Release notes from maven

3.9.14

2026-03-12T11:53:06Z

🐛 Bug Fixes

plexus-testing dependencies should be use in test scope (#11761) @slawekjaranowski

📦 Dependency updates

Bump actions/upload-artifact from 6.0.0 to 7.0.0 (#11747) @dependabot[bot]
Bump actions/download-artifact from 7.0.0 to 8.0.0 (#11748) @dependabot[bot]

3.9.13

2026-03-06T12:39:17Z

🐛 Bug Fixes

Bug: SecDispatcher is managed by legacy Plexus DI (#11711) @cstamas
[3.9.x] MavenPluginJavaPrerequisiteChecker: Handle 8/1.8 Java version in ranges as well (#11577) @cstamas

👻 Maintenance

Update Maven plugin versions in default-bindings.xml (#11721) @slachiewicz
Migrate to JUnit 5 - avoid using TestCase (#11547) @slawekjaranowski

📦 Dependency updates

Maven Resolver 1.9.27 (#11732) @cstamas
Bump resolverVersion from 1.9.25 to 1.9.26 (#11725) @dependabot[bot]
Update Maven plugin versions in default-bindings.xml (#11721) @slachiewicz
Bump version.sisu-maven-plugin from 0.9.0.M4 to 1.0.0 (#11706) @dependabot[bot]
Bump actions/cache from 5.0.2 to 5.0.3 (#11688) @dependabot[bot]
Bump org.apache.maven:maven-parent from 45 to 47 (#11647) @dependabot[bot]
Bump actions/checkout from 6.0.1 to 6.0.2 (#11666) @dependabot[bot]
Bump actions/setup-java from 5.1.0 to 5.2.0 (#11667) @dependabot[bot]
Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.26 to 1.27 (#11658) @dependabot[bot]
Bump org.codehaus.mojo:buildnumber-maven-plugin from 3.2.1 to 3.3.0 (#11657) @dependabot[bot]
Bump actions/cache from 5.0.1 to 5.0.2 (#11659) @dependabot[bot]
Bump org.codehaus.plexus:plexus-testing from 2.0.2 to 2.1.0 (#11620) @dependabot[bot]
Bump org.ow2.asm:asm from 9.9 to 9.9.1 (#11585) @slachiewicz
Bump actions/upload-artifact from 5.0.0 to 6.0.0 (#11557) @dependabot[bot]
Bump actions/download-artifact from 6.0.0 to 7.0.0 (#11556) @dependabot[bot]
Bump actions/cache from 5.0.0 to 5.0.1 (#11558) @dependabot[bot]

3.9.12

2025-12-16T21:09:02Z

🚀 New features and improvements

[3.9.x] Apply resolver changes and improvements (#11536) @cstamas
Update formatting of prerequisites-requirements error to improve readability (#11523) @slawekjaranowski
Allow a Maven plugin to require a Java version (#11479) @slawekjaranowski
Use MavenRepositorySystem in ProjectBuildingHelper instead of deprecated RepositorySystem (#11358) @slawekjaranowski
Make maven.config use UTF8 (#11264) @cstamas
Simplify prefix resolution (#11197) @slawekjaranowski

🐛 Bug Fixes

Add default implementation for new method in MavenPluginManager (#11522) @slawekjaranowski
Repository layout should be used in MavenRepositorySystem (#11495) @slawekjaranowski
Fix plugin prefix resolution when metadata is not available from repository (#11290) @slawekjaranowski
Improve source root modification warning message (#11105) @gnodet
Bug: bad cache isolation between two sessions (#11082) @cstamas
Set Guice class loading to CHILD - avoid using terminally deprecated methods (#11003) @slawekjaranowski
Avoid parsing MAVEN_OPTS (3.9.x) (#10969) @BobVul

📝 Documentation updates

clarify repository vs deployment repository (#11492) @hboutemy
add maintained branches (#11448) @hboutemy

👻 Maintenance

Add IntelliJ icon (#11408) @Bukama
Build by JDK 25 (#11187) @slawekjaranowski
Deprecate org.apache.maven.repository.RepositorySystem in 3.9.x (#11096) @slawekjaranowski

🔧 Build

Bump actions/download-artifact from 5.0.0 to 6.0.0 (#11335) @dependabot[bot]
Bump actions/upload-artifact from 4.6.2 to 5.0.0 (#11336) @dependabot[bot]

📦 Dependency updates

Bump actions/cache from 4.3.0 to 5.0.0 (#11542) @dependabot[bot]
Bump resolverVersion from 1.9.24 to 1.9.25 (#11533) @dependabot[bot]
Bump actions/checkout from 6.0.0 to 6.0.1 (#11512) @dependabot[bot]
Bump actions/setup-java from 5.0.0 to 5.1.0 (#11519) @dependabot[bot]
Bump actions/checkout from 5.0.1 to 6.0.0 (#11476) @dependabot[bot]
Bump actions/checkout from 5.0.0 to 5.0.1 (#11458) @dependabot[bot]
Bump commons-cli:commons-cli from 1.10.0 to 1.11.0 (#11438) @dependabot[bot]
Bump org.codehaus.plexus:plexus-interpolation from 1.28 to 1.29 (#11416) @dependabot[bot]
Bump commons-io:commons-io from 2.20.0 to 2.21.0 (#11417) @dependabot[bot]
Bump xmlunitVersion from 2.10.4 to 2.11.0 (#11331) @dependabot[bot]
Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.24 to 1.26 (#11231) @dependabot[bot]
Bump org.ow2.asm:asm from 9.8 to 9.9 (#11203) @dependabot[bot]
Bump actions/cache from 4.2.4 to 4.3.0 (#11172) @dependabot[bot]
Bump com.google.guava:guava from 33.4.8-jre to 33.5.0-jre (#11143) @dependabot[bot]
Bump xmlunitVersion from 2.10.3 to 2.10.4 (#11121) @dependabot[bot]
Bump actions/cache from 4.2.3 to 4.2.4 (#11032) @dependabot[bot]
Bump commons-cli:commons-cli from 1.9.0 to 1.10.0 (#11018) @dependabot[bot]
Bump commons-io:commons-io from 2.19.0 to 2.20.0 (#10966) @dependabot[bot]

4.0.0-rc-5

2025-11-13T14:07:44Z

Notes

This new release candidate of Maven 4 is released to get feedback from users.
Maven 4 has a restrained a few things comparent to Maven 3, so make sure to run the mvnup tool before trying to project with Maven 4.

Bean configuration bug

A bug has been found in the bean configuration system where field accessibility state is cached globally. This can cause plugin configuration injection to fail when the same configuration field is accessed multiple times or in different contexts during a build. This particularly affects the plugin unit tests.

This will be fixed by #11433 in the next release.

Concurrency issue in the v4 API

A concurrency issue has been found in the Maven 4 API (still in preview mode) and will be fixed by #11428 in the next release.

BOM packaging

Another bug has been found in how BOM projects are processed. When a project uses BOM packaging, the consumer POM is not being properly converted to standard POM packaging, and dependency versions could be lost in some cases.

This will be fixed by #11427 in the next release.

macOS: JLine native library may be blocked by Gatekeeper on first use

On macOS (especially Apple Silicon), the first invocation of mvn may fail to load the JLine native terminal library with an error such as:

java.lang.UnsatisfiedLinkError: .../libjline-native/Mac/arm64/libjlinenative.jnilib: dlopen(...): code signature ... not valid for use in process: library load disallowed by system policy

This occurs when the binary distribution is downloaded via a web browser, which applies the com.apple.quarantine extended attribute.

Workaround (one-time fix):

xattr -r -d com.apple.quarantine /path/to/apache-maven-4.0.0-rc-5/lib/jline-native

Recommended download method (avoids the issue entirely):

curl -L -O https://archive.apache.org/dist/maven/maven-4/4.0.0-rc-5/binaries/apache-maven-4.0.0-rc-5-bin.tar.gz
tar -xzf apache-maven-4.0.0-rc-5-bin.tar.gz

This is a known issue #10747 and will be addressed in a future release.

