Skip to content

4.0.0-rc-6

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Jul 22:16
maven-4.0.0-rc-6
f1805ac

Notes

This new release candidate of Maven 4 is released to get feedback from users.
Maven 4 has restricted a few things compared to Maven 3, so make sure to run the mvnup tool before trying your project with Maven 4.

Issues fixed since RC-5

All known issues reported in the RC-5 release notes have been fixed:

  • Bean configuration bug — field accessibility state was cached globally, causing plugin configuration injection failures. Fixed in #11433.
  • Concurrency issue in the v4 API — a ConcurrentModificationException was fixed in #11429.
  • BOM packaging — consumer POM conversion for BOM projects now correctly preserves dependency versions. Fixed in #11464.
  • macOS Gatekeeper — the extracted JLine native binaries that triggered Gatekeeper have been removed from the distribution (#11997). The xattr workaround from RC-5 is no longer needed.

Known compatibility issues

The following are known compatibility issues when using Maven 4. Running
mvnup before building with
Maven 4 will fix many common plugin version issues automatically. The issues
below are those that require manual intervention or upstream fixes.

Stricter POM validation

Maven 4 enforces stricter validation than Maven 3. Projects may need to fix their POMs:

  • Duplicate XML elements — duplicate <artifactId>, <properties>, etc. are now rejected (Duplicated tag error). Fix the source POM.
  • Duplicate dependency declarations — same groupId:artifactId declared twice is now rejected (must be unique).
  • Uninterpolated expressions — ${...} expressions in repository URLs, distribution management IDs, and other fields that Maven 3 silently accepted are now rejected.
  • Invalid XML in transitive POMs — illegal processing instructions or undeclared namespace prefixes in transitive POMs cause Non-parseable POM errors.
  • Properties in <module> paths — Maven 4 no longer interpolates properties like ${spark.version} in <module> elements at POM reading time.
  • CI-friendly versions — projects using ${revision} without flatten-maven-plugin may hit missing dependency version errors.
  • Invalid Collect Request — transitive dependencies with uninterpolated ${...} version expressions are rejected.

Transitive dependency resolution changes

Maven 4's TransitiveDependencyManager applies dependencyManagement at all transitive depths (Maven 3 only applied it at the first level). This is intentional but can change resolved versions:

  • Dependencies previously on the classpath may disappear — add explicit declarations. See #12302.
  • maven-enforcer-plugin version rules may trigger due to downgraded transitive versions.
  • license-maven-plugin may report new transitive dependencies not in the allow-list.
  • Karaf feature verification may fail due to OSGi bundle version mismatches.

Plugin and extension compatibility

Some plugins and extensions require specific versions for Maven 4:

  • Quarkus — versions before 3.20 use ServiceLocator/RepositorySystem patterns incompatible with Maven 4's Sisu-based DI. Upgrade to Quarkus 3.20+.
  • Tycho — versions before 5.0 use Guice/Sisu injection patterns broken by Maven 4. Upgrade to Tycho 5.0.3+.
  • Develocity Maven extension — fails to initialize due to SLF4J classloading changes (ClassNotFoundException: SimpleLogger).
  • pgpverify-maven-plugin — versions before 1.20 hit a ClassCastException with Maven 4's resolver. See resolver#1957.
  • cyclonedx-maven-plugin — fails with Invalid Version Range Request when using ${revision} CI-friendly versions.
  • maven-site-plugin — Velocity template rendering may fail with incompatible site plugin versions.
  • maven-shade-plugin — dependency-reduced-pom.xml can cause The parents form a cycle error.
  • commons-release-plugin — clean-staging fails under Maven 4.

Classloading changes

  • Plugins relying on Maven 3's classrealm layout may encounter "foreign imports" errors (e.g., Quarkus, JAXB plugins).
  • Maven 4's prefix-based repository routing may block artifacts not matching /.meta/prefixes.txt.

Post-mvnup formatting

  • spotless-maven-plugin and sortpom-maven-plugin may report formatting violations after mvnup modifies POM files. Re-run the formatter after mvnup.

Other

  • Broken upstream POMs — e.g., hadoop-project 3.1.0–3.3.0 has invalid XML (<Xlint:-unchecked/>) causing parse errors. These need upstream fixes tracked in HADOOP-19923.
  • Enforcer POM element ordering — Maven 4's model builder reorders POM elements into a canonical order, which can break enforcer rules checking element ordering.
  • SNAPSHOT handling — SNAPSHOT artifacts may show as "present, but unavailable" under Maven 4's different resolver metadata handling.

