All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog
and this project adheres to Semantic Versioning.
Entries from 1.1.0 onwards are generated by release-please from the commit history. Migration steps
live in UPGRADING.md, which is written by hand.
1.1.0 (2026-08-14)
- build: record and verify build reproducibility (abd46e9)
- checksums: allow opting out of the SDK's upload checksum trailer (8070b78)
- config: add retry, directory upload and module metadata (f2183a5)
- credentials: support session tokens, named profiles and assumed roles (58a019d)
- diagnostics: log the resolved endpoint, region and credential source (7d9ac92)
- downloads: add ranged parallel downloads, off by default (1c370bf)
- listing: implement getFileList with ListObjectsV2 (6078b77)
- metadata: publish object size and age to transfer listeners (f23c271)
- multipart: upload parts in parallel, and support storage class and tags (5124db8)
- s3: support SSE, canned ACLs, custom endpoints and path-style access (5b0225d)
- streaming: implement StreamingWagon (be8d01e)
- uploads: upload large artifacts as a multipart upload (7ce9ad4)
- avoid retries for missing S3 resources (877339b)
- aws-sdk 2.17.295 -> 2.19.14, add OIDC module (5a442db)
- ci: correct the vulnerability scan invocation and let javadoc skip (39597e0)
- ci: repair the two workflows CI actually rejected (2d78577)
- connection: guard closeConnection against a client that was never built (02bf75e)
- deps: raise plexus-utils past CVE-2025-67030 (895495e)
- errors: map every SDK failure onto the Wagon exception contract (394267d)
- events: report uploads to transfer listeners, and downloads only once (eb43b4e)
- freshness: compare last-modified timestamps in milliseconds (dc4629b)
- fuzz: let ClusterFuzzLite find the targets it just built (6ee0c53)
- keys: normalise the base directory when building S3 keys (df06b0f)
- maven: register the s3 scheme alongside s3p (5771226)
- proxy: give the proxy endpoint a scheme so it is actually used (dc97632)
- proxy: report a malformed proxy host instead of crashing (746a262)
- release: keep GPG output out of the Python source (67103f7)
- release: stop deploying an SBOM Clojars will reject (3c034e2)
- timeouts: apply Maven's connect and read timeouts to the HTTP client (773ccf0)
- uploads: stream artifacts instead of buffering them into a byte array (c225158)
- actions: adopt pinact and make the version comments exact (98a4a01)
- deps: bump to AWS SDK 2.51.4 and drop the Jackson release candidate (479054d)
- deps: clear the commons-compress advisories, and run Scorecard on pull requests (bbb52c8)
- fuzz: verify the Maven tarball before trusting it (3302408)
- mise: add actionlint and act-based workflow checks (b1d9e9b)
- mise: lock a checksum for every pinned tool (557e41d)
- mise: pin actionlint and add a release preview task (e8cdb0f)
- mise: pin java (zulu) and maven toolchain with build tasks (c50f46a)
- pom: add publishing metadata and attach a source jar (47398f2)
- quality: add static analysis, an SBOM, javadoc and reproducible jars (c756009)
- quality: enforce formatting with spotless (fbf792f)
- renovate: automate dependency updates (f09b08b)
- sbom: describe what ships, and add a local scorecard task (587e461)
- Treat generic S3 HTTP 404 responses as missing resources instead of retryable transfer failures
- Updated the AWS SDK from 2.17.x to 2.19.14 to fix authentication problems resulting from the AWS CLI (around 2.9.14) changing its configuration format for
~/.aws/config (splitting sso properties to a separate configuration section) - Added the AWS SDK OIDC plugin required when using SSO with OIDC