💥 Breaking changes

Disable consumer POM flattening by default and add an opt-in feature (#11347) (#11370) @gnodet

🚀 New features and improvements

Disable consumer POM flattening by default and add an opt-in feature (#11347) (#11370) @gnodet
Make config files use UTF8 (#11263) (#11265) @cstamas
Simplify prefix resolution (#11072) (#11073) @cstamas
Add PathMatcherFactory.includesAll() (#11008) @desruisseaux
Add skipMavenRc to ExecutorRequest and use it in ITs (#10944) @slawekjaranowski
Add PathMatcherFactory service with directory filtering optimization (#10923) (#10926) @gnodet
Allow configurable repository selection for version range resolution (backport) (#10890) @cstamas
Switch resolver to use rwlock-local locks (#2546) (#2555) @gnodet

🐛 Bug Fixes

Fix resource targetPath resolution to be relative to output directory (fixes #11381) (#11394) (#11406) @gnodet
Fix MavenStaxReader location reporting for properties (#11402) (#11404) @gnodet
Fix false parent cycle detection with flatten-maven-plugin (#11400) @gnodet
Resolve property before model reflection to avoid recursion (#11385, fixes #11384) (#11390) @gnodet
Explicitly register jdk ToolchainFactory for Maven 3 plugins (#11318) (#11369) @gnodet
Fix -itr option not honored (#11359) (#11361) @gnodet
Do not include invalid transitive repositories (#11357) (#11362) @gnodet
Prevent infinite loop in RootLocator when .mvn directory exists in subdirectory (fixes #11321) (#11323) (#11350) @gnodet
Fix [unknown project] messages in error output (#11324) (#11349) @gnodet
Restore compatibility in maven-embedder (#11320) (#11340) @gnodet
Add backward compatibility dependencies to maven-compat (#11301) (#11339) @gnodet
Relative are resolved against the wrong directory (#11325) @desruisseaux
Bug: when raw-streams are used, ensure system streams are set up (#11303) (#11310) @cstamas
Fix plugin prefix resolution when metadata is not available from repository (#11287) (#11288) @gnodet
Maven model 4.1.0 should not allow non-pom packaging for aggregators (#11279) (#11285) @gnodet
Fix exception caused by duplicate dependencies in consumer pom (#11283) (#11286) @gnodet
Remove use of toRealPath (#11250) (#11257) @cstamas
Bugfix: fix CLI graceful death (#11239) (#11246) @cstamas
Introduce RepositoryAwareRequest interface to consolidate repository handling (#11238) (#11244) @gnodet
Fix repository ID interpolation in Maven 4 (#11224) (#11241) @gnodet
Fix dependency groupId inference for Maven 4.1.0 model version (#11228) (#11240) @gnodet
Consumer POM should keep only transitive dependencies, fixes #11162 (#11163) (#11235) @gnodet
Fix StackOverflowError in parent POM resolution (backport #11106) (#11234) @gnodet
Fix CI-friendly version processing with profile properties (fix #11196) (#11225) @gnodet
Add phase upgrade support for Maven 4.1.0 model upgrades (#11226) @gnodet
Fix GH-11199: Maven 4.0.0-rc-4 ignores defaultLogLevel (#11227) @gnodet
Validate metaversions and detect extension conflicts (fixes #11181) (#11216) @cstamas
Allow repository URL interpolation with improved validation (#11140) (#11210) @gnodet
Improve mvn usage message (#11211) (#11213) @gnodet
Enable the search for module-info.class file in the META-INF/versions/ sub-directories of a JAR file. (#11153) (#11206) @gnodet
Fix #10939: DefaultModelXmlFactory: make location tracking opt-in—disabled by def… (#11092) @arturobernalg
Fix #11000: fix help default text (#11099) @arturobernalg
GH-10210: fix too eager decrypt of legacy passwords (#11138) (#11158) @cstamas
#11055: Inject all services into mojos and enable easy real-session mojo testing (#11103) (#11139) @gnodet
Fix ReactorReader to prefer consumer POMs over build POMs (#11107) (#11131) @gnodet
model-builder: simplify subproject auto-discovery decision (#11124) (#11132) @gnodet
Add missing equals and hashCode methods in modular Java path type. (#11130) @desruisseaux
fix: include extension in equals/hashCode of DefaultArtifactCoordinates (#11101) @arturobernalg
Fix #11127: enforce non-null keys for InputLocation lookups and document behavior (#11128) @gnodet
Bug: bad cache isolation between two sessions (#11083) (#11085) @cstamas
Fix targetPath parameter ignored in resource bundles (fixes #11062) (#11063) (#11080) @gnodet
Maven Upgrade Tool: remove unused --force and --yes options (Fixes #11001) (#11066) (#11079) @gnodet
Fix XMLReader#getURL and enable the unit test (#11069) (#11078) @gnodet
[#11048] Fix race condition in MessageUtils (#11049) (#11077) @gnodet
Uninterpolated repositories from parent POMs during model building (backport) (#11039) @cstamas
Fix maven.mainClass property missing for external tools (#10998) (#11007) @gnodet
Set Guice class loading to CHILD - avoid using terminally deprecated methods (#11002) @slawekjaranowski
Avoid parsing MAVEN_OPTS (master/4.x) (#10970) (#10993) @gnodet
Port the bug fixes identified when using that class in Maven clean and compiler plugin (#10935) (#10936) @gnodet
Fix XmlNode.equals returning false between two different node implementations (#10942) @gnodet
perf: optimize CompositeBeanHelper with reflection caching (#10927) @gnodet
Expand value interning optimization and add configurable session property (#2495) (#10932) @gnodet
Optimize validation performance with lazy SourceHint evaluation (#2518) (#10919) @gnodet
Refactor setupContainer to validate ExtensionContext, test class and instance, and throw clear IllegalStateExceptions (#10901, fixes #10428) (#10918) @gnodet
Bug fix in the default directory computed by DefaultSourceRoot. (#10912) (#10917) @gnodet
Optimize XmlPlexusConfiguration for performance and thread safety (#2527) (#10916) @gnodet
Fix mvnup tool issues #7934-#7938 (#9311) (#10915) @gnodet
Fix #2486: Make Resource.addInclude() persist in project model (#2534) (#2565) @gnodet
Fix MavenProject#getPlugin(String) performances (#2530) (#2573) @gnodet
bug: fix duplicate dependency in effective model (fixes #2532) (#2554) (#2556) @gnodet
Split system and user properties from maven.properties (#2547) @gnodet
Fix ReactorReader incorrect warnings and logic (fixes #2497, #2498) (#2536) @gnodet
Avoid double flush (#2478) (#2537) @gnodet
Deduplicate filtered dependency graph (#2493) @alzimmermsft

👻 Maintenance

Change IntelliJ icon to new oak leaf (#11407) @Bukama
Fix IT isolation for MNG-6256 IT (#11395) (#11396) @cstamas
Maven 4.0.x proper isolation (#11393) @cstamas
[4.0.x] Consolidate caches (#11379) @cstamas
Fix ITs (#11371) (#11372) @gnodet
Mimir Cache-Purge w Pre-seed (#11315) (#11348) @cstamas
Missed parts for Mimir update (#11312) (#11313) @cstamas
Mimir 0.10.3 (#11291) (#11311) @cstamas
Upgrade Mimir (#11274) (#11282) @cstamas
Upgrade to spotless 3.0.0 and palantir 2.80.0 (#11275) (#11277) @gnodet
Tidy up executor UTs (#11249) (#11262) @cstamas
Sync GH workflow with master (#11221) @cstamas
IT fixes (#11217) @cstamas
Maven 4.0.x backport mimir (#11180) @cstamas
commons-cli deprecations (#11170) (#11176) @cstamas
Mimir updates (#11161) (#11166) @cstamas
[[MNG-8696] - ](https://issues.apache.org/jira/browse/MNG-8696) - Hide the cache from DefaultDependencyResolverResult constructor (#11154) @desruisseaux
Generating configuration documentation during site build (#10979) @slawekjaranowski
Improvements in ITs executing - provide default local repo (#10963) @slawekjaranowski
Backport: Fix build and Jenkinsfile (#10904) (#10905) @cstamas
chore: remove unused managed dependency (#2570) (#2572) @gnodet
Cleanups duplicate configs with new parent (#2567) @gnodet
Update Maven version to 4.0.0-SNAPSHOT (#2513) @gnodet
Update branch name for release-drafter in maven-4.0.x (#2503) @slawekjaranowski
Execute GitHub action - Java CI on maven-4.0.x branch (#2504) @slawekjaranowski

