PackageTrack

Maven Central · #933 by repository stars

org.apache.maven:maven

3.9.16apache/maven ↗

Maven is a software build management and comprehension tool. Based on the concept of a project object model: builds, dependency management, documentation creation, site publication, and distribution publication are all controlled from the declarative file. Maven can be extended by plugins to utilise a number of other development tools for reporting or the build process.

Release timeline

104 releases since 2006
20062026

One column per quarter.

Releases

  1. 4.0.0-rc-65 Aug 2026pre-release
    Release notes

    Notes

    This new release candidate of Maven 4 is released to get feedback from users.
    Maven 4 has restricted a few things compared to Maven 3, so make sure to run the mvnup tool before trying your project with Maven 4.

    Issues fixed since RC-5

    All known issues reported in the RC-5 release notes have been fixed:

    • Bean configuration bug — field accessibility state was cached globally, causing plugin configuration injection failures. Fixed in #11433.
    • Concurrency issue in the v4 API — a ConcurrentModificationException was fixed in #11429.
    • BOM packaging — consumer POM conversion for BOM projects now correctly preserves dependency versions. Fixed in #11464.
    • macOS Gatekeeper — the extracted JLine native binaries that triggered Gatekeeper have been removed from the distribution (#11997). The xattr workaround from RC-5 is no longer needed.

    Known compatibility issues

    The following are known compatibility issues when using Maven 4. Running
    mvnup before building with
    Maven 4 will fix many common plugin version issues automatically. The issues
    below are those that require manual intervention or upstream fixes.

    Stricter POM validation

    Maven 4 enforces stricter validation than Maven 3. Projects may need to fix their POMs:

    • Duplicate XML elements — duplicate <artifactId>, <properties>, etc. are now rejected (Duplicated tag error). Fix the source POM.
    • Duplicate dependency declarations — same groupId:artifactId declared twice is now rejected (must be unique).
    • Uninterpolated expressions — ${...} expressions in repository URLs, distribution management IDs, and other fields that Maven 3 silently accepted are now rejected.
    • Invalid XML in transitive POMs — illegal processing instructions or undeclared namespace prefixes in transitive POMs cause Non-parseable POM errors.
    • Properties in <module> paths — Maven 4 no longer interpolates properties like ${spark.version} in <module> elements at POM reading time.
    • CI-friendly versions — projects using ${revision} without flatten-maven-plugin may hit missing dependency version errors.
    • Invalid Collect Request — transitive dependencies with uninterpolated ${...} version expressions are rejected.

    Transitive dependency resolution changes

    Maven 4's TransitiveDependencyManager applies dependencyManagement at all transitive depths (Maven 3 only applied it at the first level). This is intentional but can change resolved versions:

    • Dependencies previously on the classpath may disappear — add explicit declarations. See #12302.
    • maven-enforcer-plugin version rules may trigger due to downgraded transitive versions.
    • license-maven-plugin may report new transitive dependencies not in the allow-list.
    • Karaf feature verification may fail due to OSGi bundle version mismatches.

    Plugin and extension compatibility

    Some plugins and extensions require specific versions for Maven 4:

    • Quarkus — versions before 3.20 use ServiceLocator/RepositorySystem patterns incompatible with Maven 4's Sisu-based DI. Upgrade to Quarkus 3.20+.
    • Tycho — versions before 5.0 use Guice/Sisu injection patterns broken by Maven 4. Upgrade to Tycho 5.0.3+.
    • Develocity Maven extension — fails to initialize due to SLF4J classloading changes (ClassNotFoundException: SimpleLogger).
    • pgpverify-maven-plugin — versions before 1.20 hit a ClassCastException with Maven 4's resolver. See resolver#1957.
    • cyclonedx-maven-plugin — fails with Invalid Version Range Request when using ${revision} CI-friendly versions.
    • maven-site-plugin — Velocity template rendering may fail with incompatible site plugin versions.
    • maven-shade-plugin — dependency-reduced-pom.xml can cause The parents form a cycle error.
    • commons-release-plugin — clean-staging fails under Maven 4.

    Classloading changes

    • Plugins relying on Maven 3's classrealm layout may encounter "foreign imports" errors (e.g., Quarkus, JAXB plugins).
    • Maven 4's prefix-based repository routing may block artifacts not matching /.meta/prefixes.txt.

    Post-mvnup formatting

    • spotless-maven-plugin and sortpom-maven-plugin may report formatting violations after mvnup modifies POM files. Re-run the formatter after mvnup.

