# Release Notes 15 July 2026 - The Apache Ivy project is pleased to announce its 2.6.0 release. ## What is Ivy? Apache Ivy is a tool for managing (recording, tracking, resolving and reporting) project dependencies, characterized by flexibility, configurability, and tight integration with Apache Ant. ## Download You can download this release at https://ant.apache.org/ivy/download.cgi Issues should either be discussed in the Ivy user mailing list or reported at https://issues.apache.org/jira/browse/IVY More information about the project can be found on the website https://ant.apache.org/ivy/ ## Key features in this release Key features of this 2.6.0 release are: ## List of Changes in this Release For details about the following changes, check our JIRA install at https://issues.apache.org/jira/browse/IVY List of changes since Ivy 2.6.0: Note, if you have resolved dependencies with version of Ivy prior to 2.6.0, you may need to remove your Ivy cache for some fixes to have any effect. NEW: added a new `nearest` conflict manager, which handles conflicts in the same way that Maven does. (IVY-813) (Thanks to Eric Milles) IMPROVEMENT: use Apache Commons Compress for pack200 handling to avoid issues on Java 14 and later. If pack200 is needed, make sure to add Apache Commons Compress to your classpath. (IVY-1652) IMPROVEMENT: `ivy:retrieve` and the 'post resolve tasks' now support the `override` child element. (IVY-1664) IMPROVEMENT: `ivy:makepom` will now add `override` elements of the `ivy.xml` to the `dependencyManagement` section of the generated pom. (IVY-1663) (Thanks to Eric Milles) IMPROVEMENT: `ivy:deliver` and `ivy:publish` now writes inherited dependencies first to preserve resolve order (IVY-1656) (Thanks to Eric Milles) IMPROVEMENT: `ModuleRevisionId.encodeToString` now returns a deterministic string that doesn’t rely on a implmentation of `HashMap` (Thanks to Arnout Engelen) FIX: improved Maven dependencyManagement matching for dependencies with a non-default type or classifier (IVY-1654) (Thanks to Mark Kittisopikul) FIX: the `ivy:retrieve` task failed when the retrieve pattern contained some text in parentheses before the first token, for instance: `/jobs/lib (JDK 17)/[artifact].[ext]` (IVY-1660) FIX: when the `ivy:deliver` task is configured to replace dynamic revisions, it now replaces these revisions to the resolved revision before any conflict resolution was done, which was the original behavior before Ivy 2.3.0. This way, the delivered ivy.xml can be used to have reproducible dependency resolution, especially when multiple configurations are used. It also fixes issues where the dynamic revisions were replaced by versions from other configurations. (IVY-1485, IVY-1661) FIX: the `ivy:deliver` task didn’t replace dynamic revision from inherited dependencies. (IVY-1410) (Thanks to Eric Milles) FIX: the `ivy:install` task didn’t take the `from` resolver into account when resolving Maven parent modules or source/javadoc artifacts. (Thanks to Colin Chambers) FIX: the `ivy:checkdepsupdate` task could suggest a lesser version as update. (IVY-1665) (Thanks to Eric Milles) FIX: the `ivy:makepom` task no longer adds a dependency to the <dependencyManagement> section. (IVY-1667) (Thanks to Eric Milles) FIX: the `ivy:deliver` task didn’t include XML namespaces from a parent ivy module when merging the descriptors. (IVY-1658) (Thanks to Eric Milles) FIX: the `ivy:checkdepsupdate` task no longer shows evicted versions. (IVY-1662) (Thanks to Eric Milles) FIX: CVE-2026-26032: Apache Ivy: PackagerResolver path traversal vulnerability ## Committers and Contributors Here is the list of people who have contributed source code and documentation up to this release. Many thanks to all of them, and also to the whole IvyDE community contributing ideas and feedback, and promoting the use of Apache Ivy ! Committers: Matt Benson Jean-Louis Boudart Maarten Coene Charles Duffy Gintautas Grigelionis Xavier Hanin Nicolas Lalevée Jan Matèrne Jaikiran Pai Jon Schneider Gilles Scokart Stefan Bodewig Contributors: Ingo Adler Mathieu Anquetin Arseny Aprelev Andreas Axelsson Stéphane Bailliez Karl Baum Moritz Baumann Andrew Bernhagen Mikkel Bjerg Per Arnold Blaasmo Jeffrey Blattman Jasper Blues Jim Bonanno Joseph Boyd Dave Brosius Matthieu Brouillard Carlton Brown Mirko Bulovic Ed Burcher Jamie Burns Colin Chambers Wei Chen Chris Chilvers Kristian Cibulskis Andrea Bernardo Ciddio Archie Cobbs Flavio Coutinho da Costa Stefan De Boey Mykhailo Delegan Charles Duffy Martin Eigenbrodt Arnout Engelen Alexandr Esaulov Stephen Evanchik Stephan Feder Robin Fernandes Gregory Fernandez Danno Ferrin Riccardo Foschia Benjamin Francisoud Wolfgang Frank Jacob Grydholt Jensen John Gibson Mitch Gitman Evgeny Goldin Scott Goldstein Jason A. Guild Stephen Haberman Aaron Hachez Ben Hale Peter Hayes Scott Hebert Payam Hekmat Tobias Himstedt Achim Huegen Pierre Hägnestrand Matt Inger Anders Jacobsson Anders Janmyr Steve Jones Christer Jonsson Michael Kebe Matthias Kilian Alexey Kiselev Gregory Kisling Mark Kittisopikul Stepan Koltsov Heschi Kreinick Sebastian Krueger Thomas Kurpick Berno Langer Costin Leau Ilya Leoshkevich Tat Leung Antoine Levy-Lambert Tony Likhite Andrey Lomakin William Lyvers Sakari Maaranen David Maplesden Glen Marchesani Jan Materne Markus M. May Lewis John McGibbney Phil Messenger Steve Miller Eric Milles Abel Muino J. Lewis Muir Mathias Muller Stephen Nesbitt Joshua Nichols Bernard Niset Ales Nosek Randy Nott Peter Oxenham Douglas Palmer Thomas Pasch Jesper Pedersen Emmanuel Pellereau Greg Perry Carsten Pfeiffer Yanus Poluektovich Roshan Punnoose Aurélien Pupier Jean-Baptiste Quenot Carl Quinn Damon Rand Geoff Reedy Torkild U. Resheim Christian Riege Frederic Riviere Jens Rohloff Andreas Sahlbach Brian Sanders Adrian Sandor Michael Scheetz Ben Schmidt Ruslan Shevchenko John Shields Nihal Sinha Gene Smith Michal Srb Colin Stanfill Simon Steiner Johan Stuyts John Tinetti Erwin Tratar Jason Trump David Turner Ernestas Vaiciukevičius Tjeerd Verhagen Willem Verstraeten Richard Vowles Sven Walter Zhong Wang James P. White Tom Widmer John Williams Chris Wood Patrick Woodworth Jaroslaw Wypychowski Sven Zethelius Aleksey Zhukov