🔧 Build

Bump actions/upload-artifact from 4.6.2 to 5.0.0 (#11332) @dependabot[bot]
Bump actions/download-artifact from 5.0.0 to 6.0.0 (#11333) @dependabot[bot]
Allow single build per branch or pull request (#11045) @slawekjaranowski
Pin GitHub action versions by hash (#10902) @slawekjaranowski

📦 Dependency updates

Bump net.sourceforge.pmd:pmd-core from 7.17.0 to 7.18.0 (#11377) @dependabot[bot]
Bump org.codehaus.plexus:plexus-testing from 1.7.0 to 2.0.1 (#11344) @dependabot[bot]
Bump org.codehaus.mojo:extra-enforcer-rules from 1.10.0 to 1.11.0 (#11352) @dependabot[bot]
Bump io.github.olamy.maven.plugins:jacoco-aggregator-maven-plugin from 1.0.3 to 1.0.4 (#11345) @dependabot[bot]
Bump org.apache.maven.plugin-tools:maven-plugin-annotations from 3.15.1 to 3.15.2 (#11337) @dependabot[bot]
Bump org.apache.maven.plugin-tools:maven-plugin-tools-java from 3.15.1 to 3.15.2 (#11338) @dependabot[bot]
Bump xmlunitVersion from 2.10.4 to 2.11.0 (#11334) @dependabot[bot]
Bump ch.qos.logback:logback-classic from 1.5.19 to 1.5.20 (#11296) @dependabot[bot]
Bump org.codehaus.mojo:exec-maven-plugin from 3.6.1 to 3.6.2 (#11297) @dependabot[bot]
Bump org.codehaus.plexus:plexus-velocity from 2.2.1 to 2.3.0 (#11261) @dependabot[bot]
Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.24.1 to 0.24.2 (#11271) @dependabot[bot]
Bump org.codehaus.plexus:plexus-testing from 1.6.1 to 1.7.0 (#11270) @dependabot[bot]
Bump org.codehaus.plexus:plexus-testing from 1.6.0 to 1.6.1 (#11260) @dependabot[bot]
Bump org.apache.maven:maven-archiver from 3.6.4 to 3.6.5 (#11232) @dependabot[bot]
Bump eu.maveniverse.maven.mimir:testing from 0.9.3 to 0.9.4 (#11233) @dependabot[bot]
Bump org.jacoco:jacoco-maven-plugin from 0.8.13 to 0.8.14 (#11254) @dependabot[bot]
Resolver 2.0.13 (#11137) (#11248) @cstamas
Bump net.bytebuddy:byte-buddy from 1.17.7 to 1.17.8 (#11243) @dependabot[bot]
Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.23.1 to 0.24.1 (#11208) @dependabot[bot]
Bump asmVersion from 9.8 to 9.9 (#11204) @dependabot[bot]
Bump org.codehaus.mojo:exec-maven-plugin from 3.5.1 to 3.6.1 (#11205) @dependabot[bot]
Bump ch.qos.logback:logback-classic from 1.5.18 to 1.5.19 (#11192) @dependabot[bot]
Bump actions/cache from 4.2.4 to 4.3.0 (#11173) @dependabot[bot]
Bump org.assertj:assertj-core from 3.27.5 to 3.27.6 (#11164) @dependabot[bot]
Bump mockitoVersion from 5.19.0 to 5.20.0 (#11156) @dependabot[bot]
Bump org.assertj:assertj-core from 3.27.4 to 3.27.5 (#11149) @dependabot[bot]
Bump com.google.guava:guava from 33.4.8-jre to 33.5.0-jre (#11144) @dependabot[bot]
Bump net.sourceforge.pmd:pmd-core from 7.16.0 to 7.17.0 (#11123) @dependabot[bot]
Bump xmlunitVersion from 2.10.3 to 2.10.4 (#11122) @dependabot[bot]
Resolver 2.0.11 (#11043) (#11115) @cstamas
Bump jlineVersion from 3.30.5 to 3.30.6 (#11113) @dependabot[bot]
Bump eu.maveniverse.maven.plugins:bom-builder3 from 1.2.1 to 1.3.0 (#11097) @dependabot[bot]
Bump mockitoVersion from 5.18.0 to 5.19.0 (#11051) @dependabot[bot]
Bump eu.maveniverse.maven.plugins:bom-builder3 from 1.2.0 to 1.2.1 (#11064) @dependabot[bot]
Bump org.codehaus.plexus:plexus-testing from 1.5.0 to 1.6.0 (#11057) @dependabot[bot]
Bump net.bytebuddy:byte-buddy from 1.17.6 to 1.17.7 (#11053) @dependabot[bot]
Bump org.apache.maven:maven-archiver from 3.6.3 to 3.6.4 (#11036) @dependabot[bot]
Bump actions/cache from 4.2.3 to 4.2.4 (#11030) @dependabot[bot]
Bump org.assertj:assertj-core from 3.27.3 to 3.27.4 (#11034) @dependabot[bot]
Bump jlineVersion from 3.30.4 to 3.30.5 (#11026) @dependabot[bot]
Bump commons-cli:commons-cli from 1.9.0 to 1.10.0 (#11020) @dependabot[bot]
Bump eu.maveniverse.maven.plugins:bom-builder3 from 1.1.1 to 1.2.0 (#11014) @dependabot[bot]
Bump net.sourceforge.pmd:pmd-core from 7.15.0 to 7.16.0 (#11005) @dependabot[bot]
Bump org.junit:junit-bom from 5.13.3 to 5.13.4 (#10989) @dependabot[bot]
Bump org.junit.jupiter:junit-jupiter from 5.13.3 to 5.13.4 (#10988) @dependabot[bot]
Bump commons-io:commons-io from 2.19.0 to 2.20.0 (#10968) @dependabot[bot]
Bump io.github.olamy.maven.plugins:jacoco-aggregator-maven-plugin from 1.0.2 to 1.0.3 (#10933) @dependabot[bot]
Bump org.codehaus.plexus:plexus-utils from 3.0.24 to 3.6.0 (#2563) @dependabot[bot]
Bump org.codehaus.plexus:plexus-component-annotations from 2.1.0 to 2.2.0 (#2560) @dependabot[bot]
Bump com.google.jimfs:jimfs from 1.3.0 to 1.3.1 (#10911) @dependabot[bot]
Bump org.junit.jupiter:junit-jupiter from 5.13.2 to 5.13.3 (#8716) @dependabot[bot]
Bump org.junit:junit-bom from 5.13.2 to 5.13.3 (#8717) @dependabot[bot]
Bump org.junit.jupiter:junit-jupiter from 5.13.1 to 5.13.2 (#2561) @dependabot[bot]
Bump org.apache.maven:maven-parent from 44 to 45 (#2552) @dependabot[bot]
Bump net.sourceforge.pmd:pmd-core from 7.14.0 to 7.15.0 (#2553) @dependabot[bot]
Bump org.junit:junit-bom from 5.13.1 to 5.13.2 (#2549) @dependabot[bot]
Bump net.bytebuddy:byte-buddy from 1.17.5 to 1.17.6 (#2543) @dependabot[bot]
Bump xmlunitVersion from 2.10.2 to 2.10.3 (#2542) @dependabot[bot]
Bump resolverVersion from 2.0.9 to 2.0.10 (#2541) @dependabot[bot]

3.9.11

2025-07-15T21:17:53Z

🚀 New features and improvements

Augment version range resolution used repositories (#2574) @cstamas

🐛 Bug Fixes

Deduplicate filtered dependency graph (#2489) @alzimmermsft
Move ensure in boundaries of project lock (#2470) @cstamas

👻 Maintenance

[MNGSITE-393] - remove references to Maven 2 (#2438) @elharo
Update CONTRIBUTING after GitHub issues enabled (#2449) @slawekjaranowski
Enable Github Issues (3.9.x) (#2414) @Bukama
[MNG-8763] - Remove name from site bannerLeft (#2419) @slawekjaranowski

🔧 Build

Pin GitHub action versions by hash (#10898) @slawekjaranowski
Build the project by JDK 21 as default (#10896) @slawekjaranowski
Use Maven 3.9.10 for build on GitHub (#2452) @slawekjaranowski

📦 Dependency updates

Bump resolverVersion from 1.9.23 to 1.9.24 (#2540) @dependabot[bot]
Bump xmlunitVersion from 2.10.2 to 2.10.3 (#2500) @dependabot[bot]
Bump org.apache.maven:maven-parent from 44 to 45 (#2491) @dependabot[bot]
Bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.0 to 3.6.1 (#2432) @dependabot[bot]

4.0.0-rc-4

2025-07-17T19:39:13Z

Maven 4.0.0-rc-4 aims at being the last release candidate before Maven 4.0.0 GA. We'll focus on fixing critical bugs raised before GA.
Worth mentioning is the new upgrade tool which can be used to fix your pom.xml files and make them usable in Maven 4.

