SUSE-SU-2026:21608-1

Description of the patch:

This update for ongres-scram, ongres-stringprep, plexus-testing, maven, maven-doxia, mojo-parent, sisu fixes the following issues:

Changes in ongres-scram:

• Version 3.2

  • Fix Timing Attack Vulnerability in SCRAM Authentication (bsc#1250399, CVE-2025-59432)
  • Updated dependencies and maven plugins
  • Use central-publishing-maven-plugin to deploy to Maven Central.

• Do not create multirelease jar if the only Java 9+ class file is module-info.class

Changes in ongres-stringprep:

• Do not create multirelease jar if the only Java 9+ class file is module-info.class

Changes in plexus-testing:

• The build without tests does not need the full junit5; the junit5-minimal (built with ant) is enough

Changes in maven:

• Upgrade to upstream version 3.9.14

  • Bug Fixes

    • plexus-testing dependencies should be used in test scope

• Upgrade to upstream version 3.9.13

  • Bug Fixes

    • Bug: SecDispatcher is managed by legacy Plexus DI
    • [3.9.x] MavenPluginJavaPrerequisiteChecker: Handle 8/1.8 Java version in ranges as well

  • Maintenance

    • Update Maven plugin versions in default-bindings.xml
    • Migrate to JUnit 5 - avoid using TestCase

Changes in maven-doxia:

Upgrade to upstream version 2.1.0:

• New features and improvements

  • Distinguish between linebreaks for formatting markup and linebreaks in output
  • Return SinkEventAttributes instead of super class MutableAttributeSet for filterAttributes
  • Optionally leave fragments of internal links untouched Support strikethrough for Markdown sink
  • DOXIA-770: Only escape when necessary
  • DOXIA-760: Clarify table justification semantics and introduce new "JUSTIFY_DEFAULT" alignment
  • DOXIA-756: Allow to customize macro execution
  • DOXIA-759: Support anchors in MarkdownSink

• Bug Fixes

  • MarkdownSink: Fix verbatim inside table cell
  • Make sure to emit metadata prior everything else
  • Convert...