Upgrade to Maven 4.0.0-rc-6

[slachiewicz]

Maven 4.0.0-rc-6 was released on 2026-07-30. This tracks moving the repositories that build against a Maven 4 pre-release onto it, so nothing is left pinned to rc-5 or older.

Each linked PR moves the repository's Maven 4 version property and — where the repository was relying on the maven4-version default in maven-gh-actions-shared — also pins the version explicitly in that repository's own maven-verify.yml, so its CI no longer moves when the shared default does.

Shared CI default

PR	Status / notes
apache/maven-gh-actions-shared#298	merged — maven4-version default rc-5 → rc-6, base v4
apache/maven-gh-actions-shared#299	merged — same change, base v5

Maven core

PR	Status / notes
#12674	merged — wrapper job → rc-6 (master), plus commenting out the Google mirror
#12675	merged — wrapper job → rc-6 (maven-4.0.x), plus commenting out the Google mirror
apache/maven-mvnd#1714	merged — maven.version + wrapper distributionUrl, plus the resolver 2.0.21 / slf4j 2.0.18 / JLine 4.3.1 sync and the jline-terminal-jansi → jansi-core rename. The GraalVM native jobs fail on master too (stat@GLIBC_2.17), so that red is not from this change
apache/maven-resolver#2027	merged — maven4Version
apache/maven-build-cache-extension#520	merged — maven4.0 profile
apache/maven-executor#35	merged — version.maven4 + CI pin

Plugins and shared components

PR	Status	Was on
apache/maven-clean-plugin#329	merged	rc-5
apache/maven-deploy-plugin#685	merged	rc-5
apache/maven-install-plugin#429	merged	rc-5
apache/maven-archiver#390	merged	rc-5
apache/maven-filtering#367	merged	rc-5
apache/maven-compiler-plugin#1104	merged	rc-4
apache/maven-jar-plugin#573	merged	rc-4 — same change as my #574, which is closed as superseded
apache/maven-resources-plugin#500	merged	rc-4
apache/maven-source-plugin#268	open, changes requested (by @sparsick, predates this effort)	beta-3 — a migration, not a bump. My duplicate #315 is closed in its favour
apache/maven-plugin-tools#1146	merged	rc-4
codehaus-plexus/plexus-xml#87	merged	rc-5 (maven-xml dependency)

Jenkins

PR	Status / notes
apache/maven-jenkins-lib#22	merged — provisions Maven on Jenkins through the wrapper (maven-wrapper-plugin:3.3.4:wrapper -Dmaven=${maven}, then ./mvnw), applying the pattern already used in maven-gh-actions-shared v5
#12677	merged — same change for apache/maven's own Jenkinsfile on maven-4.0.x: deploy through ./mvnw rather than the maven_3_latest Jenkins tool
apache/maven-clean-plugin#331	merged — siteMvn was passed as a List, which stringifies to [4.0.x], misses the version mapping and silently ran the site stage on Maven 3
apache/maven-compiler-plugin#1107	merged — same fix, in the repo's inert Jenkinsfile.disable
apache/maven-install-plugin#430	merged — same fix, in the repo's inert Jenkinsfile.disable
apache/maven-resources-plugin#501	open — same fix, live Jenkinsfile
apache/maven-jar-plugin#575	merged — same fix, live Jenkinsfile
apache/maven-jenkins-env#8	merged — adds mvnVersionFromPattern, returning a concrete version (and null for anything unrecognised, so callers can fail loudly)
apache/maven-jenkins-lib#23	merged — fixed a live breakage from #22: -Dmaven= was given the pattern 4.0.x, which the wrapper turns into apache-maven-4.0.x-bin.zip (404). Needs maven-jenkins-env#8 first

CI-only version pins (3.x lines verifying against Maven 4)

PR	Status	Was on
apache/maven-compiler-plugin#1105	merged	rc-4
apache/maven-mapping#58	merged	rc-4
apache/maven-shared-io#122	merged	rc-2

Known blockers

The Google Cloud mirror of Central has not synced rc-6. apache-maven-4.0.0-rc-6-bin.zip is a 404 on maven-central.storage-download.googleapis.com/maven2 while repo.maven.apache.org serves it, and rc-5 is present on the mirror. .github/workflows/maven.yml pointed the wrapper there via MVNW_REPOURL, which broke the initial-build job on both core PRs; they now leave it unset so the wrapper downloads from Central. Note the same mirror is configured for dependency resolution in .github/ci-mimir-session.properties.