🚀 New features and improvements

[MNG-8765] - Maven Upgrade Tool (#2407) @gnodet
Maven4 "legacy" mode and more (#2380) @cstamas
[MNG-8759] - Restore toString method in DefaultJavaToolchain (#2411) @slawekjaranowski
[MNG-8572] - Support DI beans in build extensions (#2274) @gnodet
[MNG-8717] - Remove maven-plugin-plugin:addPluginArtifactMetadata from default binding (#2294) @slawekjaranowski

🐛 Bug Fixes

Deduplicate filtered dependency graph (#2493) @alzimmermsft
User properties are not interpolated for paths (#2480) @cstamas
Move project mutation inside project lock (#2474) @cstamas
[MNG-8736] - Fix concurrency issue in model building with profile activation (#2378) @gnodet
[MNG-8767] - Add suppressed exceptions to BatchRequestException in AbstractRequestCache (#2431) @gnodet
[MNG-8746] - Preserve property insertion order in WrapperProperties (#2404) @gnodet
[MNG-8764] - Sort injected lists by @priority annotation (#2425) @gnodet
[MNG-8761] - Add Maven 3 MavenToolchainsXpp3Reader/Writer (#2412) @slawekjaranowski
[MNG-8729] - Use correct outputStream destination; request instead of path in DefaultPluginXmlFactory#write (#2312) @Pankraz76
[MNG-8720] - Fix for symlinked project directory (#2289) @cstamas
[MNG-8653] - Fix 'all' phase and add 'each' phase (#2191) @gnodet
[MNG-5668] - Execute after:* phases when build fails (#2195) @gnodet
[MNG-8629] - bugfix: If POM has parent and repository stanza, it is used un-interpolated (#2192) @cstamas
[MNG-8645] - Fix dependency management section of consumer POM (#2183) @gnodet
[MNG-8624] - Fix dependency not being set correctly for unsupported types (#2153) @gnodet
Fix ITs referencing rc-3-SNAPSHOT (#2164) @gnodet
[MNG-8620] - Fix links in SVG (#2152) @kwin

📝 Documentation updates

[MNG-8731] - Use https for xsi:schemaLocation in generated descriptors (#2341) @slawekjaranowski

👻 Maintenance

Fix integration tests to use correct Maven version instead of hardcoded 2.1-SNAPSHOT (#2476) @gnodet
Use local repository in tests (#2485) @slawekjaranowski
Refactor WrapperProperties template to remove caching and simplify implementation (#2436) @gnodet
Ban "plain" Guice; downgrade it to 5.1.0 (#2472) @cstamas
Unfurl CLI (#2465) @cstamas
Don't ignore SVG files (#2435) @elharo
Update CONTRIBUTING after GitHub issues enabled (#2448) @slawekjaranowski
Remove extra variable (#2398) @elharo
Enable Github Issues (#2413) @Bukama
[S1161] Add missing @OverRide to overriding and implementing methods (#2402) @Pankraz76
use try-with-resources statement in LookupWagonMojo (#2426) @Pankraz76
Add UT for cache in FilteredProjectDependencyGraphTest (#2394) @slawekjaranowski
[MNG-8764] - centralize domain comparison logic Binding#getPriorityComparator (#2428) @Pankraz76
evolve Disabled to DisabledOnOs(WINDOWS) (#2423) @Pankraz76
use try-with-resources statement in CatchMojo (#2424) @Pankraz76
chore: resolve unused Binding#getDisplayString (#2429) @Pankraz76
Remove ignored method call (#2399) @elharo
[MNG-8750] - Delete unused interface (#2388) @elharo
chore: resolve false negative suppression @SuppressWarnings("checkstyle:UnusedLocalVariable") (#2369) @Pankraz76
[chore] Modernize codebase with Java improvements - Replace custom null checks with Objects.requireNonNull (#2290) @Pankraz76
Symbolic change (no issue) (#2383) @cstamas
[MNG-8713] - SourceRoot.directory() default value should include the module when present (#2278) @desruisseaux
[MNG-8727] - Prepare for Java 24 (#2328) @cstamas
[MNG-8686] - Add SourceRoot.matcher(boolean) method (#2236) @desruisseaux
Remove unused private methods (#2310) @Pankraz76
Improve invoker test (#2308) @cstamas
Pull #2282: Add project icon for IntelliJ IDEA (#2283) @Pankraz76
[MNG-8718] - Restore Maven 3 compat: ProjectBuilder is unusable for legacy code (#2285) @cstamas
Test MavenITmng7587Jsr330 should be executed on every JDK (#2298) @slawekjaranowski
[MNG-8719] - Restore Maven3 compat: model setInherited(boolean) (#2288) @cstamas
[MNG-8614] - Maven Sisu in Maven 4 same as in Maven 3 (#2284) @cstamas
[MNG-8712] - dependency version is a requirement, not effective (#2286) @hboutemy
[MNG-8670] - Fix concurrent builder missing/wrong project events (#2251) @oehme
[MNG-8674] - Deprecate mergeId in the Maven 3 model and remove it in the new model (#2233) @gnodet
[MNG-8694] - Fix version interpolation and ternary operator (#2272) @kamilkrzywanski
[MNGSITE-393] - Remove Maven 1 and 2 references (#2276) @elharo
Remove unneeded toString and valueOf calls (#2230) @elharo
Drop unused assembly exclude (#2266) @cstamas
aether repository system isn't used (#2237) @elharo
remove unused field (#2238) @elharo
Cleanup extra semicolons (#2229) @elharo
[MNG-8676] - Improve model builder error messages (#2257) @cstamas
Avoid warning about unthrown exception (#2217) @elharo
[MNG-8687] - Restore ability to run on JIMFS (#2256) @cstamas
[MNG-8673] - SourceRoot includes and excludes should be String (#2232) @gnodet
[MNG-8675] - Correctly deprecate Resource in the model (#2234) @gnodet
[MNG-8685] - Better support for CI systems (#2254) @cstamas
Add types for processor annotation path (#2239) @desruisseaux
[MNG-8679] - Align superpom with mvn3 (#2246) @cstamas
Avoid exposing non-public type outside its scope (#2220) @elharo
Grammar and typo fixes in javadoc and other comments (#2222) @elharo
Remove methods that duplicate superclass methods (#2211) @elharo
[MNG-8637] - Pull out Standalone API from UTs (#2226) @gnodet
[MRESOLVER-673] - Improve model validator error messages (#2227) @cstamas
[MNG-8660] - Decouple legacy prompter from implementation details (#2196) @oehme
Add missing Javadoc to API subprojects (#2218) @gnodet
prefer primitive type (#2216) @elharo
autobox (#2223) @elharo
No catch block needed when rethrowing same exception (#2210) @elharo
[MNG-3558] - Ensure properties can be escaped (#2206) @gnodet
[MNG-8669] - Add missing context (#2224) @cstamas
[MNG-8662] - Add missing methods for removing project source roots (#2205) @gnodet
[MNG-4559] - Support spaces in jvm.config (#2213) @gnodet
prefer isEmpty (#2215) @elharo
[CI] Disable Mimir JGroups node (#2212) @cstamas
Access static fields in a static way (#2209) @elharo
Make maven-cli module tests use Mimir as well (#2207) @cstamas
Remove a few thousand lines of commented and obsolete code (#2200) @elharo
minor cleanups (#2199) @elharo
[MNG-8467] - Add links to configuration pages in index.xml (#2201) @gnodet
Add missing headers (#2202) @gnodet
[MNG-8598] - Add support for MAVEN_PROJECTBASEDIR substitution in jvm.config (#2194) @gnodet
[MNG-8548] - Add cycle detection to dependency injection (#2197) @gnodet
Remove some unnecessary statements (#2190) @elharo
Add test to suite (#2198) @gnodet
[MNG-8642] - Integrate the testing framework inside Maven Core (#2193) @gnodet
[MNG-8648] - Concurrent executor fires wrong ProjectStarted event (#2189) @oehme
[MNG-8647] - Set the default source directory to src/${scope}/${lang} as per documentation (#2180) @desruisseaux
[MNG-8646] - Make IT tests use "outer" Mimir caching as well (#2176) @cstamas
Remove redundant code (#2188) @elharo
Expected argument comes first in JUnit (#2187) @elharo
Reenable many old style tests (#2182) @elharo
[MNG-8490] - Add an XmlService and a builder + implementation for XmlNode (#2150) @gnodet
requireNonNull (#2181) @elharo
Remove old symbolic link in ITmng8400 test (#2178) @slawekjaranowski
[MNG-8612] - Document Node#asString and remove Version#asString and VersionConstraint#asString (#2172) @gnodet
[MNG-8510] - Avoid duplicate Utils classes (#2173) @gnodet
[MNG-8639] - Check namespaces when reading XML models (#2170) @gnodet
[MNG-8511] - Explains the meaning of cling (#2174) @gnodet
[IT] Refactor executor (#2175) @cstamas
[MNG-8633] - Initialize entities map lazily (#2165) @gnodet
Replace a NullPointerException by a more explicit error message (#2160) @desruisseaux
Restore Jenkins build for master (#2151) @olamy
[experiment] Mimir (#2144) @cstamas
[[MNG-8615] [MNG-8616]](https://issues.apache.org/jira/browse/MNG-8615] [MNG-8616) - Maven core extensions handling improvements (#2147) @cstamas
Minor Javadoc cleanup (#2126) @elharo
[MNG-8613] - Copy edit dependency javadocs (#2143) @elharo

