Skip to content

Update dependency maven to v4.0.0-rc-6 - #9625

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/maven-4.x
Open

Update dependency maven to v4.0.0-rc-6#9625
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/maven-4.x

Conversation

@renovate

@renovate renovate Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
maven (source) 4.0.0-rc-5 → 4.0.0-rc-6 age confidence

Release Notes

apache/maven (maven)

v4.0.0-rc-6: Maven 4.0.0-rc-6

Compare Source

Notes

This new release candidate of Maven 4 is released to get feedback from users.
Maven 4 has restricted a few things compared to Maven 3, so make sure to run the mvnup tool before trying your project with Maven 4.

Issues fixed since RC-5

All known issues reported in the RC-5 release notes have been fixed:

  • Bean configuration bug — field accessibility state was cached globally, causing plugin configuration injection failures. Fixed in #​11433.
  • Concurrency issue in the v4 API — a ConcurrentModificationException was fixed in #​11429.
  • BOM packaging — consumer POM conversion for BOM projects now correctly preserves dependency versions. Fixed in #​11464.
  • macOS Gatekeeper — the extracted JLine native binaries that triggered Gatekeeper have been removed from the distribution (#​11997). The xattr workaround from RC-5 is no longer needed.
Known compatibility issues

The following are known compatibility issues when using Maven 4. Running
mvnup before building with
Maven 4 will fix many common plugin version issues automatically. The issues
below are those that require manual intervention or upstream fixes.

Stricter POM validation

Maven 4 enforces stricter validation than Maven 3. Projects may need to fix their POMs:

  • Duplicate XML elements — duplicate <artifactId>, <properties>, etc. are now rejected (Duplicated tag error). Fix the source POM.
  • Duplicate dependency declarations — same groupId:artifactId declared twice is now rejected (must be unique).
  • Uninterpolated expressions — ${...} expressions in repository URLs, distribution management IDs, and other fields that Maven 3 silently accepted are now rejected.
  • Invalid XML in transitive POMs — illegal processing instructions or undeclared namespace prefixes in transitive POMs cause Non-parseable POM errors.
  • Properties in <module> paths — Maven 4 no longer interpolates properties like ${spark.version} in <module> elements at POM reading time.
  • CI-friendly versions — projects using ${revision} without flatten-maven-plugin may hit missing dependency version errors.
  • Invalid Collect Request — transitive dependencies with uninterpolated ${...} version expressions are rejected.
Transitive dependency resolution changes

Maven 4's TransitiveDependencyManager applies dependencyManagement at all transitive depths (Maven 3 only applied it at the first level). This is intentional but can change resolved versions:

  • Dependencies previously on the classpath may disappear — add explicit declarations. See #​12302.
  • maven-enforcer-plugin version rules may trigger due to downgraded transitive versions.
  • license-maven-plugin may report new transitive dependencies not in the allow-list.
  • Karaf feature verification may fail due to OSGi bundle version mismatches.
Plugin and extension compatibility

Some plugins and extensions require specific versions for Maven 4:

  • Quarkus — versions before 3.20 use ServiceLocator/RepositorySystem patterns incompatible with Maven 4's Sisu-based DI. Upgrade to Quarkus 3.20+.
  • Tycho — versions before 5.0 use Guice/Sisu injection patterns broken by Maven 4. Upgrade to Tycho 5.0.3+.
  • Develocity Maven extension — fails to initialize due to SLF4J classloading changes (ClassNotFoundException: SimpleLogger).
  • pgpverify-maven-plugin — versions before 1.20 hit a ClassCastException with Maven 4's resolver. See resolver#1957.
  • cyclonedx-maven-plugin — fails with Invalid Version Range Request when using ${revision} CI-friendly versions.
  • maven-site-plugin — Velocity template rendering may fail with incompatible site plugin versions.
  • maven-shade-plugin — dependency-reduced-pom.xml can cause The parents form a cycle error.
  • commons-release-plugin — clean-staging fails under Maven 4.
Classloading changes
  • Plugins relying on Maven 3's classrealm layout may encounter "foreign imports" errors (e.g., Quarkus, JAXB plugins).
  • Maven 4's prefix-based repository routing may block artifacts not matching /.meta/prefixes.txt.
Post-mvnup formatting
  • spotless-maven-plugin and sortpom-maven-plugin may report formatting violations after mvnup modifies POM files. Re-run the formatter after mvnup.
Other
  • Broken upstream POMs — e.g., hadoop-project 3.1.0–3.3.0 has invalid XML (<Xlint:-unchecked/>) causing parse errors. These need upstream fixes tracked in HADOOP-19923.
  • Enforcer POM element ordering — Maven 4's model builder reorders POM elements into a canonical order, which can break enforcer rules checking element ordering.
  • SNAPSHOT handling — SNAPSHOT artifacts may show as "present, but unavailable" under Maven 4's different resolver metadata handling.

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the renovate Renovate label Aug 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

renovate Renovate

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants