifactId>alfresco-sdk-aggregator</artifactId>
-        <version>4.14.0</version>
+        <version>4.16.0-A2</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 

archetypes/archetypes-it/pom.xml

@@ -17,7 +17,7 @@
     <parent>
         <groupId>org.alfresco.maven</groupId>
         <artifactId>alfresco-sdk-aggregator</artifactId>
-        <version>4.14.0</version>
+        <version>4.16.0-A2</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 

modules/alfresco-rad/pom.xml

@@ -10,7 +10,7 @@
     <parent>
         <groupId>org.alfresco.maven</groupId>
         <artifactId>alfresco-sdk-aggregator</artifactId>
-        <version>4.14.0</version>
+        <version>4.16.0-A2</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 
@@ -38,6 +38,7 @@
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-context</artifactId>
+            <scope>provided</scope>
         </dependency>
 
         <!-- Access to JUnit runner classes -->

plugins/alfresco-maven-plugin/pom.xml

@@ -8,7 +8,7 @@
     <parent>
         <groupId>org.alfresco.maven</groupId>
         <artifactId>alfresco-sdk-aggregator</artifactId>
-        <version>4.14.0</version>
+        <version>4.16.0-A2</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 
@@ -112,17 +112,17 @@
         <dependency>
             <groupId>commons-net</groupId>
             <artifactId>commons-net</artifactId>
-            <version>3.10.0</version>
+            <version>3.13.0</version>
         </dependency>
         <dependency>
             <groupId>commons-codec</groupId>
             <artifactId>commons-codec</artifactId>
-            <version>1.17.1</version>
+            <version>1.22.0</version>
         </dependency>
         <dependency>
             <groupId>commons-io</groupId>
             <artifactId>commons-io</artifactId>
-            <version>2.17.0</version>
+            <version>2.22.0</version>
         </dependency>
         <dependency>
             <groupId>org.alfresco</groupId>
@@ -137,7 +137,7 @@
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-lang3</artifactId>
-            <version>3.18.0</version>
+            <version>3.20.0</version>
         </dependency>
         <dependency>
             <groupId>org.twdata.maven</groupId>

pom.xml

@@ -3,7 +3,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>org.alfresco.maven</groupId>
     <artifactId>alfresco-sdk-aggregator</artifactId>
-    <version>4.14.0</version>
+    <version>4.16.0-A2</version>
     <name>Alfresco SDK</name>
     <description>This aggregator Project builds all modules required for the Alfresco SDK</description>
     <packaging>pom</packaging>
@@ -56,9 +56,9 @@
         <alfresco.sdk.tests.exclude>*/*-enterprise*/*</alfresco.sdk.tests.exclude>
 
         <alfresco.bomDependency.artifactId>acs-community-packaging</alfresco.bomDependency.artifactId>
-        <alfresco.platform.version>26.1.0-A.14</alfresco.platform.version>
+        <alfresco.platform.version>26.1.0</alfresco.platform.version>
         <alfresco.platform.docker.user>alfresco</alfresco.platform.docker.user>
-        <alfresco.share.docker.version>26.1.0-A.14</alfresco.share.docker.version>
+        <alfresco.share.docker.version>26.1.0</alfresco.share.docker.version>
         <!--
              The following value is now obtained by looking at the
              - alfresco-community-share.version (eg. https://github.com/Alfresco/acs-community-packaging/blob/25.1.0/pom.xml#L17)
@@ -66,7 +66,7 @@
              - alfresco-enterprise-share.version (eg. https://github.com/Alfresco/acs-packaging/blob/25.1.0/pom.xml#L18)
              for the GitHub Tag related to the above Docker version.
          -->
-        <alfresco.share.version>26.1.0.30</alfresco.share.version>
+        <alfresco.share.version>26.1.0.45</alfresco.share.version>
         <alfresco.platform.docker.image>alfresco/alfresco-content-repository-community</alfresco.platform.docker.image>
         <alfresco.share.docker.image>alfresco/alfresco-share</alfresco.share.docker.image>
         <keystore.settings>
@@ -290,14 +290,40 @@
             </properties>
         </profile>
 