🚀 New features and improvements

🐛 Bug Fixes

  • [MNG-8425] Fix mvnenc init saving invalid master source configuration (#12564) @gnodet
  • Consumer POM of multi-module project should exclude and elements (#11764) @desruisseaux
  • Fix #12045: fix mvnup plugin upgrade strategy for inherited plugins from remote parent POMs (#12054) @gnodet
  • Backport #12538: Handle Ctrl+C on Windows terminals (#12550) @gnodet
  • [Backport 4.0.x] Fix #12531: filter NO_REPOSITORY sentinel from mapped exceptions in ArtifactResolverResult (#12561) @gnodet
  • [Backport 4.0.x] Fix #12534: Wire up @after annotation processing in Maven core (#12566) @gnodet
  • [Backport 4.0.x] Fix #12427: Reject path-traversal segments in coordinate ids and versions (#12565) @gnodet
  • [Backport 4.0.x] [MNG-11147] - Fix BOM version inference for sibling modules in dependencyManagement (#12569) @gnodet
  • Backport #12523 to 4.0.x: preserve unresolved ${...} in CLI -D values (#12524) @ascheman
  • [Backport 4.0.x] Avoid IllegalStateException on duplicate profile ids in DefaultModelBuilder (#12506) @ascheman
  • Backport #12446: Fix deadlock in AbstractRequestCache (#12468) @gnodet
  • Fix #12464: Skip MAVEN_ARGS for non-default main classes (backport to 4.0.x) (#12466) @gnodet
  • Bugfix: use GAV and not GAPV in source labels for profiles (#12406) (#12424) @cstamas
  • [#11449] Fix Mockito agent: use late binding @{} interpolation (backport to 4.0.x) (#12415) @gnodet
  • Make LookupContext#closeables thread safe (backport to 4.0.x) (#12414) @gnodet
  • [#11683] Install JUL-to-SLF4J bridge to route java.util.logging through Maven logging (#12345) @gnodet
  • [#12303] Fix CI-friendly ${revision} not interpolated for non-build POM reads (#12322) @gnodet
  • [4.0.x] Fix mvn.cmd jvm.config read failing silently on Windows CI (#12379) @gnodet
  • [Backport 4.0.x] Fix mvnup spurious pluginManagement injection for remote parent plugins (#12351) @gnodet
  • [MNG-8650] - Fix MAVEN_ARGS backslash stripping on Windows (#12349) @gnodet
  • Port #11908: Do not force metadata download for plugin prefix resolution (#11905) (#12343) @gnodet
  • [Backport 4.0.x] Fix NPE in DefaultLookup.lookupOptional() when container returns null (#12340) @gnodet
  • [#12301] Use stack-passed Set for activeModelReads cycle detection (#12325) @gnodet
  • [Backport 4.0.x] Sync DefaultTypeProvider and dependency-types docs across impl and compat (#12326) @gnodet
  • [#12301] Fix StackOverflowError with internal parent and CI-friendly revision (#12314) @gnodet
  • [Backport 4.0.x] [#12288] Add -P !profile deactivation regression guard (#12298) (#12315) @gnodet
  • [maven-4.0.x] Fix #12305: filter uninterpolated deps in ArtifactDescriptorReaderDelegate (#12309) @gnodet
  • [maven-4.0.x] Fix #12304: replace deprecated property expressions in mvnup (#12308) @gnodet
  • [maven-4.0.x] Fix #12306: normalize targetPath in DefaultSourceRoot (#12307) @gnodet
  • [Backport 4.0.x] [#12288] Pass settings.xml profile properties to LRM (#12299) @gnodet
  • Fix thread-safety in DefaultModelValidator (backport to 4.0.x) (#12284) @gnodet
  • Fix MojoExtension.beforeEach to use merged model instead of raw parsed model (backport to 4.0.x) (#12287) @gnodet
  • Fix BUILD_CONSUMER profile activation for locally-resolved parent POMs (backport to 4.0.x) (#12286) @gnodet
  • Fix NPE in DefaultModelBuilder when POM resolved from repository (backport to 4.0.x) (#12285) @gnodet
  • Backport #12053: Tokenize arithmetic operators as delimiters in ConditionParser (#12275) @gnodet
  • Backport #12117: Support sealed parameter implementation hints (#12258) @gnodet
  • Backport #12038: Fix ConditionParser to handle newlines before && operator (#12259) @gnodet
