From b7bdcdfa0abeb3e78067b2033160b1cb660ded7e Mon Sep 17 00:00:00 2001
From: Shinsuke Sugaya <shinsuke@apache.org>
Date: Sat, 25 Apr 2026 14:55:19 +0900
Subject: [PATCH 1/2] chore(deps): upgrade dependencies and move gpg signing to
 release profile

- Bump xmlsec 4.0.1 -> 4.0.4
- Bump commons-codec 1.16.0 -> 1.22.0
- Bump azure-security-keyvault-keys 4.7.3 -> 4.10.6
- Bump corelib 0.5.5 -> 0.7.1
- Bump commons-text 1.11.0 -> 1.15.0
- Bump mockito-core 5.6.0 -> 5.23.0
- Bump maven-compiler-plugin 3.11.0 -> 3.15.0
- Bump maven-javadoc-plugin 3.6.0 -> 3.12.0
- Bump maven-jar-plugin 3.3.0 -> 3.5.0
- Bump maven-surefire-plugin 2.22.2 -> 3.5.5
- Bump jacoco-maven-plugin 0.8.10 -> 0.8.14
- Bump central-publishing-maven-plugin 0.7.0 -> 0.10.0
- Move maven-gpg-plugin into a 'release' profile and enable bestPractices
---
 core/pom.xml |  6 +++---
 pom.xml      | 58 +++++++++++++++++++++++++++++++---------------------
 2 files changed, 38 insertions(+), 26 deletions(-)

diff --git a/core/pom.xml b/core/pom.xml
index 19ff91c..1f6bebb 100644
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -54,19 +54,19 @@
 		<dependency>
 			<groupId>org.apache.santuario</groupId>
 			<artifactId>xmlsec</artifactId>
-			<version>4.0.1</version>
+			<version>4.0.4</version>
 		</dependency>
 		<dependency>
 			<groupId>commons-codec</groupId>
 			<artifactId>commons-codec</artifactId>
-			<version>1.16.0</version>
+			<version>1.22.0</version>
 		</dependency>
 
 		<!-- Azure Key Vault -->
 		<dependency>
 			<groupId>com.azure</groupId>
 			<artifactId>azure-security-keyvault-keys</artifactId>
-			<version>4.7.3</version>
+			<version>4.10.6</version>
 			<optional>true</optional>
 		</dependency>
 		<dependency>
diff --git a/pom.xml b/pom.xml
index 4022eae..1c4665d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -42,8 +42,8 @@
 		<slf4j.version>1.7.36</slf4j.version>
 		<junit.version>4.13.2</junit.version>
 		<logback.version>1.4.14</logback.version>
-		<corelib.version>0.5.5</corelib.version>
-		<commons.text.version>1.11.0</commons.text.version>
+		<corelib.version>0.7.1</corelib.version>
+		<commons.text.version>1.15.0</commons.text.version>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 	</properties>
 	<dependencyManagement>
@@ -58,7 +58,7 @@
 			<dependency>
 				<groupId>org.mockito</groupId>
 				<artifactId>mockito-core</artifactId>
-				<version>5.6.0</version>
+				<version>5.23.0</version>
 				<scope>test</scope>
 			</dependency>
 			<dependency>
@@ -92,7 +92,7 @@
 			<plugins>
 				<plugin>
 					<artifactId>maven-compiler-plugin</artifactId>
-					<version>3.11.0</version>
+					<version>3.15.0</version>
 					<configuration>
 						<release>17</release>
 						<encoding>UTF-8</encoding>
@@ -113,7 +113,7 @@
 				</plugin>
 				<plugin>
 					<artifactId>maven-javadoc-plugin</artifactId>
-					<version>3.6.0</version>
+					<version>3.12.0</version>
 					<configuration>
 						<encoding>UTF-8</encoding>
 						<docencoding>UTF-8</docencoding>
@@ -124,11 +124,11 @@
 				</plugin>
 				<plugin>
 					<artifactId>maven-jar-plugin</artifactId>
-					<version>3.3.0</version>
+					<version>3.5.0</version>
 				</plugin>
 				<plugin>
 					<artifactId>maven-surefire-plugin</artifactId>
-					<version>2.22.2</version>
+					<version>3.5.5</version>
 					<configuration>
 						<useSystemClassLoader>false</useSystemClassLoader>
 					</configuration>
@@ -136,7 +136,7 @@
 				<plugin>
 					<groupId>org.jacoco</groupId>
 					<artifactId>jacoco-maven-plugin</artifactId>
-					<version>0.8.10</version>
+					<version>0.8.14</version>
 					<executions>
 						<execution>
 							<goals>
@@ -155,24 +155,10 @@
 			</plugins>
 		</pluginManagement>
 		<plugins>
-			<plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-gpg-plugin</artifactId>
-				<version>3.2.7</version>
-				<executions>
-					<execution>
-						<id>sign-artifacts</id>
-						<phase>verify</phase>
-						<goals>
-							<goal>sign</goal>
-						</goals>
-					</execution>
-				</executions>
-			</plugin>
 			<plugin>
 				<groupId>org.sonatype.central</groupId>
 				<artifactId>central-publishing-maven-plugin</artifactId>
-				<version>0.7.0</version>
+				<version>0.10.0</version>
 				<extensions>true</extensions>
 				<configuration>
 					<publishingServerId>central</publishingServerId>
@@ -180,4 +166,30 @@
 			</plugin>
 		</plugins>
 	</build>
+	<profiles>
+		<profile>
+			<id>release</id>
+			<build>
+				<plugins>
+					<plugin>
+						<groupId>org.apache.maven.plugins</groupId>
+						<artifactId>maven-gpg-plugin</artifactId>
+						<version>3.2.8</version>
+						<executions>
+							<execution>
+								<id>sign-artifacts</id>
+								<phase>verify</phase>
+								<goals>
+									<goal>sign</goal>
+								</goals>
+								<configuration>
+									<bestPractices>true</bestPractices>
+								</configuration>
+							</execution>
+						</executions>
+					</plugin>
+				</plugins>
+			</build>
+		</profile>
+	</profiles>
 </project>

From 0c981962b5c6f40a3a6093fc9dcdb1e8467f8252 Mon Sep 17 00:00:00 2001
From: Shinsuke Sugaya <shinsuke@apache.org>
Date: Sat, 25 Apr 2026 15:13:07 +0900
Subject: [PATCH 2/2] fix(ci): pin corelib to 0.6.0 for Java 17 and trigger CI
 on PR only

corelib 0.7.0+ is compiled for Java 21 (class file 65), which breaks the
Java 17 build (expects 61). 0.6.0 is the latest release still targeting
Java 17.

Also limit the workflow to pull_request and workflow_dispatch so CI no
longer runs twice on push + PR for the same commit.
---
 .github/workflows/maven.yml | 2 +-
 pom.xml                     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 3e04d3a..8673b9c 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -3,7 +3,7 @@
 
 name: java-saml CI with Maven
 
-on: [push, pull_request, workflow_dispatch]
+on: [pull_request, workflow_dispatch]
 
 jobs:
   test:
diff --git a/pom.xml b/pom.xml
index 1c4665d..8782a0a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -42,7 +42,7 @@
 		<slf4j.version>1.7.36</slf4j.version>
 		<junit.version>4.13.2</junit.version>
 		<logback.version>1.4.14</logback.version>
-		<corelib.version>0.7.1</corelib.version>
+		<corelib.version>0.6.0</corelib.version>
 		<commons.text.version>1.15.0</commons.text.version>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 	</properties>