////
   Licensed to the Apache Software Foundation (ASF) under one
   or more contributor license agreements.  See the NOTICE file
   distributed with this work for additional information
   regarding copyright ownership.  The ASF licenses this file
   to you under the Apache License, Version 2.0 (the
   "License"); you may not use this file except in compliance
   with the License.  You may obtain a copy of the License at

     https://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing,
   software distributed under the License is distributed on an
   "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
   KIND, either express or implied.  See the License for the
   specific language governing permissions and limitations
   under the License.
////

= Ivy Release Announcement

15 July 2026 - The Apache Ivy project is pleased to announce its 2.6.0 release.

== What is Ivy?
Apache Ivy is a tool for managing (recording, tracking, resolving and reporting) project dependencies, characterized by flexibility,
configurability, and tight integration with link:https://ant.apache.org/[Apache Ant].

== Download
You can download this release at link:https://ant.apache.org/ivy/download.cgi[]

Issues should either be discussed in the link:https://ant.apache.org/ivy/mailing-lists.html[Ivy user mailing list] or reported at link:https://issues.apache.org/jira/browse/IVY[]

More information about the project can be found on the website link:https://ant.apache.org/ivy/[]

== Key features in this release

Key features of this 2.6.0 release are:

== List of Changes in this Release

For details about the following changes, check our JIRA install at link:https://issues.apache.org/jira/browse/IVY[]

*List of changes since Ivy 2.6.0:*

Note, if you have resolved dependencies with version of Ivy prior to 2.6.0, you may need to remove your Ivy cache for some fixes to have any effect.

////
 Samples :
- NEW: bla bla bla (jira:IVY-1234[]) (Thanks to Jane Doe)
- IMPROVEMENT: bla bla bla (jira:IVY-1234[]) (Thanks to Jane Doe)
- FIX: bla bla bla (jira:IVY-1234[]) (Thanks to Jane Doe)
- DOCUMENTATION: bla bla bla (jira:IVY-1234[]) (Thanks to Jane Doe)
////

- NEW: added a new `nearest` conflict manager, which handles conflicts in the same way that Maven does. (IVY-813) (Thanks to Eric Milles)
- IMPROVEMENT: use Apache Commons Compress for pack200 handling to avoid issues on Java 14 and later. If pack200 is needed, make sure to add Apache Commons Compress to your classpath. (IVY-1652)
- IMPROVEMENT: `ivy:retrieve` and the 'post resolve tasks' now support the `override` child element. (IVY-1664)
- IMPROVEMENT: `ivy:makepom` will now add `override` elements of the `ivy.xml` to the `dependencyManagement` section of the
  generated pom. (IVY-1663) (Thanks to Eric Milles)
- IMPROVEMENT: `ivy:deliver` and `ivy:publish` now writes inherited dependencies first to preserve resolve order (IVY-1656) (Thanks to Eric Milles)
- IMPROVEMENT: `ModuleRevisionId.encodeToString` now returns a deterministic string that doesn't rely on a implmentation of `HashMap` (Thanks to Arnout Engelen)
- FIX: improved Maven dependencyManagement matching for dependencies with a non-default type or classifier (IVY-1654) (Thanks to Mark Kittisopikul)
- FIX: the `ivy:retrieve` task failed when the retrieve pattern contained some text in parentheses before the first token, for instance: `/jobs/lib (JDK 17)/[artifact].[ext]` (IVY-1660)
- FIX: when the `ivy:deliver` task is configured to replace dynamic revisions, it now replaces these revisions to the resolved revision before any conflict resolution was done, which was the original behavior before Ivy 2.3.0.
This way, the delivered ivy.xml can be used to have reproducible dependency resolution, especially when multiple configurations are used.
It also fixes issues where the dynamic revisions were replaced by versions from other configurations. (IVY-1485, IVY-1661)
- FIX: the `ivy:deliver` task didn't replace dynamic revision from inherited dependencies. (IVY-1410) (Thanks to Eric Milles)
- FIX: the `ivy:install` task didn't take the `from` resolver into account when resolving Maven parent modules or source/javadoc artifacts. (Thanks to Colin Chambers)
- FIX: the `ivy:checkdepsupdate` task could suggest a lesser version as update. (IVY-1665) (Thanks to Eric Milles)
- FIX: the `ivy:makepom` task no longer adds a dependency to the <dependencyManagement> section. (IVY-1667) (Thanks to Eric Milles)
- FIX: the `ivy:deliver` task didn't include XML namespaces from a parent ivy module when merging the descriptors. (IVY-1658)
  (Thanks to Eric Milles)
- FIX: the `ivy:checkdepsupdate` task no longer shows evicted versions. (IVY-1662) (Thanks to Eric Milles)
- FIX: CVE-2026-26032: Apache Ivy: PackagerResolver path traversal vulnerability

== Committers and Contributors

Here is the list of people who have contributed source code and documentation up to this release. Many thanks to all of them, and also to the whole IvyDE community contributing ideas and feedback, and promoting the use of Apache Ivy !