    Other

    • Broken upstream POMs — e.g., hadoop-project 3.1.0–3.3.0 has invalid XML (<Xlint:-unchecked/>) causing parse errors. These need upstream fixes tracked in HADOOP-19923.
    • Enforcer POM element ordering — Maven 4's model builder reorders POM elements into a canonical order, which can break enforcer rules checking element ordering.
    • SNAPSHOT handling — SNAPSHOT artifacts may show as "present, but unavailable" under Maven 4's different resolver metadata handling.

    🚀 New features and improvements

    🐛 Bug Fixes

    • Remove an optimization on PathSelector producing false negatives (#12623) @desruisseaux
    • Remove erroneous path normalization optimization + regression test (#12621) @gnodet
    • Fix #12583: Inverted file existence check in DefaultTransport.put() (#12619) @gnodet @elharo
    • [MNG-8507] mvnup: skip dedup inside plugin <configuration> elements (#12582) @gnodet
    • Fix BOM consumer POM leaving property references unresolved (#12627) @gnodet
    • Use resource filtering for mng-12534 IT plugin mavenVersion to avoid hardcoded versions (58cb473) @gnodet
    • [MNG-8425] Fix mvnenc init saving invalid master source configuration (#12564) @gnodet
    • Consumer POM of multi-module project should exclude and elements (#11764) @desruisseaux
    • Fix #12045: fix mvnup plugin upgrade strategy for inherited plugins from remote parent POMs (#12054) @gnodet
    • Backport #12538: Handle Ctrl+C on Windows terminals (#12550) @gnodet
    • [Backport 4.0.x] Fix #12531: filter NO_REPOSITORY sentinel from mapped exceptions in ArtifactResolverResult (#12561) @gnodet
    • [Backport 4.0.x] Fix #12534: Wire up @after annotation processing in Maven core (#12566) @gnodet
    • [Backport 4.0.x] Fix #12427: Reject path-traversal segments in coordinate ids and versions (#12565) @gnodet
    • [Backport 4.0.x] [MNG-11147] - Fix BOM version inference for sibling modules in dependencyManagement (#12569) @gnodet
    • Backport #12523 to 4.0.x: preserve unresolved ${...} in CLI -D values (#12524) @ascheman
    • [Backport 4.0.x] Avoid IllegalStateException on duplicate profile ids in DefaultModelBuilder (#12506) @ascheman
    • Backport #12446: Fix deadlock in AbstractRequestCache (#12468) @gnodet
    • Fix #12464: Skip MAVEN_ARGS for non-default main classes (backport to 4.0.x) (#12466) @gnodet
    • Bugfix: use GAV and not GAPV in source labels for profiles (#12406) (#12424) @cstamas
    • [#11449] Fix Mockito agent: use late binding @{} interpolation (backport to 4.0.x) (#12415) @gnodet
    • Make LookupContext#closeables thread safe (backport to 4.0.x) (#12414) @gnodet
    • [#11683] Install JUL-to-SLF4J bridge to route java.util.logging through Maven logging (#12345) @gnodet
    • [#12303] Fix CI-friendly ${revision} not interpolated for non-build POM reads (#12322) @gnodet
    • [4.0.x] Fix mvn.cmd jvm.config read failing silently on Windows CI (#12379) @gnodet
    • [Backport 4.0.x] Fix mvnup spurious pluginManagement injection for remote parent plugins (#12351) @gnodet
    • [MNG-8650] - Fix MAVEN_ARGS backslash stripping on Windows (#12349) @gnodet
    • Port #11908: Do not force metadata download for plugin prefix resolution (#11905) (#12343) @gnodet
    • [Backport 4.0.x] Fix NPE in DefaultLookup.lookupOptional() when container returns null (#12340) @gnodet
    • [#12301] Use stack-passed Set for activeModelReads cycle detection (#12325) @gnodet
    • [Backport 4.0.x] Sync DefaultTypeProvider and dependency-types docs across impl and compat (#12326) @gnodet
    • [#12301] Fix StackOverflowError with internal parent and CI-friendly revision (#12314) @gnodet
    • [Backport 4.0.x] [#12288] Add -P !profile deactivation regression guard (#12298) (#12315) @gnodet
    • [maven-4.0.x] Fix #12305: filter uninterpolated deps in ArtifactDescriptorReaderDelegate (#12309) @gnodet
    • [maven-4.0.x] Fix #12304: replace deprecated property expressions in mvnup (#12308) @gnodet
    • [maven-4.0.x] Fix #12306: normalize targetPath in DefaultSourceRoot (#12307) @gnodet
    • [Backport 4.0.x] [#12288] Pass settings.xml profile properties to LRM (#12299) @gnodet
    • Fix thread-safety in DefaultModelValidator (backport to 4.0.x) (#12284) @gnodet
    • Fix MojoExtension.beforeEach to use merged model instead of raw parsed model (backport to 4.0.x) (#12287) @gnodet