🔧 Build

Improve configuration for dependabot in 3.x branch (#2447) @slawekjaranowski
Remove branch after merge (#2323) @slawekjaranowski

📦 Dependency updates

Bump xmlunitVersion from 2.10.2 to 2.10.3 (#2501) @dependabot[bot]
Bump org.junit:junit-bom from 5.13.0 to 5.13.1 (#2459) @dependabot[bot]
Bump org.junit.jupiter:junit-jupiter from 5.13.0 to 5.13.1 (#2460) @dependabot[bot]
Bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.0 to 3.6.1 (#2433) @dependabot[bot]
Bump org.junit.jupiter:junit-jupiter from 5.12.2 to 5.13.0 (#2420) @dependabot[bot]
Bump net.sourceforge.pmd:pmd-core from 7.13.0 to 7.14.0 (#2421) @dependabot[bot]
Bump org.junit:junit-bom from 5.12.2 to 5.13.0 (#2422) @dependabot[bot]
Update Mimir to 0.7.8 (#2416) @cstamas
Bump org.codehaus.mojo:exec-maven-plugin from 3.5.0 to 3.5.1 (#2397) @dependabot[bot]
Bump jlineVersion from 3.30.3 to 3.30.4 (#2405) @dependabot[bot]
Bump com.fasterxml.woodstox:woodstox-core from 7.1.0 to 7.1.1 (#2409) @dependabot[bot]
Upgrade Maven Bom Builder Plugin (#2408) @cstamas
[MNG-8737] - Bump xmlunitVersion from 2.10.1 to 2.10.2 (#2391) @dependabot[bot]
[MNG-8740][MNG-8733] - Bump jlineVersion from 3.30.0 to 3.30.3 (#2379) @dependabot[bot]
[MNG-8739] - Bump net.sourceforge.pmd:pmd-core from 7.12.0 to 7.13.0 (#2335) @dependabot[bot]
[MNG-8738] - Bump mockitoVersion from 5.17.0 to 5.18.0 (#2362) @dependabot[bot]
[MNG-8737] - Bump xmlunitVersion from 2.10.0 to 2.10.1 (#2355) @dependabot[bot]
[MNG-8728] - Update Eclipse Sisu to 0.9.0.M4 (#2358) @cstamas
[MNG-8732] - Bump Resolver to 2.0.9 (#2352) @cstamas
[MNG-8726] - Bump jlineVersion from 3.29.0 to 3.30.0 (#2325) @cstamas
Bump org.eclipse.jetty:jetty-server from 9.4.55.v20240627 to 9.4.56.v20240826 in /its/core-it-suite (#2305) @dependabot[bot]
Bump commons-jxpath:commons-jxpath from 1.3 to 1.4.0 (#2267) @dependabot[bot]
Update Maveniverse stuff (#2269) @cstamas
Bump com.google.guava:guava from 33.4.7-jre to 33.4.8-jre (#2265) @dependabot[bot]
Bump org.codehaus.plexus:plexus-velocity from 2.2.0 to 2.2.1 (#2259) @dependabot[bot]
Bump org.junit:junit-bom from 5.12.1 to 5.12.2 (#2260) @dependabot[bot]
Bump commons-io:commons-io from 2.18.0 to 2.19.0 (#2261) @dependabot[bot]
Bump org.junit.jupiter:junit-jupiter from 5.11.4 to 5.12.2 (#2262) @dependabot[bot]
Bump com.google.guava:guava from 33.4.6-jre to 33.4.7-jre (#2263) @dependabot[bot]
[MNG-8677] - Bump to Resolver 2.0.8 and more (#2158) @cstamas
Bump org.codehaus.plexus:plexus-classworlds from 2.8.0 to 2.9.0 (#2247) @dependabot[bot]
Bump io.github.olamy.maven.plugins:jacoco-aggregator-maven-plugin from 1.0.1 to 1.0.2 (#2248) @dependabot[bot]
Bump org.codehaus.plexus:plexus-testing from 1.4.0 to 1.5.0 (#2249) @dependabot[bot]
Bump org.codehaus.plexus:plexus-interactivity-api from 1.3 to 1.4 (#2250) @dependabot[bot]
Bump org.codehaus.plexus:plexus-xml from 4.0.4 to 4.1.0 (#2242) @dependabot[bot]
Bump io.github.olamy.maven.plugins:jacoco-aggregator-maven-plugin from 1.0.0 to 1.0.1 (#2244) @dependabot[bot]
Bump mockitoVersion from 5.16.1 to 5.17.0 (#2245) @dependabot[bot]
Bump org.codehaus.plexus:plexus-interpolation from 1.27 to 1.28 (#2243) @dependabot[bot]
Bump org.jacoco:jacoco-maven-plugin from 0.8.12 to 0.8.13 (#2225) @dependabot[bot]
Bump net.bytebuddy:byte-buddy from 1.17.4 to 1.17.5 (#2214) @dependabot[bot]
[MNG-8663] - Bump asmVersion from 9.7.1 to 9.8 (#2204) @dependabot[bot]
Bump Mimir from 0.4.0 to 0.4.1 (#2203) @cstamas
Bump com.google.guava:guava from 33.4.5-jre to 33.4.6-jre (#2186) @dependabot[bot]
Bump net.bytebuddy:byte-buddy from 1.17.2 to 1.17.4 (#2179) @dependabot[bot]
[MNG-8641] - Bump org.apache.maven:maven-parent from 43 to 44 (#2162) @dependabot[bot]
Bump com.google.guava:guava from 33.4.0-jre to 33.4.5-jre (#2166) @dependabot[bot]
[MNG-8630] - Bump ch.qos.logback:logback-classic from 1.5.17 to 1.5.18 (#2161) @dependabot[bot]
Bump mockitoVersion from 5.16.0 to 5.16.1 (#2156) @dependabot[bot]
Bump org.junit:junit-bom from 5.12.0 to 5.12.1 (#2155) @dependabot[bot]

