From 523e6315d159739cba8ba5f8e272bb77f6809d82 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 19 Jan 2026 13:49:42 +0000
Subject: [PATCH 1/2] Bump org.codehaus.plexus:plexus-archiver from 4.2.7 to
 4.11.0

Bumps [org.codehaus.plexus:plexus-archiver](https://github.com/codehaus-plexus/plexus-archiver) from 4.2.7 to 4.11.0.
- [Release notes](https://github.com/codehaus-plexus/plexus-archiver/releases)
- [Changelog](https://github.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md)
- [Commits](https://github.com/codehaus-plexus/plexus-archiver/compare/plexus-archiver-4.2.7...plexus-archiver-4.11.0)

---
updated-dependencies:
- dependency-name: org.codehaus.plexus:plexus-archiver
  dependency-version: 4.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 tooling/karaf-maven-plugin/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tooling/karaf-maven-plugin/pom.xml b/tooling/karaf-maven-plugin/pom.xml
index 4ae27ded55b..6216b70ec4f 100644
--- a/tooling/karaf-maven-plugin/pom.xml
+++ b/tooling/karaf-maven-plugin/pom.xml
@@ -169,7 +169,7 @@
         <dependency>
             <groupId>org.codehaus.plexus</groupId>
             <artifactId>plexus-archiver</artifactId>
-            <version>4.2.7</version>
+            <version>4.11.0</version>
         </dependency>
         <dependency>
             <groupId>org.apache.felix</groupId>

From 56c95b26450e4cf6a19df1a6ce7a86a3fb9793ba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?JB=20Onofr=C3=A9?= <jb.onofre@dremio.com>
Date: Sat, 24 Jan 2026 12:49:15 +0100
Subject: [PATCH 2/2] Fix the way to deal with temp files in the KarMojo

---
 .../org/apache/karaf/tooling/KarMojo.java     | 25 ++++++++++++-------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/tooling/karaf-maven-plugin/src/main/java/org/apache/karaf/tooling/KarMojo.java b/tooling/karaf-maven-plugin/src/main/java/org/apache/karaf/tooling/KarMojo.java
index 75b96aa6fe8..9c7b7d003a8 100644
--- a/tooling/karaf-maven-plugin/src/main/java/org/apache/karaf/tooling/KarMojo.java
+++ b/tooling/karaf-maven-plugin/src/main/java/org/apache/karaf/tooling/KarMojo.java
@@ -50,13 +50,13 @@
 import org.apache.maven.artifact.resolver.ArtifactResolutionException;
 import org.apache.maven.plugin.MojoExecutionException;
 import org.apache.maven.plugin.MojoFailureException;
-import org.apache.maven.plugins.annotations.Component;
 import org.apache.maven.plugins.annotations.LifecyclePhase;
 import org.apache.maven.plugins.annotations.Mojo;
 import org.apache.maven.plugins.annotations.Parameter;
 import org.apache.maven.plugins.annotations.ResolutionScope;
-import org.codehaus.plexus.archiver.Archiver;
 import org.codehaus.plexus.archiver.jar.JarArchiver;
+import javax.inject.Inject;
+import javax.inject.Named;
 
 /**
  * Assemble a kar archive from a features.xml file
@@ -75,7 +75,8 @@ public class KarMojo extends MojoSupport {
     /**
      * The Jar archiver.
      */
-    @Component(role = Archiver.class, hint="jar")
+    @Inject
+    @Named("jar")
     private JarArchiver jarArchiver = null;
 
     /**
@@ -264,6 +265,7 @@ private File createArchive(List<Artifact> bundles, File featuresFile, String gro
         // configure for Reproducible Builds based on outputTimestamp value
         archiver.configureReproducible(outputTimestamp);
 
+        List<File> tempMetadataFiles = new ArrayList<>();
         try {
             //TODO should .kar be a bundle?
 //            archive.addManifestEntry(Constants.BUNDLE_NAME, project.getName());
@@ -345,12 +347,7 @@ private File createArchive(List<Artifact> bundles, File featuresFile, String gro
                     }
 
                     jarArchiver.addFile(metadataTmp, repositoryPath + layout.pathOf(artifact).substring(0, layout.pathOf(artifact).lastIndexOf('/')) + "/maven-metadata-local.xml");
-
-                    try {
-                        metadataTmp.delete();
-                    } catch (final Exception ex) {
-                        getLog().warn("Cannot delete temporary created file.", ex);
-                    }
+                    tempMetadataFiles.add(metadataTmp);
                 }
 
                 String targetFileName = repositoryPath + layout.pathOf(artifact);
@@ -362,6 +359,16 @@ private File createArchive(List<Artifact> bundles, File featuresFile, String gro
             }
             archiver.createArchive(mavenSession, project, archive);
 
+            for (File tempMetadataFile : tempMetadataFiles) {
+                try {
+                    if (!tempMetadataFile.delete()) {
+                        getLog().warn("Cannot delete temporary created file: " + tempMetadataFile.getAbsolutePath());
+                    }
+                } catch (final Exception ex) {
+                    getLog().warn("Cannot delete temporary created file: " + tempMetadataFile.getAbsolutePath(), ex);
+                }
+            }
+
             return archiveFile;
         } catch (Exception e) {
             throw new MojoExecutionException("Failed to create archive", e);