update plugins for maven 3.6.3+

[dev-mlb]

No description provided.

[jpdahlke]

• validate versions are available internally

[cfkoehler]

Not done checking yet.
Ran the following goals so far (compile, verify, site)

[jpdahlke]

I was able to build these changes internally using this 'incremental' path of commands:

mvn clean verify
mvn clean install
mvn clean verify -Pcheckstyle
mvn clean verify -Pcheckstyle,pmd,coverage
mvn clean site
mvn clean deploy (failed to connect to repo due to access but plugin worked)
mvn clean install site -Pcheckstyle,pmd,coverage

All of which 'worked' (success at the end) but I believe I could have just done the last command and been covered (except for deploy), it just would have been harder to find issues with missing dependencies.

I did run into an issue where the maven-project-info-reports had errors when using the cyclonedx plugin. I recommend bumping that to the latest 2.9.1 version as well as adding this plugin dependency (in the dist profile config) to try to manage the version being used with cyclone (it uses 2.0.8 now):

<plugin>
  <groupId>io.takari.maven.plugins</groupId>
  <artifactId>takari-lifecycle-plugin</artifactId>
  <version>2.2.0</version>
</plugin>

I also see an error during pmd generating the CPD report for a NoSuchMethodError which complains about org.apache.maven.doxia.sink.Sink.verbatim(). I didn't investigate if that was new or where that might have started but it appears as though there are two versions of doxia being included, 2.0.0 and 1.11.1 using:

mvn dependency:resolve-plugins

Since the result is not a failure of the build but a failure of report generation I'm ok moving forward and resolving in a follow-up pending your feedback.

[jpdahlke]

mvn clean install site -Pcheckstyle,coverage,pmd,dist worked fully for me

[sambish5]

works for me!