maven-3.8.9

2025-06-14T19:52:15Z

[maven-release-plugin] copy for tag maven-3.8.9

3.9.10

2025-06-06T20:30:59Z

Release Notes - Maven - Version 3.9.10

Bug

[MNG-8096] - Inconsistent dependency resolution behaviour for concurrent multi-module build can cause failures
[MNG-8169] - MINGW support requires --add-opens java.base/java.lang=ALL-UNNAMED
[MNG-8170] - Maven 3.9.8 contains weird native library for Jansi on Windows/arm64
[MNG-8211] - Maven should fail builds that use CI Friendly versions but have no values set
[MNG-8248] - WARNING: A restricted method in java.lang.System has been called
[MNG-8256] - ProjectDependencyGraph bug: in case of filtering, non-direct module links are lost
[MNG-8315] - Failure of mvn.cmd if a .mvn directory is located at drive root
[MNG-8396] - Maven takes forever to resume
[MNG-8711] - "Duplicate artifact" in LifecycleDependencyResolver

Improvement

[MNG-8370] - Introduce maven.repo.local.head
[MNG-8399] - JDK 24+ issues warning about usage of sun.misc.Unsafe
[MNG-8707] - Add methods to remove compile and test source roots
[MNG-8712] - improve dependency version explanation: it's a requirement, not always effective version
[MNG-8717] - Remove maven-plugin-plugin:addPluginArtifactMetadata from default binding
[MNG-8722] - Use a single standalone version of asm
[MNG-8731] - Use https for xsi:schemaLocation in generated descriptors
[MNG-8734] - Simplify scripting like "get project version" cases

Task

[MNG-8728] - Bump Eclipse Sisu from 0.9.0.M3 to 0.9.0.M4 and use Java 24 on CI

Dependency upgrade

[MNG-8289] - Update Plexus annotations to 2.2.0
[MNG-8443] - Bump com.google.guava:guava from 33.2.1-jre to 33.4.0-jre
[MNG-8531] - Bump org.codehaus.plexus:plexus-utils from 3.5.1 to 3.6.0
[MNG-8532] - Bump commons-io:commons-io from 2.16.1 to 2.18.0
[MNG-8534] - Bump org.codehaus.mojo:buildnumber-maven-plugin from 3.2.0 to 3.2.1
[MNG-8635] - Bump com.google.guava:failureaccess from 1.0.2 to 1.0.3
[MNG-8636] - Bump com.google.guava:guava from 33.4.0-jre to 33.4.5-jre
[MNG-8640] - Bump org.apache.maven:maven-parent from 43 to 44
[MNG-8661] - Bump com.google.guava:guava from 33.4.5-jre to 33.4.6-jre
[MNG-8701] - Bump org.codehaus.plexus:plexus-interpolation from 1.27 to 1.28
[MNG-8702] - Bump org.codehaus.plexus:plexus-classworlds from 2.8.0 to 2.9.0
[MNG-8703] - Bump commons-io:commons-io from 2.18.0 to 2.19.0
[MNG-8704] - Bump com.google.guava:guava from 33.4.6-jre to 33.4.8-jre
[MNG-8705] - Bump commons-jxpath:commons-jxpath from 1.3 to 1.4.0
[MNG-8706] - Bump commons-cli:commons-cli from 1.8.0 to 1.9.0
[MNG-8715] - Bump org.fusesource.jansi:jansi from 2.4.1 to 2.4.2
[MNG-8716] - Bump resolver to 1.9.23
[MNG-8745] - Bump xmlunitVersion from 2.10.0 to 2.10.2

What's Changed

[MNG-8211] Fail the build if CI Friendly revision used without value by @cstamas in #1656
Add missing since by @cstamas in #1682
[MNG-8256] FilteredProjectDependencyGraph fix for non-transitive case by @cstamas in #1724
[MNG-8315] Failure of mvn.cmd if a .mvn folder is located at drive root by @fmarot in #1806
[MNG-8289] Update Plexus Annotations to 2.2.0 by @dependabot in #1666
[MNG-8370] Add maven.repo.local.head by @slawekjaranowski in #1915
[MNG-8443] Bump com.google.guava:guava from 33.2.1-jre to 33.4.0-jre by @dependabot in #1991
[MNG-8531] Bump org.codehaus.plexus:plexus-utils from 3.5.1 to 3.6.0 by @dependabot in #2013
[MNG-8532] Bump commons-io:commons-io from 2.16.1 to 2.18.0 by @dependabot in #1926
[MNG-8534] Bump org.codehaus.mojo:buildnumber-maven-plugin from 3.2.0 to 3.2.1 by @dependabot in #1699
Add PR Automation action by @slawekjaranowski in #2113
Bump com.google.guava:failureaccess from 1.0.2 to 1.0.3 by @dependabot in #2167
Bump com.google.guava:guava from 33.4.0-jre to 33.4.5-jre by @dependabot in #2168
[MNG-8640] Bump org.apache.maven:maven-parent from 43 to 44 by @dependabot in #2163
Use Maven 3.9.9 for build maven-3.9.x branch by @slawekjaranowski in #2177
[MNG-8248] Add enable-native-access to startup scripts by @slawekjaranowski in #2171
[MNG-8661] Bump com.google.guava:guava from 33.4.5-jre to 33.4.6-jre by @dependabot in #2185
Use dedicated local repo for ITs on Jenkins by @slawekjaranowski in #2255
[MNG-8701] Bump org.codehaus.plexus:plexus-interpolation from 1.27 to 1.28 by @dependabot in #2240
[MNG-8702] Bump org.codehaus.plexus:plexus-classworlds from 2.8.0 to 2.9.0 by @dependabot in #2241
[MNG-8703] Bump commons-io:commons-io from 2.18.0 to 2.19.0 by @dependabot in #2258
[MNG-8704] Bump com.google.guava:guava from 33.4.6-jre to 33.4.8-jre by @dependabot in #2264
[MNG-8705] Bump commons-jxpath:commons-jxpath from 1.3 to 1.4.0 by @dependabot in #2270
[MNG-8706] Bump commons-cli:commons-cli from 1.8.0 to 1.9.0 by @dependabot in #1665
[MNG-8715] Bump org.fusesource.jansi:jansi from 2.4.1 to 2.4.2 by @dependabot in #2280
[MNG-8707] Add methods to remove compile and test source roots by @gnodet in #2275
[MNG-8712] dependency version is a requirement, not effective by @hboutemy in #2279
[MNG-8717] Remove maven-plugin-plugin:addPluginArtifactMetadata from default binding by @slawekjaranowski in #2295
[MNG-8169] Add opens java.base/java.lang=ALL-UNNAMED for MinGW by @slawekjaranowski in #2296
[MNG-8722] Use a single standalone version of asm by @slawekjaranowski in #2297
[MNG-8716] Bump resolver to 1.9.23 by @slawekjaranowski in #2282
[MNG-8731] Use https for xsi:schemaLocation in generated descriptors by @slawekjaranowski in #2343
[MNG-8711] Fix concurrent cache access by @slawekjaranowski in #2345
Update README.md by @slawekjaranowski in #2353
[MNG-8728] Bump Eclipse Sisu from 0.9.0.M3 to 0.9.0.M4 by @cstamas in #2359
[MNG-8728] Build ITs on JDK 21, 24 by @slawekjaranowski in #2360
[MNG-8734] Make Maven 3.9.10 ignore --raw-streams option by @cstamas in #2361
Bump xmlunitVersion from 2.10.0 to 2.10.1 by @dependabot in #2354
[MNG-8396] Backport: add cache layer to the filtered dep graph by @cstamas in #2393
[MNG-8745] Bump xmlunitVersion from 2.10.1 to 2.10.2 by @dependabot in #2389

New Contributors

@fmarot made their first contribution in #1806

Full Changelog: maven-3.9.9...maven-3.9.10

Maven 4.0.0-rc-3

2025-03-10T12:29:17Z

Release notes

Maven has entered the release candidate phase and aims to be finally released in a few weeks. Please give it a try and report errors.