  • Backport #12146: Handle missing package metadata in model ids (#12257) @gnodet
  • Backport #11742: Fix #11715: preserve 4.1.0 namespace/schema in help:effective-pom (#12255) @gnodet
  • Backport #12237: Add XmlService classloader fallback for ServiceLoader discovery (#12254) @gnodet
  • Avoid reflective InputSource modelId mutation (#12147) @Will-thom
  • Fix MavenITConsumerPomBomFromSettingsRepoTest missing super constructor call (#12253) @gnodet
  • fix reportSet inheritance in Maven 4 model building (#12245) @hboutemy
  • [4.0.x] [GH-11772] - Fail-fast consumer POM validation for non-4.0.0 model versions (#12236) @gnodet
  • [4.0.x] Fix Source.targetPath incorrectly aligned to basedir (#12235) @gnodet
  • [4.0.x] Fix #11856: Improve error message for prefix-based remote repository filtering errors (#12234) @gnodet
  • [4.0.x] Fix #11796: Preserve default-phases bindings for standard lifecycle phases (#12233) @gnodet
  • [4.0.x] Fix @PreDestroy ClassNotFoundException from premature ClassRealm disposal (#12232) @gnodet
  • [4.0.x] [MNG-6772] - Re-enable integration test for nested import scope repository override (#12231) @gnodet
  • Fix deadlocks in request cache (unstable hashCode, re-entrant self-deadlock, mutable properties) (#12166) @gnodet
  • [maven-4.0.x] Backport bug fixes from #11741 and #11733 (#12144) @gnodet
  • [backport maven-4.0.x] Fix logging setup/teardown order (#12137) @gnodet
  • Fix domtrip API breakage after 1.5.1 upgrade (#12138) @gnodet
  • Update binary distribution LICENSE with complete Apache License 2.0 text (#12116) @slawekjaranowski
  • Fix #11899: Default addLocationInformation to false in Settings and Toolchains XML writers (#12123) @gnodet
  • [maven-4.0.x] Fix mvn script expanding ${...} in CLI arguments (#12095) @gnodet
  • [maven-4.0.x] Fix consumer POM serialization of prefixed XML attributes (fixes #11760) (#12110) @gnodet
  • Fix #11885: Disable ANSI colors when stdout is piped on JDK 22+ (backport) (#12111) @gnodet
  • [maven-4.0.x] Fix #12085: regression tests for version inheritance from remote parent (#12101) @gnodet
  • Fix #12074: prevent false parent cycle with shade plugin's dependency-reduced-pom.xml (#12079) @gnodet
  • Fix #12075: skip expression validation for distributionManagement repository IDs (#12076) (#12077) @gnodet
  • [maven-4.0.x] fix: restore buildConfiguration() callback in deprecated build() methods (#12094) @gnodet
  • [maven-4.0.x] fix: propagate addResource() to model Build for Maven 3 compat (#12093) @gnodet
  • [maven-4.0.x] Filter transitive repositories with uninterpolated IDs (#12049) (#12070) @gnodet
  • Downgrade plexus-classworlds from 2.11.0 to 2.9.0 (#12092) @gnodet
  • [maven-4.0.x] Fix #11920: skip expression validation for profile repository URLs (#12055) @gnodet
  • Mvn4: Remove extracted Mac OS JLine binaries from Maven distro (#11997) @kwin
  • Fixes issue #11827 - Maven DI crashes if the file org.apache.maven.api.di.Inject contains empty lines (#11830) @slawekjaranowski
  • Backport the simplification and fixes of PathSelector (#11565) @desruisseaux
  • [maven-4.0.x] Fix special characters in .mvn/jvm.config (fix #11363, #11485 and #11486) (#11365) (#11537) @gnodet
  • Improve DefaultModelProcessor error reporting for alternative parsers (#11529) @gnodet
  • Allow ${project.basedir} in profile activation.condition (#11528) @gnodet
  • [maven-4.0.x] Fix profile source tracking in multi-module projects (fixes #11409) (#11440) (#11466) @gnodet
  • [maven-4.0.x] Fix BOM packaging in consumer POMs (#11427) (#11464) @gnodet
  • [maven-4.0.x] Fix field accessibility leak in EnhancedCompositeBeanHelper (#11425) (#11433) @gnodet
  • Fix a ConcurrentModificationException (#11429) @desruisseaux

