Changes in 7.4.0

bndtools release 7.4.0

Release date: 2026/08/18 (see Release page for changes)

• Installation: See the Release section of the README and the Installation page for where to find Bnd/Bndtools.
• Contained PRs

Changes

[Security] Maven Repositories: Add Trusted Checksum Verification

• Introduces optional support for trusted checksum verification in the Maven repository providers (MavenBndRepository and BndPomRepository). The main goal is to ensure that downloaded artifacts can be validated against a trusted checksum file, to improve supply-chain security for bnd-based builds using Maven artifacts. Trusted Checksum are a consumer-controlled expected value which answers: "Are these exactly the bytes of a dependency we previously approved?" (https://github.com/bndtools/bnd/pull/7269)

Scenario	GPG	Trusted Checksums
MITM / artifact replaced during transport	✅	✅
Compromised publisher account (legitimate key abused)	❌	✅
Artifact without GPG signature (e.g. private/internal repos)	❌	✅
Offline / air-gapped environments (no keyserver)	❌	✅
Reproducible builds / exact lock-state guarantee	❌	✅

Docs: https://bnd.bndtools.org/plugins/maven.html#trusted-checksum-verification

Misc

• [CLI] Add repo deps command to export the Maven GAVs of all artifacts in the Maven repositories for license/IP analysis (dash-licenses) (https://github.com/bndtools/bnd/pull/7275)
  • Docs: https://bnd.bndtools.org/commands/repo.html#available-sub-commands
• [bndtools] Persist and manage workspace template fragment indexes (https://github.com/bndtools/bnd/pull/7284). This allows to store other template index URLs permanently and have them ready in the dialog when you import a Template Fragment next time. Docs: https://bnd.bndtools.org/chapters/620-template-fragments.html#template-fragments
• Various bugfixes

Git log

BJ Hargrave (1):
      gradle: Properly configure sourceSet compile and runtime classpaths

Christoph Rueger (19):
      Create SECURITY.md for bnd security documentation
      Do not overwrite existing request properties
      Docs: Add HTTP headers override section
      Cooldowns for Dependabot updates
      Set explicit headers before defaults and refine logging
      Readme: Update Bnd Maven and Gradle plugin versions to 7.3.0
      Update baseline version to 7.3.0
      Update dependabot.yml to remove cooldown settings
      Add sync baseline version step in postrelease workflow
      Revert docs baseline version to 7.2.1
      Add baseline version update also to docs-generate
      Update postrelease.yml
      fix IndexOutOfBoundsException
      Exclude features from P2Repo.versions()
      Add trusted checksum verification for Maven artifacts
      Fix NPE in RepoCollector initialization during Project construction
      Fix warnings in build output
      Fix thread-safety in Tee class
      build: Build Release 7.4.0.RC1

Eleanor Joslin (1):
      Fix task order between compileJava and processResources.

Jared Anderson (3):
      Make fields volatile to avoid memory visibility problem
      Update to not set the index until it has completed opening
      Hold read lock to avoid refresh closing repository

Jürgen Albert (1):
      Add `repo deps` command to export Maven GAVs for dash-licenses

Mark Hoffmann (1):
      Persist and manage workspace template fragment indexes

Peter Kirschner (13):
      Increase maximum heap size for Gradle
      Remove long-running test from ci server build
      CI build output improvement
      fixing post release workspace template update
      fixing post release workspace template update
      fixing post release workspace template update
      Bndtools Explorer Quick Links addition - Existing Bnd Workspace
      fix issue #7234
      remove top-level bnd root project
      fix local test execution on macosx,aarch64
      fixing issue #7124
      Eclipse feature support for buildpath
      Revert "Eclipse feature support for buildpath"

Tim Ward (1):
      [maven][resolve] Provide a better logging experience for maven users when resolving

copilot-swe-agent[bot] (11):
      Add Sonatype deployment IDs to CI job summary and outputs
      Initial plan
      Initial plan
      Fix Sonatype deployment test for per-group deployment ID files
      Fix workspace template push authentication URL
      Use PAT_WORKSPACE_REPO for workspace template push
      Handle alternate deployment ID file locations in SonatypeDeploymentTest
      Initial plan
      Fix IllegalArgumentException for prepared SNAPSHOT Pom Versions
      Initial plan
      Clean up only when branch is in local bnd repo

github-actions (1):
      Post release 7.3.0