    • Fix BUILD_CONSUMER profile activation for locally-resolved parent POMs (backport to 4.0.x) (#12286) @gnodet
    • Fix NPE in DefaultModelBuilder when POM resolved from repository (backport to 4.0.x) (#12285) @gnodet
    • Backport #12053: Tokenize arithmetic operators as delimiters in ConditionParser (#12275) @gnodet
    • Backport #12117: Support sealed parameter implementation hints (#12258) @gnodet
    • Backport #12038: Fix ConditionParser to handle newlines before && operator (#12259) @gnodet
    • Backport #12146: Handle missing package metadata in model ids (#12257) @gnodet
    • Backport #11742: Fix #11715: preserve 4.1.0 namespace/schema in help:effective-pom (#12255) @gnodet
    • Backport #12237: Add XmlService classloader fallback for ServiceLoader discovery (#12254) @gnodet
    • Avoid reflective InputSource modelId mutation (#12147) @Will-thom
    • Fix MavenITConsumerPomBomFromSettingsRepoTest missing super constructor call (#12253) @gnodet
    • fix reportSet inheritance in Maven 4 model building (#12245) @hboutemy
    • [4.0.x] [GH-11772] - Fail-fast consumer POM validation for non-4.0.0 model versions (#12236) @gnodet
    • [4.0.x] Fix Source.targetPath incorrectly aligned to basedir (#12235) @gnodet
    • [4.0.x] Fix #11856: Improve error message for prefix-based remote repository filtering errors (#12234) @gnodet
    • [4.0.x] Fix #11796: Preserve default-phases bindings for standard lifecycle phases (#12233) @gnodet
    • [4.0.x] Fix @PreDestroy ClassNotFoundException from premature ClassRealm disposal (#12232) @gnodet
    • [4.0.x] [MNG-6772] - Re-enable integration test for nested import scope repository override (#12231) @gnodet
    • Fix deadlocks in request cache (unstable hashCode, re-entrant self-deadlock, mutable properties) (#12166) @gnodet
    • [maven-4.0.x] Backport bug fixes from #11741 and #11733 (#12144) @gnodet
    • [backport maven-4.0.x] Fix logging setup/teardown order (#12137) @gnodet
    • Fix domtrip API breakage after 1.5.1 upgrade (#12138) @gnodet
    • Update binary distribution LICENSE with complete Apache License 2.0 text (#12116) @slawekjaranowski
    • Fix #11899: Default addLocationInformation to false in Settings and Toolchains XML writers (#12123) @gnodet
    • [maven-4.0.x] Fix mvn script expanding ${...} in CLI arguments (#12095) @gnodet
    • [maven-4.0.x] Fix consumer POM serialization of prefixed XML attributes (fixes #11760) (#12110) @gnodet
    • Fix #11885: Disable ANSI colors when stdout is piped on JDK 22+ (backport) (#12111) @gnodet
    • [maven-4.0.x] Fix #12085: regression tests for version inheritance from remote parent (#12101) @gnodet
    • Fix #12074: prevent false parent cycle with shade plugin's dependency-reduced-pom.xml (#12079) @gnodet
    • Fix #12075: skip expression validation for distributionManagement repository IDs (#12076) (#12077) @gnodet
    • [maven-4.0.x] fix: restore buildConfiguration() callback in deprecated build() methods (#12094) @gnodet
    • [maven-4.0.x] fix: propagate addResource() to model Build for Maven 3 compat (#12093) @gnodet
    • [maven-4.0.x] Filter transitive repositories with uninterpolated IDs (#12049) (#12070) @gnodet
    • Downgrade plexus-classworlds from 2.11.0 to 2.9.0 (#12092) @gnodet
    • [maven-4.0.x] Fix #11920: skip expression validation for profile repository URLs (#12055) @gnodet
    • Mvn4: Remove extracted Mac OS JLine binaries from Maven distro (#11997) @kwin
    • Fixes issue #11827 - Maven DI crashes if the file org.apache.maven.api.di.Inject contains empty lines (#11830) @slawekjaranowski
    • Backport the simplification and fixes of PathSelector (#11565) @desruisseaux
    • [maven-4.0.x] Fix special characters in .mvn/jvm.config (fix #11363, #11485 and #11486) (#11365) (#11537) @gnodet
    • Improve DefaultModelProcessor error reporting for alternative parsers (#11529) @gnodet
    • Allow ${project.basedir} in profile activation.condition (#11528) @gnodet
    • [maven-4.0.x] Fix profile source tracking in multi-module projects (fixes #11409) (#11440) (#11466) @gnodet
    • [maven-4.0.x] Fix BOM packaging in consumer POMs (#11427) (#11464) @gnodet
    • [maven-4.0.x] Fix field accessibility leak in EnhancedCompositeBeanHelper (#11425) (#11433) @gnodet
    • Fix a ConcurrentModificationException (#11429) @desruisseaux