Upgrading from Maven 3

Maven 4 brings a tons of changes. We've tried hard to maximise compatibility with Maven 3.x, but in order to have your build work with Maven 4, you will need to upgrade some plugins (such as maven-enforcer-plugin, maven-remote-resources-plugin, maven-shade-plugin, etc...) to their most recent versions.

If your build is leveraging Maven extensions, you may very well expect some breakage. Some extensions may need to be updated:

the useful, but unmaintained, os-maven-plugin extension has been replaced with at nisse extension.

Contact the extensions' developers team to know their plans regarding supporting to Maven 4.

Upgrading from Maven 4.0.0-rc-2

Important note about breaking changes: Maven 4.0.0-rc-3 includes changes in the new API that will require updates in plugin targeting the new API, especially relating to [MNG-8395] which adds a new <source> element to the model and redirects the <sourceDirectory> element. Plugin developers will need to update their code to work with these changes.

Change log

What's Changed

[MNG-8437] mvnsh by @cstamas in #1982
[MNG-8438] maven-jline: Migrate to Maven DI (off javax.inject) by @cstamas in #1987
[MNG-8433] Use the switch expressions syntax by @CrazyHZM in #1983
[MNG-8436] Fix wrong transfer rates displayed in console by @gnodet in #1985
Exclude maven-xml and maven-xml-impl (the artifact has been renamed) by @gnodet in #1992
[MNG-8446] Project cannot start due to too many warnings by @gnodet in #1993
[MNG-8447] Lossy ProblemCollector by @cstamas in #1994
[MNG-8454] Force the FileSizeFormat UT to US Locale by @cstamas in #2003
[MNG-8460] Implement flush() by @cstamas in #2006
[MNG-8463] Update plugins by @cstamas in #2005
[MNG-8461] Initial settings method must restore context state by @cstamas in #2004
[MNG-8465] Add support for project.rootDirectory in repositories and fix other expressions by @gnodet in #2007
[MNG-8461] Integrate reproducer as IT by @cstamas in #2009
[MNG-8469] Fix interpolation precedence order by @cstamas in #2011
[MNG-8487] Completely isolate UTs by @cstamas in #2021
MNG-8479 - Use 'ejb' not 'ejb3' as type in ReactorReader artifact resolution for compile phase by @scottkurz in #2016
Copy edits in comments, API doc, and messages by @elharo in #2020
Fix comparisons against null in PathSource.equals by @elharo in #2026
[MNG-8502] Embedded executor should obey MAVEN_ARGS env variable by @cstamas in #2032
[MNG-8475] In the loop scenario, StringBuilder is used instead of concatenation by @CrazyHZM in #2014
[MNG-8473] Site fixes by @cstamas in #2010
[MNG-8494] Restore Maven 3 compatibility by @gnodet in #2031
[MNG-8482] Use instanceof assignments to get rid of casting expressions by @breun in #2018
[MNG-8483] Prefer Objects.requireNonNull by @elharo in #2019
[MNG-8493] 'serialVersionUID' can be annotated with '@serial' annotation by @Stellar1999 in #2034
[MNG-8513] Be stricter about xml combination modes by @gnodet in #2038
[MNG-8514] Improve VersionRangeResolverResult by @gnodet in #2039
[MNG-8510] Remove Utils class from maven-di by @gnodet in #2040
[MNG-8515] Use internal interpolator by @gnodet in #2044
[MNG-8478] Fix formatting of timestamp in logger by @gnodet in #2046
[MNG-8522] Deprecate maven-builder-support artifact and its classes by @gnodet in #2043
[MNG-6113] Restore 'Maven Central Repository' name (lost with #1139) by @gnodet in #2054
[MNGSITE-393] Remove references to Maven 2.x by @elharo in #2024
[MNG-8512] Fix org.slf4j.simpleLogger.defaultLogLevel Configuration conflict by @CrazyHZM in #2042
[MNG-8520] Add cache for model resolution during project building by @gnodet in #2047
[MNG-8508] Move content of maven-impl to the org.apache.maven.impl package by @gnodet in #2060
[MNG-8524] DefaultInterpolator should be used by injection by @CrazyHZM in #2049
[MNG-8395] [BREAKING CHANGE] Add a element in the model. Plugins will need to be updated to work with this new API. by @desruisseaux in #1936
[MNG-8503] Configure logging using maven.logger.* properties rather than org.slf4j.simpleLogger.* by @gnodet in #2048
[MNG-8477] Fix problems with file activation being wrongly cached by @gnodet in #2062
[MNG-8525] Add an integration test with Maven 4 Plugin Sample by @sparsick in #2055
[MNG-8527] Re-enable consumer POM, trim down the consumer pom further by @gnodet in #2058
[MNG-8544] Conflicting extensions went unnoticed by @cstamas in #2063
[MNG-8545] Use of RemoteRepository in keys w/o equals/hashes by @cstamas in #2064
[MNG-8523] Make sure user properties override model properties by @gnodet in #2059
[MNG-8519] Introduce Request / Results / RequestTrace by @gnodet in #2050
[MNG-8541] Support throwing Exception from Mojo#execute by @laeubi in #2066
[MNG-8545] More repository handling fixes by @cstamas in #2067
Just some details i spotted during debug by @cstamas in #2068
[MNG-8513] Move xml combination mode validation to validator by @cstamas in #2069
[MNG-8395] [BREAKING CHANGE] Redirect the element to by @desruisseaux in #2061
Add javadoc to DI by @gnodet in #2072
ProjectManager cleanup by @gnodet in #2073
Simplify and complete method implementation by @cstamas in #2075
[MNG-8550] Update JLine3 to 3.29.0 by @cstamas in #2074
[MNG-8551] Improve early error reporting by @cstamas in #2076
[MNG-8554] Fix UT suite for CLI by @cstamas in #2078
[MNG-8555] Use plexus-sec-dispatcher 4.1.0 by @kwin in #2080
[MNG-8241] Test comparing letters to numbers by @elharo in #2081
[MNG-7592] String deduplication in model building by @gnodet in #2083
[MNG-8530] Prompter fixes by @cstamas in #2086
[MNG-8561] SourceRoot should be more lenient wrt duplicates by @gnodet in #2085
[MNG-8563] Provide a weak cache for objects from the main model by @gnodet in #2087
[MNG-8564] Move to maven-compat Plexus legacy by @cstamas in #2088
Make full build upload surefire logs in case of failure. by @cstamas in #2089
[MNG-8565] Thread leaks in maven-cli by @cstamas in #2090
[MNG-8540] Add cache to API requests by @gnodet in #2051
[MNG-8553] Resolver 2.0.6 by @cstamas in #2079
[MNG-8535] Full std stream support for executor by @cstamas in #2082
Add badge for 3.x version by @slawekjaranowski in #2094
[MNG-8241] Handle non-BMP characters when comparing versions by @elharo in #2071
Align Toolbox versions by @cstamas in #2096
Fix links to Settings Descriptor Reference by @kwin in #2095
[MNG-8573] OS Service by @cstamas in #2099
[MNG-8517] Cleanup dependencies by @cstamas in #2098
[MNG-8571] Sisu @priority annotation is not honoured by @gnodet in #2097
[MNG-8562] remove "child" attributes from by @gnodet in #2101
[MNG-8575] Replace a list with O(N²) performance by O(N) at least during iteration. by @desruisseaux in #2092
[MNG-8558] Switch toolchain support for v4 API by @gnodet in #2084
Dump public IPs of runners by @cstamas in #2103
[MNG-8567] Fix resumption to not recurse into subprojects by @gnodet in #2102
[MNG-8577] Project POM hierarchy by @cstamas in #2104
[MNG-8579] StdOut/StdErr printstream bug by @cstamas in #2108
[MNG-8558] Move JavaToolchain by @gnodet in #2107
[MNG-8540] Improve cache extensibility by @gnodet in #2109
Add PR Automation action by @slawekjaranowski in #2105
Add Stale action by @slawekjaranowski in #2111
[MNG-8582] Keep stdout/stderr functioning by @cstamas in #2112
[MNGSITE-441] Characterization tests for case insensitivie version strings by @elharo in #2114
[MNG-8586] Expose Maven version segments as properties by @cstamas in #2116
[MNG-8587] mvnsh navigation by @cstamas in #2117
[MNG-8580] Keep devs/contributors by @cstamas in #2122
[MNG-8590] Make sure maven-resolver-provider does not depend on maven-impl by @gnodet in #2123
[MNG-8591] Fix default value for plugin resolution (which has always been null) by @gnodet in #2124
[MNG-8592] Package Sisu enabled JAR separately by @cstamas in #2125
[MNG-8595] Bump slf4jVersion from 2.0.16 to 2.0.17 by @cstamas in #2130
[MNG-8594] Add atFile option by @cstamas in #2131
[MNG-8588] Add activated profiles to Project interface by @gnodet in #2132
[MNG-8599] Generated source files should be included in the sources jars by @gnodet in #2133
[MNG-8600] Allow Terminal and raw streams customization by @cstamas in #2134
[MNG-8593] Bump to Resolver 2.0.7 by @cstamas in #2135
[MNG-8601] Add type test-java-source type by @cstamas in #2136
[MNG-8604] Use soft references for cache by @gnodet in #2138
[MNG-8602] Fix BOM consumer pom by @gnodet in #2139
[MNG-8605] The log file should be appended to by @gnodet in #2137
[MNG-8610] Add javadoc for all o.a.m.api packages by @gnodet in #2142
[MNG-8599] Fix configuration for maven-source-plugin by @slawekjaranowski in #2145
[MNG-8611] Build with apache-release profile by @gnodet in #2146