ASF Jenkins does not have 4.0.0-rc-6 installed — maven_4_latest still resolves to 4.0.0-rc-5 on the build nodes. apache/maven-jenkins-lib#22 and its follow-up #23 have both merged, so builds now provision Maven through the wrapper rather than depending on an installed tool, which removes the need for a per-release INFRA request. The node installation is tracked separately in INFRA-28215. Confirmed by rerunning all 93 master and 3.x jobs: 89 green. Worth noting only 4 of them had run at all since the library changed, so the green results that predated the rerun proved nothing — the rerun was the point.

apache/maven-jar-plugin#573 carries the same relocation fix. The version bump alone made JarMojoTest fail with expected: <foo> but was: <myGroupId>: rc-6's relocated MojoExtension only recognises the new annotation types, so with the deprecated org.apache.maven.api.plugin.testing names the @InjectMojo attributes come back null and the @Basedir pom is never read. It still compiles, which makes this a silent behavioural break for any plugin left on the old imports — worth knowing beyond this one repository.

apache/maven-resources-plugin#500 fixes the MRESOURCES-131 failure that the bump surfaced. It is not an rc-6 regression — the same assertion fails on rc-5. ResourcesMojo and TestResourcesMojo both declare a private skip field; they collapse into one descriptor parameter for testResources and the configurator writes the superclass field, so <skip>true</skip> never reaches the goal.

apache/maven-source-plugin#268 completes the migration from 4.0.0-beta-3 — the furthest behind of the 4-native plugins. maven-api-meta/maven-api-impl are replaced, and getCompileSourceRoots/getResources move onto the unified SourceRoot model with attachArtifact taking a ProducedArtifact. 10 unit tests pass and all 23 ITs pass. MSOURCES-140 needed a second commit: its assertion contained a literal " + File.separator + " inside a Groovy slashy regex, so it could never match, and it had been skipped on beta-3 via invoker.properties.

---

Status column last refreshed 2026-08-04. 34 of 35 merged; 1 open.

---

Open pull requests

• Update maven to 4.0.0-rc-6 maven-source-plugin#268 — checks green, changes requested: move the test harness off the deprecated org.apache.maven.api.plugin.testing.* annotations, and take resources through getEnabledSourceRoots(..., Language.RESOURCES) rather than the deprecated model API

Everything else in this upgrade has merged.

The two branches that were failing on the old parent are fixed: apache/maven-reporting-api#77 (parent 34 -> 49, which brings an apache-rat that accepts the generated wrapper properties file) and apache/maven-reporting-impl#241 (dropping a doxia -SNAPSHOT that no longer resolves). Neither branch has been rebuilt yet.

Jenkins rerun of all 93 master and 3.x jobs — complete

89 green, 3 failures, 1 unstable. None of the four is caused by the rc-6 upgrade:

• maven-reporting-api-3.x — apache-rat rejects .mvn/wrapper/maven-wrapper.properties, which the shared library now generates and which carries no licence header. Only bites branches on old parents; that branch is on maven-shared-components:34, its own master is on 49 and passes.
• maven-reporting-impl-3.x — stale doxia-sink-api:1.12.0-SNAPSHOT.
• maven-surefire/master — E2ETest.endToEndTest, no wrapper errors in the log.
• maven-shared-utils/master — already unstable before the rerun.

maven-resources-plugin/master went green once #500 merged, which confirms the <skip> fix on master.

[slachiewicz]

Status and remaining work

28 of 35 pull requests merged. Every repository that referenced a pre-rc-6 Maven 4 version is now either merged or has an open PR — there is nothing left to find.

Still open

PR	State
apache/maven-mvnd#1714	approved. The four GraalVM Build native distribution jobs fail on master too (undefined reference to stat@GLIBC_2.17 on ubuntu-24.04-arm), so that red is not from this change; apache/maven-mvnd#1712 is the fix for it
apache/maven-resources-plugin#500	approved. Carries the <skip> workaround for the shadowed-parameter bug, with a TODO pointing at #12626, which fixes the cause in the core configurator
apache/maven-source-plugin#315	awaiting review. Migration off 4.0.0-beta-3 onto the SourceRoot model; all 23 ITs pass
apache/maven-executor#35	awaiting review
apache/maven-dist-tool#202	awaiting review. Rewrites the master-jobs report as a sorted table and fixes a broken status icon (&#2754; is decimal 2754 = U+0AC2, a Gujarati vowel sign, not U+2754)

Jenkins verification in progress

All 93 master and 3.x jobs in maven-box were rerun after the shared-library fixes landed. This mattered because only 4 of the 95 jobs had run at all since apache/maven-jenkins-lib#22 changed how Maven is provisioned — every other green result predated it.