    📝 Documentation updates

    • [Backport 4.0.x] Fix Javadoc about default value of consumer POM flattening (#12562) @gnodet
    • [Backport 4.0.x] [ISSUE-10329] - Document behaviour of UrlNormalizer (#12296) @gnodet
    • Add deprecation Javadoc to XmlNode constants and methods (backport #11576) (#12295) @gnodet
    • [Backport 4.0.x] Update lifecycles reference to point to LifecycleRegistry (#12292) @gnodet
    • [Backport 4.0.x] Document deprecation rationale for Artifact version constants (#12290) @gnodet
    • fix doc cross references (#12273) @hboutemy
    • document modelVersion supported values (#11810) @hboutemy
    • [maven-4.0.x] improve align in dependency graph (#12015)

    Note truncated.

    Open source →
  2. 4.0.0-rc-57 Nov 2025pre-release
    Release notes

    Notes

    This new release candidate of Maven 4 is released to get feedback from users.
    Maven 4 has a restrained a few things comparent to Maven 3, so make sure to run the mvnup tool before trying to project with Maven 4.

    Bean configuration bug

    A bug has been found in the bean configuration system where field accessibility state is cached globally. This can cause plugin configuration injection to fail when the same configuration field is accessed multiple times or in different contexts during a build. This particularly affects the plugin unit tests.

    This will be fixed by #11433 in the next release.

    Concurrency issue in the v4 API

    A concurrency issue has been found in the Maven 4 API (still in preview mode) and will be fixed by #11428 in the next release.

    BOM packaging

    Another bug has been found in how BOM projects are processed. When a project uses BOM packaging, the consumer POM is not being properly converted to standard POM packaging, and dependency versions could be lost in some cases.

    This will be fixed by #11427 in the next release.

    macOS: JLine native library may be blocked by Gatekeeper on first use

    On macOS (especially Apple Silicon), the first invocation of mvn may fail to load the JLine native terminal library with an error such as:

    java.lang.UnsatisfiedLinkError: .../libjline-native/Mac/arm64/libjlinenative.jnilib: dlopen(...): code signature ... not valid for use in process: library load disallowed by system policy

    This occurs when the binary distribution is downloaded via a web browser, which applies the com.apple.quarantine extended attribute.

    Workaround (one-time fix):

    xattr -r -d com.apple.quarantine /path/to/apache-maven-4.0.0-rc-5/lib/jline-native

    Recommended download method (avoids the issue entirely):

    curl -L -O https://archive.apache.org/dist/maven/maven-4/4.0.0-rc-5/binaries/apache-maven-4.0.0-rc-5-bin.tar.gz
tar -xzf apache-maven-4.0.0-rc-5-bin.tar.gz

    This is a known issue #10747 and will be addressed in a future release.

    💥 Breaking changes

    • Disable consumer POM flattening by default and add an opt-in feature (#11347) (#11370) @gnodet

    🚀 New features and improvements

    🐛 Bug Fixes

    👻 Maintenance

    🔧 Build

    Note truncated.

