Sitelet https://github.com/apache/maven/releases
Skip to content

Releases: apache/maven

Release list

3.10.0

3.10.0 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Oct 08:29
maven-3.10.0
c43a36b

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

🔧 Build

📦 Dependency updates

Read more

Contributors

cstamas, gnodet, and 6 other contributors
Assets 2
Loading

Maven 4.0.0-rc-7

Maven 4.0.0-rc-7 Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Sep 22:50
maven-4.0.0-rc-7
6d8f301

This release candidate is expected to be the last before the Maven 4.0.0 GA release, which we aim to publish in the coming weeks, pending community feedback.

🚀 New features and improvements

🔧 Maintenance

  • Externalize default lifecycle plugin versions to POM properties (#13137) @gnodet

🐛 Bug Fixes

Read more

Contributors

cstamas, gnodet, and 9 other contributors
Loading

Maven 4.0.0-rc-6

Maven 4.0.0-rc-6 Pre-release
Pre-release

Choose a tag to compare

View all tags
@gnodet gnodet released this 30 Jul 15:59
maven-4.0.0-rc-6
6a8189b

Notes

This new release candidate of Maven 4 is released to get feedback from users.
Maven 4 has restricted a few things compared to Maven 3, so make sure to run the mvnup tool before trying your project with Maven 4.

Issues fixed since RC-5

All known issues reported in the RC-5 release notes have been fixed:

  • Bean configuration bug — field accessibility state was cached globally, causing plugin configuration injection failures. Fixed in #11433.
  • Concurrency issue in the v4 API — a ConcurrentModificationException was fixed in #11429.
  • BOM packaging — consumer POM conversion for BOM projects now correctly preserves dependency versions. Fixed in #11464.
  • macOS Gatekeeper — the extracted JLine native binaries that triggered Gatekeeper have been removed from the distribution (#11997). The xattr workaround from RC-5 is no longer needed.

Known compatibility issues

The following are known compatibility issues when using Maven 4. Running
mvnup before building with
Maven 4 will fix many common plugin version issues automatically. The issues
below are those that require manual intervention or upstream fixes.

Stricter POM validation

Maven 4 enforces stricter validation than Maven 3. Projects may need to fix their POMs:

  • Duplicate XML elements — duplicate <artifactId>, <properties>, etc. are now rejected (Duplicated tag error). Fix the source POM.
  • Duplicate dependency declarations — same groupId:artifactId declared twice is now rejected (must be unique).
  • Uninterpolated expressions — ${...} expressions in repository URLs, distribution management IDs, and other fields that Maven 3 silently accepted are now rejected.
  • Invalid XML in transitive POMs — illegal processing instructions or undeclared namespace prefixes in transitive POMs cause Non-parseable POM errors.
  • Properties in <module> paths — Maven 4 no longer interpolates properties like ${spark.version} in <module> elements at POM reading time.
  • CI-friendly versions — projects using ${revision} without flatten-maven-plugin may hit missing dependency version errors.
  • Invalid Collect Request — transitive dependencies with uninterpolated ${...} version expressions are rejected.

Transitive dependency resolution changes

Maven 4's TransitiveDependencyManager applies dependencyManagement at all transitive depths (Maven 3 only applied it at the first level). This is intentional but can change resolved versions:

  • Dependencies previously on the classpath may disappear — add explicit declarations. See #12302.
  • maven-enforcer-plugin version rules may trigger due to downgraded transitive versions.
  • license-maven-plugin may report new transitive dependencies not in the allow-list.
  • Karaf feature verification may fail due to OSGi bundle version mismatches.

Plugin and extension compatibility

Some plugins and extensions require specific versions for Maven 4:

  • Quarkus — versions before 3.20 use ServiceLocator/RepositorySystem patterns incompatible with Maven 4's Sisu-based DI. Upgrade to Quarkus 3.20+.
  • Tycho — versions before 5.0 use Guice/Sisu injection patterns broken by Maven 4. Upgrade to Tycho 5.0.3+.
  • Develocity Maven extension — fails to initialize due to SLF4J classloading changes (ClassNotFoundException: SimpleLogger).
  • pgpverify-maven-plugin — versions before 1.20 hit a ClassCastException with Maven 4's resolver. See resolver#1957.
  • cyclonedx-maven-plugin — fails with Invalid Version Range Request when using ${revision} CI-friendly versions.
  • maven-site-plugin — Velocity template rendering may fail with incompatible site plugin versions.
  • maven-shade-plugin — dependency-reduced-pom.xml can cause The parents form a cycle error.
  • commons-release-plugin — clean-staging fails under Maven 4.

Classloading changes

  • Plugins relying on Maven 3's classrealm layout may encounter "foreign imports" errors (e.g., Quarkus, JAXB plugins).
  • Maven 4's prefix-based repository routing may block artifacts not matching /.meta/prefixes.txt.

Post-mvnup formatting

  • spotless-maven-plugin and sortpom-maven-plugin may report formatting violations after mvnup modifies POM files. Re-run the formatter after mvnup.

Other

  • Broken upstream POMs — e.g., hadoop-project 3.1.0–3.3.0 has invalid XML (<Xlint:-unchecked/>) causing parse errors. These need upstream fixes tracked in HADOOP-19923.
  • Enforcer POM element ordering — Maven 4's model builder reorders POM elements into a canonical order, which can break enforcer rules checking element ordering.
  • SNAPSHOT handling — SNAPSHOT artifacts may show as "present, but unavailable" under Maven 4's different resolver metadata handling.