Dependencies

[MNG-8435] Bump net.bytebuddy:byte-buddy from 1.15.10 to 1.15.11 by @dependabot in #1984
[MNG-8442] Bump eu.maveniverse.maven.plugins:bom-builder3 from 1.0.2 to 1.0.3 by @dependabot in #1990
[MNG-8441] Bump org.junit:junit-bom from 5.11.3 to 5.11.4 by @dependabot in #1989
[MNG-8440] Bump org.junit.jupiter:junit-jupiter from 5.11.3 to 5.11.4 by @dependabot in #1988
Bump com.google.guava:guava from 33.3.1-jre to 33.4.0-jre by @dependabot in #1995
Bump ch.qos.logback:logback-classic from 1.5.12 to 1.5.13 by @dependabot in #1999
Bump ch.qos.logback:logback-classic from 1.5.13 to 1.5.14 by @dependabot in #2001
Bump org.assertj:assertj-core from 3.26.3 to 3.27.0 by @dependabot in #2002
Bump ch.qos.logback:logback-classic from 1.5.14 to 1.5.15 by @dependabot in #2008
Bump ch.qos.logback:logback-classic from 1.5.15 to 1.5.16 by @dependabot in #2028
Bump org.assertj:assertj-core from 3.27.0 to 3.27.2 by @dependabot in #2027
Bump mockitoVersion from 5.14.2 to 5.15.2 by @dependabot in #2017
Bump com.github.siom79.japicmp:japicmp-maven-plugin from 0.23.0 to 0.23.1 by @dependabot in #2035
Bump org.assertj:assertj-core from 3.27.2 to 3.27.3 by @dependabot in #2053
Bump net.bytebuddy:byte-buddy from 1.15.11 to 1.16.1 by @dependabot in #2052
Bump net.bytebuddy:byte-buddy from 1.16.1 to 1.17.0 by @dependabot in #2070
Bump org.junit:junit-bom from 5.11.4 to 5.12.0 by @dependabot in #2121
Bump ch.qos.logback:logback-classic from 1.5.16 to 1.5.17 by @dependabot in #2128
Bump mockitoVersion from 5.15.2 to 5.16.0 by @dependabot in #2140
Bump net.bytebuddy:byte-buddy from 1.17.1 to 1.17.2 by @dependabot in #2141

New Contributors

@scottkurz made their first contribution in #2016
@breun made their first contribution in #2018
@Stellar1999 made their first contribution in #2034
@sparsick made their first contribution in #2055

Full Changelog: maven-4.0.0-rc-2...maven-4.0.0-rc-3

4.0.0-rc-2

2024-12-16T23:58:34Z

Release notes

Maven has entered the release candidate phase and aims to be finally released in a few weeks. Please give it a try and report errors.

Upgrading from Maven 3

If your build is leveraging Maven extensions, you may very well expect some breakage. Some extensions may need to be updated:

the useful, but unmaintained, os-maven-plugin extension has been forked and now maintained at os-detector-maven-plugin

Contact the extensions' developers team to know their plans regarding supporting to Maven 4.

Known issues

the mvnenc tool used to encrypt passwords in settings is broken
download rates appearing in the console display wrong values

Change log

Improvements

[MNG-5729] Use monotonic time measurements by @gnodet in #1965
[MNG-8394] Event bridge and properties fix by @cstamas in #1937
[MNG-8403] Maven ITs use maven-executor by @cstamas in #1940
[MNG-8407] Add target attribute to SVG links by @kwin in #1954
[MNG-8415] Add constant for the security settings xml file by @gnodet in #1956
[MNG-8419][MNG-8424] Too aggressive warning for pre-Maven4 passwords by @cstamas in #1970

Bug fixes

IT: Move ITs off maven-shared-utils by @cstamas in #1941
[MNG-8389] MavenExReq lacks u/p/i settings file paths by @cstamas in #1939
[MNG-8391] Wrong effective model when conflicting values come from parents and profiles by @gnodet in #1942
[MNG-8396] Add a cache layer to the filtered dependency graph by @gnodet in #1944
[MNG-8400] Make sure base parser uses canonical maven.home by @cstamas in #1945
[MNG-8402] System properties can take precedence over builtin expressions by @gnodet in #1947
[MNG-8405] Fail On Severity, when set, is not reset (in resident instances) by @gnodet in #1950
[MNG-8403] Collapse IT utils and helpers by @cstamas in #1949
IT: Drop dead stuff by @cstamas in #1951
[MNG-8404] ModelValidator: add unit tests and simplify a bit by @gnodet in #1948
IT: Streamline ITs more by @cstamas in #1952
[MNG-8388] Fix escape characters being replaced to change the original configuration by @CrazyHZM in #1946
Use https for www.apache.org/licenses/ by @slawekjaranowski in #1955
[MNG-8401] Reference global Maven download page by @kwin in #1953
[MNG-8410] API cleanup by @gnodet in #1957
[MNG-8411][MNG-8412][MNG-8416] mvnenc fixes by @cstamas in #1959
[MNG-8393] Enable consumer pom by default for 4.1.0 model version only by @gnodet in #1963
[MNG-8421] Move all of logging setup to LookupInvoker; mvnenc IT by @cstamas in #1964
[MNG-8423] mvnenc -h by @cstamas in #1971
[MNG-8406] Proper IT isolation by @cstamas in #1968
Add missing package infos by @gnodet in #1980
[MNG-5729] Fix possible NPE with introduction of mononic clock by @gnodet in #1972
[MNG-5729] Fix transfer rate computation by @gnodet in #1969
[MNG-8244] Using before:all / all / after:all is not triggered by @gnodet in #1973
[MNG-8245][MNG-8246] Warn when calling before: or after: phases by @gnodet in #1974
[MNG-3282] Docgen: remove property numbering, they are misleading and properties are "floating" anyway (alphabetically) by @gnodet in #1979
[MNG-8414] The consumer pom should warn if not able to downgrade the model version to 4.0.0 by @gnodet in #1981

Dependency upgrade

[MNG-8420] Bump jlineVersion from 3.27.1 to 3.28.0 by @dependabot in #1962
[MNG-8430] Resolver 2.0.5 by @cstamas in #1975
[MNG-8427] Bump PlexusSecDispatcher to 4.0.3 by @cstamas in #1959

Full changelog

maven-4.0.0-rc-1...maven-4.0.0-rc-2