*Committers:*

* Matt Benson
* Jean-Louis Boudart
* Maarten Coene
* Charles Duffy
* Gintautas Grigelionis
* Xavier Hanin
* Nicolas Lalev&eacute;e
* Jan Mat&egrave;rne
* Jaikiran Pai
* Jon Schneider
* Gilles Scokart
* Stefan Bodewig

*Contributors:*

* Ingo Adler
* Mathieu Anquetin
* Arseny Aprelev
* Andreas Axelsson
* St&eacute;phane Bailliez
* Karl Baum
* Moritz Baumann
* Andrew Bernhagen
* Mikkel Bjerg
* Per Arnold Blaasmo
* Jeffrey Blattman
* Jasper Blues
* Jim Bonanno
* Joseph Boyd
* Dave Brosius
* Matthieu Brouillard
* Carlton Brown
* Mirko Bulovic
* Ed Burcher
* Jamie Burns
* Colin Chambers
* Wei Chen
* Chris Chilvers
* Kristian Cibulskis
* Andrea Bernardo Ciddio
* Archie Cobbs
* Flavio Coutinho da Costa
* Stefan De Boey
* Mykhailo Delegan
* Charles Duffy
* Martin Eigenbrodt
* Arnout Engelen
* Alexandr Esaulov
* Stephen Evanchik
* Stephan Feder
* Robin Fernandes
* Gregory Fernandez
* Danno Ferrin
* Riccardo Foschia
* Benjamin Francisoud
* Wolfgang Frank
* Jacob Grydholt Jensen
* John Gibson
* Mitch Gitman
* Evgeny Goldin
* Scott Goldstein
* Jason A. Guild
* Stephen Haberman
* Aaron Hachez
* Ben Hale
* Peter Hayes
* Scott Hebert
* Payam Hekmat
* Tobias Himstedt
* Achim Huegen
* Pierre H&auml;gnestrand
* Matt Inger
* Anders Jacobsson
* Anders Janmyr
* Steve Jones
* Christer Jonsson
* Michael Kebe
* Matthias Kilian
* Alexey Kiselev
* Gregory Kisling
* Mark Kittisopikul
* Stepan Koltsov
* Heschi Kreinick
* Sebastian Krueger
* Thomas Kurpick
* Berno Langer
* Costin Leau
* Ilya Leoshkevich
* Tat Leung
* Antoine Levy-Lambert
* Tony Likhite
* Andrey Lomakin
* William Lyvers
* Sakari Maaranen
* David Maplesden
* Glen Marchesani
* Jan Materne
* Markus M. May
* Lewis John McGibbney
* Phil Messenger
* Steve Miller
* Eric Milles
* Abel Muino
* J. Lewis Muir
* Mathias Muller
* Stephen Nesbitt
* Joshua Nichols
* Bernard Niset
* Ales Nosek
* Randy Nott
* Peter Oxenham
* Douglas Palmer
* Thomas Pasch
* Jesper Pedersen
* Emmanuel Pellereau
* Greg Perry
* Carsten Pfeiffer
* Yanus Poluektovich
* Roshan Punnoose
* Aur&eacute;lien Pupier
* Jean-Baptiste Quenot
* Carl Quinn
* Damon Rand
* Geoff Reedy
* Torkild U. Resheim
* Christian Riege
* Frederic Riviere
* Jens Rohloff
* Andreas Sahlbach
* Brian Sanders
* Adrian Sandor
* Michael Scheetz
* Ben Schmidt
* Ruslan Shevchenko
* John Shields
* Nihal Sinha
* Gene Smith
* Michal Srb
* Colin Stanfill
* Simon Steiner
* Johan Stuyts
* John Tinetti
* Erwin Tratar
* Jason Trump
* David Turner
* Ernestas Vaiciukevi&ccaron;ius
* Tjeerd Verhagen
* Willem Verstraeten
* Richard Vowles
* Sven Walter
* Zhong Wang
* James P. White
* Tom Widmer
* John Williams
* Chris Wood
* Patrick Woodworth
* Jaroslaw Wypychowski
* Sven Zethelius
* Aleksey Zhukov