📝 Documentation updates

👻 Maintenance

  • Add DefaultLookupTest for lookupOptional NPE fix (#12385) @ascheman
  • [Backport 4.0.x] [MNG-8425] - Fix mvnenc init saving invalid master source configuration (#12564) @gnodet
  • push-to-atr profile for source+binaries in apache-maven subproject (#12448) @hboutemy
  • configure ATR project (#12449) @hboutemy
  • Forward-port #11985: remove redundant required MDO attrs (#11979) (#12347) @gnodet
  • Forward port Maven 3.10.0 PluginDependenciesResolver changes (#12335) @cstamas
  • [Backport 4.0.x] Move model SPI interfaces from maven-impl to maven-api-spi (#12289) @gnodet
  • Deprecate testing classes in org.apache.maven.api, add new ones in org.apache.maven.testing (#12277) @gnodet
  • Backport #12256: Centralize XXE hardening for StAX XML parsers (#12269) @gnodet
  • Refactor JUnit extensions to avoid using static fields. (#12202) @slawekjaranowski
  • [4.0.x] Fix mvnup effective model analysis for CI-friendly parent versions (#12230) @gnodet
  • [4.0.x] Filter project repos with uninterpolated property expressions (#12229) @gnodet
  • [4.0.x] Bump exec-maven-plugin target to 3.5.0 and fix PLUGIN_UPGRADES inconsistencies (#12228) @gnodet
  • [4.0.x] Use request properties consistently for CI-friendly version interpolation (#12227) @gnodet
  • [4.0.x] Bump scala-maven-plugin upgrade target from 4.9.2 to 4.9.5 (#12226) @gnodet
  • [4.0.x] Fix mvnup PLUGIN_UPGRADES for compiler and exec plugins (#12225) @gnodet
  • [4.0.x] Remove invalid combine.self and combine.children attributes in mvnup (#12224) @gnodet
  • [4.0.x] Fix mvnup plugin upgrade for versions locked by parent build/plugins (#12223) @gnodet
  • [4.0.x] Fix mvnup: use effective model to resolve properties from remote parents (#12222) @gnodet
  • [4.0.x] Fix mvnup recommending non-existent maven-enforcer-plugin:3.5.2 (#12156) @gnodet
  • [maven-4.0.x] Fix #12080: mvnup - comment out dependencies with undefined property expressions (#12099) @gnodet
  • [maven-4.0.x] Fix incompatible extensions in mvnup for Maven 4 (#12122) @gnodet
  • [maven-4.0.x] Upgrade more plugins in mvnup PluginUpgradeStrategy (#12121) @gnodet
  • [maven-4.0.x] Fix mvnup to replace deprecated ${basedir} in repository URLs (#12106) @gnodet
  • [maven-4.0.x] Fix #12086: filter transitive repos and deps with uninterpolated expressions (#12098) @gnodet
  • [maven-4.0.x] Filter transitive dependencies with uninterpolated expressions (#12097) @gnodet
  • [maven-4.0.x] Upgrade plugin dependencies (extra-enforcer-rules) in mvnup (#12108) @gnodet
  • Backport bug fixes from master to maven-4.0.x (batch 2) (#12107) @gnodet
  • [maven-4.0.x] Use maven-api Version for mvnup plugin version comparison (#12073) @gnodet
  • Fix #12081: mvnup: use domtrip XML API on 4.0.x branch to align with master (#12082) @gnodet
  • [maven-4.0.x] Backport bug fixes from master to maven-4.0.x (#12091) @gnodet
  • chore: delete junit3 reference (#11771) @sparsick
  • Maven Parent 46 (#11637) (#11638) @cstamas
  • [4.0.x] Use Mimir mirror feature (#11622) (#11631) @cstamas
  • Add InputLocation/InputSource factory methods and make classes final for 4.0.0-rc-6 (#11538) @gnodet
  • Use full version for GitHub action in comments (#11482) @slawekjaranowski

📦 Dependency updates

Contributors

cstamas, gnodet, and 8 other contributors
Assets 2
Loading