So far: 17 finished, all green; 76 still building; no failures.

The mechanism is confirmed working. From maven-clean-plugin master #57:

+ mvn ... maven-wrapper-plugin:3.3.4:wrapper -Dmaven=4.0.0-rc-6
+ ./mvnw ...
Apache Maven 4.0.0-rc-6 (6a8189b24518daa120539fa41ce12f2b48ec09a8)
Maven home: /home/jenkins/.m2/wrapper/dists/apache-maven-4.0.0-rc-6/2fa31093
[INFO] BUILD SUCCESS

Note the node's own maven_4_latest still resolves to 4.0.0-rc-5 — the build runs on rc-6 purely through the wrapper. An INFRA request to install rc-6 on the build nodes is therefore no longer needed for these builds.

Known issues that are not part of this upgrade

• maven-testing: deprecated org.apache.maven.api.plugin.testing annotations compile but are silently ignored #12678 — the deprecated org.apache.maven.api.plugin.testing annotations still compile but are silently ignored by the relocated MojoExtension, so a plugin that has not moved its imports keeps building and quietly stops reading its test POMs. Also covers ProducedArtifactStub's shim losing its five-argument constructor.
• Fix field cache to let child class fields take precedence over parent #12626 — EnhancedCompositeBeanHelper.buildFieldCache() lets a parent field shadow a child's, which is what breaks <skip> on testResources. Once released, the workaround in maven-resources-plugin#500 can be removed.
• maven_4_latest on the ASF build nodes still points at 4.0.0-rc-5. Not blocking anything now, but worth an INFRA ticket for anything that bypasses the wrapper.

[slachiewicz]

Jenkins rerun complete — 90 of 93 finished, 85 green

All master and 3.x jobs in maven-box were rerun after the shared-library fixes. Five did not come back green; here is what each one is, since only one of them is actually caused by this work.

Job	Cause	Ours?
maven-resources-plugin/master #175	UNSTABLE — MRESOURCES-131 FAILED, 26 ITs passed	No, and apache/maven-resources-plugin#500 fixes it. The IT has been failing since 4.0.0-rc-5
maven-shared-utils/master #191	UNSTABLE — also unstable in #188 and #189, before the rerun	No, pre-existing
maven-surefire/master #485	E2ETest.endToEndTest failed. No wrapper or version-resolution errors in the log; #484 was green yesterday	No, unrelated to the wrapper change
maven-reporting-impl/maven-reporting-impl-3.x #5	Could not find artifact org.apache.maven.doxia:doxia-sink-api:jar:1.12.0-SNAPSHOT	No, a stale SNAPSHOT dependency
maven-reporting-api/maven-reporting-api-3.x #4	apache-rat: Too many files with unapproved license: 1	Yes — see below

The RAT failure is a side effect of provisioning the wrapper

Since apache/maven-jenkins-lib#22, every build generates the Maven wrapper into the workspace before building. That writes three files, and they are not equal in the eyes of apache-rat:

• mvnw — carries an ASF licence header
• mvnw.cmd — carries an ASF licence header
• .mvn/wrapper/maven-wrapper.properties — no header, just wrapperVersion / distributionType / distributionUrl

Exactly one unlicensed file, which matches the count RAT reports.

It only fails where the RAT configuration does not exclude it. maven-reporting-api-3.x inherits maven-shared-components:34, which predates the wrapper; the same repository's master is on maven-shared-components:49 and passes. So this will affect old maintenance branches on old parents, and leave modern branches alone — 1 job out of 93 here.

Worth deciding how to handle it rather than leaving it to surface repo by repo:

1. have the shared library exclude the generated file when it invokes the build,
2. have maven-wrapper-plugin emit a licence header in maven-wrapper.properties, which fixes it everywhere at once, or
3. leave it, and let affected maintenance branches add a RAT exclusion when someone touches them.

What the rerun did confirm

85 green, including every repository in this upgrade, on both asfMavenTlpPlgnBuild and asfMavenTlpStdBuild, on Maven 3 and Maven 4 branches alike. Builds provision 4.0.0-rc-6 through the wrapper while the nodes still resolve maven_4_latest to 4.0.0-rc-5.