    Open source →
  3. 4.0.0-rc-418 Jun 2025pre-release

    Nothing published for this version

  4. 4.0.0-rc-35 Mar 2025pre-release

    Nothing published for this version

  5. 4.0.0-rc-213 Dec 2024pre-release

    Nothing published for this version

  6. 4.0.0-rc-125 Nov 2024pre-release

    Nothing published for this version

  7. 4.0.0-beta-519 Oct 2024pre-release

    Nothing published for this version

  8. 4.0.0-beta-430 Aug 2024pre-release

    Nothing published for this version

  9. 4.0.0-beta-322 May 2024pre-release

    Nothing published for this version

  10. 4.0.0-alpha-136 Mar 2024pre-release

    Nothing published for this version

  11. 4.0.0-alpha-1212 Jan 2024pre-release

    Nothing published for this version

  12. 4.0.0-alpha-1018 Dec 2023pre-release

    Nothing published for this version

  13. 4.0.0-alpha-98 Dec 2023pre-release

    Nothing published for this version

  14. 4.0.0-alpha-820 Oct 2023pre-release

    Nothing published for this version

  15. 4.0.0-alpha-724 Jun 2023pre-release

    Nothing published for this version

  16. 4.0.0-alpha-515 Mar 2023pre-release

    Nothing published for this version

  17. 4.0.0-alpha-427 Jan 2023pre-release

    Nothing published for this version

  18. 4.0.0-alpha-312 Dec 2022pre-release

    Nothing published for this version

  19. 4.0.0-alpha-215 Oct 2022pre-release

    Nothing published for this version

  20. 3.10.0-rc-19 Jul 2026pre-release
    Release notes

    💥 Breaking changes

    🚀 New features and improvements

    🐛 Bug Fixes

    📝 Documentation updates

    👻 Maintenance

    📦 Dependency updates

    Open source →
  21. 3.9.1613 May 2026
    Release notes

    🐛 Bug Fixes

    📦 Dependency updates

    Open source →
  22. 3.9.1513 Apr 2026
    Release notes

    📝 Documentation updates

    📦 Dependency updates

    Open source →
  23. 3.9.149 Mar 2026
    Release notes

    🐛 Bug Fixes

    📦 Dependency updates

    Open source →
  24. 3.9.133 Mar 2026
    Release notes

    🐛 Bug Fixes

    • Bug: SecDispatcher is managed by legacy Plexus DI (#11711) @cstamas
    • [3.9.x] MavenPluginJavaPrerequisiteChecker: Handle 8/1.8 Java version in ranges as well (#11577) @cstamas

    👻 Maintenance

    📦 Dependency updates

    Open source →
  25. 3.9.1213 Dec 2025
    Release notes

    🚀 New features and improvements

    🐛 Bug Fixes

    📝 Documentation updates

    👻 Maintenance

    🔧 Build

    📦 Dependency updates

    Open source →
  26. 3.9.1112 Jul 2025

    Nothing published for this version

  27. 3.9.101 Jun 2025

    Nothing published for this version

  28. 3.9.914 Aug 2024

    Nothing published for this version

  29. 3.9.813 Jun 2024

    Nothing published for this version

  30. 3.9.722 May 2024

    Nothing published for this version

  31. 3.9.628 Nov 2023

    Nothing published for this version

  32. 3.9.52 Oct 2023

    Nothing published for this version

  33. 3.9.431 Jul 2023

    Nothing published for this version

  34. 3.9.323 Jun 2023

    Nothing published for this version

  35. 3.9.28 May 2023

    Nothing published for this version

  36. 3.9.115 Mar 2023

    Nothing published for this version

  37. 3.9.031 Jan 2023

    Nothing published for this version

  38. 3.8.914 Jun 2025

    Nothing published for this version

  39. 3.8.88 Mar 2023

    Nothing published for this version

  40. 3.8.724 Dec 2022

    Nothing published for this version

  41. 3.8.66 Jun 2022

    Nothing published for this version

  42. 3.8.55 Mar 2022

    Nothing published for this version

  43. 3.8.414 Nov 2021

    Nothing published for this version

  44. 3.8.327 Sept 2021

    Nothing published for this version

  45. 3.8.24 Aug 2021

    Nothing published for this version

  46. 3.8.130 Mar 2021

    Nothing published for this version

  47. 3.6.319 Nov 2019

    Nothing published for this version

  48. 3.6.227 Aug 2019

    Nothing published for this version

  49. 3.6.14 Apr 2019

    Nothing published for this version

  50. 3.6.024 Oct 2018

    Nothing published for this version

  51. 3.5.417 Jun 2018

    Nothing published for this version

  52. 3.5.324 Feb 2018

    Nothing published for this version

  53. 3.5.218 Oct 2017

    Nothing published for this version

  54. 3.5.03 Apr 2017

    Nothing published for this version

  55. 3.5.0-beta-120 Mar 2017pre-release

    Nothing published for this version

  56. 3.5.0-alpha-123 Feb 2017pre-release

    Nothing published for this version

  57. 3.3.910 Nov 2015

    Nothing published for this version

  58. 3.3.322 Apr 2015

    Nothing published for this version

  59. 3.3.113 Mar 2015

    Nothing published for this version

  60. 3.2.514 Dec 2014

    Nothing published for this version