🚀 New features and improvements

🐛 Bug Fixes

Read more

Contributors

cstamas, gnodet, and 8 other contributors
Loading

3.10.0-rc-1

3.10.0-rc-1 Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Jul 08:21
maven-3.10.0-rc-1
1f7f1a5

💥 Breaking changes

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

📦 Dependency updates

Read more

Contributors

olamy, cstamas, and 7 other contributors
Loading

3.9.16

3.9.16

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 May 16:55
maven-3.9.16
This tag was signed with the committer’s verified signature.
slawekjaranowski Slawomir Jaranowski
GPG key ID: 9EB80E92EB2135B1
Verified
Learn about vigilant mode.
2bdd9fd
This commit was signed with the committer’s verified signature.
slawekjaranowski Slawomir Jaranowski
GPG key ID: 9EB80E92EB2135B1
Verified
Learn about vigilant mode.

🐛 Bug Fixes

📦 Dependency updates

Contributors

cstamas and slawekjaranowski
Loading

3.9.15

3.9.15

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Apr 09:19
maven-3.9.15
This tag was signed with the committer’s verified signature.
slawekjaranowski Slawomir Jaranowski
GPG key ID: 9EB80E92EB2135B1
Verified
Learn about vigilant mode.
98b2cdb
This commit was signed with the committer’s verified signature.
slawekjaranowski Slawomir Jaranowski
GPG key ID: 9EB80E92EB2135B1
Verified
Learn about vigilant mode.

📝 Documentation updates

📦 Dependency updates

Contributors

hboutemy and slawekjaranowski
Loading

3.9.14

3.9.14

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Mar 11:53
maven-3.9.14
996c630

🐛 Bug Fixes

📦 Dependency updates

Contributors

slawekjaranowski
Loading

3.9.13

3.9.13

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Mar 12:39
maven-3.9.13
39d686b

🐛 Bug Fixes

  • Bug: SecDispatcher is managed by legacy Plexus DI (#11711) @cstamas
  • [3.9.x] MavenPluginJavaPrerequisiteChecker: Handle 8/1.8 Java version in ranges as well (#11577) @cstamas

👻 Maintenance

📦 Dependency updates

Contributors

cstamas, slawekjaranowski, and slachiewicz
Loading

3.9.12

3.9.12

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Dec 21:09
maven-3.9.12
This tag was signed with the committer’s verified signature.
slawekjaranowski Slawomir Jaranowski
GPG key ID: 9EB80E92EB2135B1
Verified
Learn about vigilant mode.
848fbb4
This commit was signed with the committer’s verified signature.
slawekjaranowski Slawomir Jaranowski
GPG key ID: 9EB80E92EB2135B1
Verified
Learn about vigilant mode.

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

🔧 Build

📦 Dependency updates

Contributors

cstamas, gnodet, and 4 other contributors
Loading

4.0.0-rc-5

4.0.0-rc-5 Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Nov 14:07
maven-4.0.0-rc-5
fb3ecae

Notes

This new release candidate of Maven 4 is released to get feedback from users.
Maven 4 has a restrained a few things comparent to Maven 3, so make sure to run the mvnup tool before trying to project with Maven 4.

Bean configuration bug

A bug has been found in the bean configuration system where field accessibility state is cached globally. This can cause plugin configuration injection to fail when the same configuration field is accessed multiple times or in different contexts during a build. This particularly affects the plugin unit tests.

This will be fixed by #11433 in the next release.

Concurrency issue in the v4 API

A concurrency issue has been found in the Maven 4 API (still in preview mode) and will be fixed by #11428 in the next release.

BOM packaging

Another bug has been found in how BOM projects are processed. When a project uses BOM packaging, the consumer POM is not being properly converted to standard POM packaging, and dependency versions could be lost in some cases.

This will be fixed by #11427 in the next release.

macOS: JLine native library may be blocked by Gatekeeper on first use

On macOS (especially Apple Silicon), the first invocation of mvn may fail to load the JLine native terminal library with an error such as:

java.lang.UnsatisfiedLinkError: .../libjline-native/Mac/arm64/libjlinenative.jnilib: dlopen(...): code signature ... not valid for use in process: library load disallowed by system policy

This occurs when the binary distribution is downloaded via a web browser, which applies the com.apple.quarantine extended attribute.

Workaround (one-time fix):

xattr -r -d com.apple.quarantine /path/to/apache-maven-4.0.0-rc-5/lib/jline-native

Recommended download method (avoids the issue entirely):

curl -L -O https://archive.apache.org/dist/maven/maven-4/4.0.0-rc-5/binaries/apache-maven-4.0.0-rc-5-bin.tar.gz
tar -xzf apache-maven-4.0.0-rc-5-bin.tar.gz

This is a known issue #10747 and will be addressed in a future release.

💥 Breaking changes

  • Disable consumer POM flattening by default and add an opt-in feature (#11347) (#11370) @gnodet

🚀 New features and improvements

🐛 Bug Fixes

Read more

Contributors

cstamas, gnodet, and 5 other contributors
Loading