+        <!-- 25.4 -->
+        <profile>
+            <id>community-254-tests</id>
+            <properties>
+                <alfresco.bomDependency.artifactId>acs-community-packaging</alfresco.bomDependency.artifactId>
+                <alfresco.platform.version>25.4.0-A.10</alfresco.platform.version>
+                <alfresco.share.docker.version>25.4.0-A.10</alfresco.share.docker.version>
+                <alfresco.share.version>25.4.0.53</alfresco.share.version>
+                <alfresco.platform.docker.image>alfresco/alfresco-content-repository-community</alfresco.platform.docker.image>
+                <alfresco.share.docker.image>alfresco/alfresco-share</alfresco.share.docker.image>
+                <alfresco.platform.docker.user>alfresco</alfresco.platform.docker.user>
+            </properties>
+        </profile>
+        <profile>
+            <id>enterprise-254-tests</id>
+            <properties>
+                <alfresco.bomDependency.artifactId>acs-packaging</alfresco.bomDependency.artifactId>
+                <alfresco.platform.version>25.4.0-A.10</alfresco.platform.version>
+                <alfresco.share.docker.version>25.4.0-A.10</alfresco.share.docker.version>
+                <alfresco.share.version>25.4.0.53</alfresco.share.version>
+                <alfresco.platform.docker.image>quay.io/alfresco/alfresco-content-repository</alfresco.platform.docker.image>
+                <alfresco.share.docker.image>quay.io/alfresco/alfresco-share</alfresco.share.docker.image>
+                <alfresco.platform.docker.user>alfresco</alfresco.platform.docker.user>
+            </properties>
+        </profile>
+
         <!-- 26.1 -->
         <profile>
             <id>community-261-tests</id>
             <properties>
                 <alfresco.bomDependency.artifactId>acs-community-packaging</alfresco.bomDependency.artifactId>
-                <alfresco.platform.version>26.1.0-A.14</alfresco.platform.version>
+                <alfresco.platform.version>26.1.0</alfresco.platform.version>
-                <alfresco.share.docker.version>26.1.0-A.14</alfresco.share.docker.version>
+                <alfresco.share.docker.version>26.1.0</alfresco.share.docker.version>
-                <alfresco.share.version>26.1.0.30</alfresco.share.version>
+                <alfresco.share.version>26.1.0.45</alfresco.share.version>
                 <alfresco.platform.docker.image>alfresco/alfresco-content-repository-community</alfresco.platform.docker.image>
                 <alfresco.share.docker.image>alfresco/alfresco-share</alfresco.share.docker.image>
                 <alfresco.platform.docker.user>alfresco</alfresco.platform.docker.user>
@@ -307,9 +333,9 @@
             <id>enterprise-261-tests</id>
             <properties>
                 <alfresco.bomDependency.artifactId>acs-packaging</alfresco.bomDependency.artifactId>
-                <alfresco.platform.version>26.1.0-A.16</alfresco.platform.version>
+                <alfresco.platform.version>26.1.0</alfresco.platform.version>
-                <alfresco.share.docker.version>26.1.0-A.16</alfresco.share.docker.version>
+                <alfresco.share.docker.version>26.1.0</alfresco.share.docker.version>
-                <alfresco.share.version>26.1.0.30</alfresco.share.version>
+                <alfresco.share.version>26.1.0.45</alfresco.share.version>
                 <alfresco.platform.docker.image>quay.io/alfresco/alfresco-content-repository</alfresco.platform.docker.image>
                 <alfresco.share.docker.image>quay.io/alfresco/alfresco-share</alfresco.share.docker.image>
                 <alfresco.platform.docker.user>alfresco</alfresco.platform.docker.user>