Informational 15 Bitcoin Committed Sep 17, 2026 · 15:58 UTC

Update build to improve release process (#3381)

c3e9f5d6 View source ↗

Public commit record

What the developer wrote

Authored by Fabrice Drouin

86/100 · Strong

Update build to improve release process (#3381)

* Update maven plugins

* Don't store commit id in eclair-core jar manifest

It creates a chicken-and-egg problem if you want to commit the checksum of eclair-core.jar to .mvn/checksums/checksums-workspace.sha256.

* Add maven profile for eclair-fuzz

To build eclair-fuzz, use the with-eclair-fuzz profile with -Pwith-eclair-fuzz

✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference

The short version

What changed, and why it matters

This commit is a routine build-system update. It upgrades several Maven plugin versions, removes the git commit ID from one jar manifest field to avoid a build-time circular dependency, and adds an optional build profile for a fuzz-testing module. There are no code changes that affect how the software runs or how users interact with it.

Recommended action

No security action required. Treat as normal build maintenance; review plugin release notes for routine compatibility if desired.

Security signals we found

No strong security signals were identified.

Technical analysis

Evidence from the diff

The patch updates pom.xml files: maven-assembly-plugin 3.6.0→3.8.0, versions-maven-plugin 2.7→2.22.0, scala-maven-plugin 4.8.1→4.9.10, maven-source-plugin 3.3.0→3.4.0, build-helper-maven-plugin 3.4.0→3.6.2, maven-surefire-plugin 3.1.2→3.6.0. It removes explicit plugin version overrides in eclair-front and eclair-node so they inherit the parent version. It removes the Specification-Version manifest entry containing ${git.commit.id} from eclair-core because that created a chicken-and-egg problem when committing a reproducible checksum of eclair-core.jar. It adds a with-eclair-fuzz Maven profile to optionally include the eclair-fuzz module. No runtime code, cryptography, network handling, or configuration defaults are changed.

Changed components

Maven build configuration (pom.xml files)eclair-core jar manifest generationeclair-front assembly plugin configurationeclair-node assembly plugin configuration

Inspect captured patch +834 / −10

### .mvn/checksums/checksums-central.sha256
[binary or diff unavailable]

### eclair-core/pom.xml
@@ -62,8 +62,6 @@
                             <addDefaultImplementationEntries>true</addDefaultImplementationEntries>
                         </manifest>
                         <manifestEntries>
-                            <!-- we hide the git commit in the Specification-Version standard field-->
-                            <Specification-Version>${git.commit.id}</Specification-Version>
                             <Url>${project.parent.url}</Url>
                         </manifestEntries>
                     </archive>

### eclair-front/pom.xml
@@ -50,7 +50,6 @@
             </plugin>
             <plugin>
                 <artifactId>maven-assembly-plugin</artifactId>
-                <version>3.6.0</version>
                 <configuration>
                     <finalName>${project.name}-${project.version}-${git.commit.id.abbrev}</finalName>
                     <descriptors>

### eclair-node/pom.xml
@@ -50,7 +50,6 @@
             </plugin>
             <plugin>
                 <artifactId>maven-assembly-plugin</artifactId>
-                <version>3.6.0</version>
                 <configuration>
                     <finalName>${project.name}-${project.version}-${git.commit.id.abbrev}</finalName>
                     <descriptors>

### pom.xml
@@ -115,13 +115,13 @@
             </plugin>
             <plugin>
                 <artifactId>maven-assembly-plugin</artifactId>
-                <version>3.6.0</version>
+                <version>3.8.0</version>
                 <inherited>true</inherited>
             </plugin>
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>versions-maven-plugin</artifactId>
-                <version>2.7</version>
+                <version>2.22.0</version>
             </plugin>
             <plugin>
                 <groupId>pl.project13.maven</groupId>
@@ -141,7 +141,7 @@
             <plugin>
                 <groupId>net.alchim31.maven</groupId>
                 <artifactId>scala-maven-plugin</artifactId>
-                <version>4.8.1</version>
+                <version>4.9.10</version>
                 <configuration>
                     <args combine.children="append">
                         <arg>-feature</arg>
@@ -184,7 +184,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-source-plugin</artifactId>
-                <version>3.3.0</version>
+                <version>3.4.0</version>
                 <executions>
                     <execution>
                         <id>attach-sources</id>
@@ -197,7 +197,7 @@
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>build-helper-maven-plugin</artifactId>
-                <version>3.4.0</version>
+                <version>3.6.2</version>
                 <executions>
                     <execution>
                         <id>add-source</id>
@@ -229,7 +229,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
-                <version>3.1.2</version>
+                <version>3.6.0</version>
                 <configuration>
                     <skipTests>true</skipTests>
                 </configuration>
@@ -295,4 +295,13 @@
             <scope>test</scope>
         </dependency>
     </dependencies>
+
+    <profiles>
+        <profile>
+            <id>with-eclair-fuzz</id>
+            <modules>
+                <module>eclair-fuzz</module>
+            </modules>
+        </profile>
+    </profiles>
 </project>

Risk score

Why this scored 15/100

Our methodology →

Potential impact 0/30

Exploitability 0/25

Stealth signal 0/15

Affected reach 0/15

Confidence 10/10

Evidence quality 5/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 15/100

Community notes

Related watches

Reject API access from browsers (#3380)

Back to dev (#3379)

Improve the deterministic build (#3378)