Planned releases for September 2026 — Doxia stack, plugins, shared deps

# Planned releases — September 2026 (Doxia stack + plugins + shared deps)

Tracking issue for the September 2026 release round. Survey done 2026-09-09 against the Maven estate checkouts

## Pre-round: shared deps with unreleased fixes (release FIRST)

| Dep | Release | Benefit for our round |
|---|---|---|
| [`maven-shared-utils`](https://github.com/apache/maven-shared-utils) | **3.5.0 minor, not 3.4.3** (japicmp: `Commandline`/`Shell` drop `Cloneable`; 30 new `@Deprecated` incl. whole `xml` package; `jsr305`→`jspecify` compile scope; commons-io 2.11→2.22; plus the threading/SIOOBE/Windows fixes) — pom says 3.4.3-SNAPSHOT but milestone is 3.5.0, bump pom first; merge PRs apache/maven-shared-utils#395 + apache/maven-shared-utils#393, slip apache/maven-shared-utils#391, apache/maven-shared-utils#377 blocked | impl, site-plugin, help, invoker, dependency, javadoc, compiler, surefire (all pin 3.4.2) |
| [`maven-script-interpreter`](https://github.com/apache/maven-script-interpreter) | **1.9** (FileLogger NPE apache/maven-script-interpreter#204; 1.8 w/ bytecode-target apache/maven-script-interpreter#201 released 04 Sep) | invoker-plugin pins 1.7 → bump straight to 1.9 |
| [`maven-shared-jar`](https://github.com/apache/maven-shared-jar) | **3.2.1** (SHA-1 all-entries apache/maven-shared-jar#147, inner-class UTF-8 apache/maven-shared-jar#140) | MPIR pins 3.2.0 |

Already released, just bump pins: [dependency-analyzer](https://github.com/apache/maven-dependency-analyzer) `1.17.2` (05 Sep), [resolver](https://github.com/apache/maven-resolver) `1.9.27`.

Skip (bumps/docs only, release after): [archiver](https://github.com/apache/maven-archiver) 3.6.7, [filtering](https://github.com/apache/maven-filtering) 3.5.2,
invoker-shared 3.3.1, [dep-tree](https://github.com/apache/maven-dependency-tree) 3.3.1, filters 3.4.1, [harness-3.x](https://github.com/apache/maven-plugin-testing/tree/maven-plugin-testing-3.x).

## Main round

| Component | Release | Owner | Notes |
|---|---|---|---|
| [doxia](https://github.com/apache/maven-doxia) | **2.2.0** (minor) | | New `HtmlTag`, Markdown sink fixes, APT macro fix, japicmp BBC |
| [reporting-api](https://github.com/apache/maven-reporting-api) | **4.0.1** | | Default `getOutputName()` |
| [sitetools](https://github.com/apache/maven-doxia-sitetools) | **2.1.1** | | apache/maven-doxia-sitetools#639 ISE fix on deprecated `DocumentRenderingContext` |
| [reporting-impl](https://github.com/apache/maven-reporting-impl) | **4.0.1** | | Doxia-1 verbatim compat; bump `reportingApiVersion→4.0.1` |
| [reporting-exec](https://github.com/apache/maven-reporting-exec) | **2.1.0** (minor) | | Drops deprecated `localRepository`; bump hardcoded api; push `drop-maven-compat` branch first |
| [site-plugin](https://github.com/apache/maven-site-plugin) | **3.23.0** (minor, not patch) | | `site:run` Jetty 9 → JDK `HttpServer` (#1298); bump exec `2.0.1→2.1.0`; clean up `site-run-without-jetty` branch |
| [fluido-skin](https://github.com/apache/maven-fluido-skin) | **2.2.0** (minor) | | SCM last-modified date; re-verify ITs on site-plugin 3.23.0 |
| [project-info-reports](https://github.com/apache/maven-project-info-reports-plugin) | **3.10.0** (minor) | | MPIR-477 Resolver API migration |
| [dependency-plugin](https://github.com/apache/maven-dependency-plugin) (+script-interpreter/resolver/analyzer bumps) | **3.12.0** (minor) | | MDEP-858 Resolver migration, MDEP-927/425/870; push `ci-verify-maven-baseline` first |
| [pmd-plugin](https://github.com/apache/maven-pmd-plugin) | **3.29.0** (minor) | @adangel ([volunteered](https://github.com/apache/maven/issues/13085#issuecomment-5615442469)) | New threads control apache/maven-pmd-plugin#700; PMD 7.27.0 apache/maven-pmd-plugin#729; |
| [help-plugin](https://github.com/apache/maven-help-plugin) | **3.5.3** | | MPH-210 apache/maven-help-plugin#327, apache/maven-help-plugin#393, Maven4 fixes |
| [invoker-plugin](https://github.com/apache/maven-invoker-plugin) (+script-interpreter 1.9) | **3.10.2** | | |
| [javadoc-plugin](https://github.com/apache/maven-javadoc-plugin) | **3.12.1** | | Java25 fixes |
| [checkstyle-plugin](https://github.com/apache/maven-checkstyle-plugin) | **3.6.1** | | |
| [jxr](https://github.com/apache/maven-jxr) | **3.6.1** | | Wagon → URI |
| [surefire](https://github.com/apache/maven-surefire) (master) | **3.6.1** | | ForkStarter filter apache/maven-surefire#3453; rebase local branch |
| [changes-plugin](https://github.com/apache/maven-changes-plugin) | **3.0.0-M4** | | |
| [plugin-tools](https://github.com/apache/maven-plugin-tools) 4.x | skip (only release-prepare since beta-3) | | |

## 3.x maintenance lines

`deploy/install **3.1.5**` (security backports), `source **3.5.0**` (new `followSymlinks` → minor),
`surefire **3.5.7**` (backports apache/maven-surefire#3428/apache/maven-surefire#3412). Rest refresh-only or skip
(compiler-3.x, plugin-tools-3.x: release-prepare only).

## Order

`shared-utils 3.4.3 → script-interpreter 1.9 → shared-jar 3.2.1 → doxia 2.2.0 →
reporting-api 4.0.1 → sitetools 2.1.1 → reporting-impl 4.0.1 → reporting-exec 2.1.0 →
site-plugin 3.23.0 → fluido 2.2.0 → reporting/core/packaging plugins` (+ 3.x side any order).