Maven Central · #940 by repository stars

org.apache.maven:maven-model-builder

3.9.16apache/maven ↗New releases in your daily digest, changelog included.

The effective model builder, with inheritance, profile activation, interpolation, ...

Last release 1 months ago
05 Aug 2026
Ships fairly regularly
a new release about every 6 weeks
Rarely documented
notes for 5 of 49 stable releases
Nothing withdrawn
no release was ever pulled
17 years old
80 releases · first in 2009

Release timeline

80 releases since 2009

20092011201320152017

Releases

4.0.0-rc-65 Aug 2026pre-releaseDeprecated
[maven-4.0.x] Fix #12304 : replace deprecated property expressions in mvnup ( #12308 ) @gnodet
Notes

This new release candidate of Maven 4 is released to get feedback from users.
Maven 4 has restricted a few things compared to Maven 3, so make sure to run the mvnup tool before trying your project with Maven 4.

Issues fixed since RC-5

All known issues reported in the RC-5 release notes have been fixed:

Bean configuration bug — field accessibility state was cached globally, causing plugin configuration injection failures. Fixed in #11433.

Concurrency issue in the v4 API — a ConcurrentModificationException was fixed in #11429.

BOM packaging — consumer POM conversion for BOM projects now correctly preserves dependency versions. Fixed in #11464.

macOS Gatekeeper — the extracted JLine native binaries that triggered Gatekeeper have been removed from the distribution (#11997). The xattr workaround from RC-5 is no longer needed.

Known compatibility issues

The following are known compatibility issues when using Maven 4. Running
mvnup before building with
Maven 4 will fix many common plugin version issues automatically. The issues
below are those that require manual intervention or upstream fixes.

Stricter POM validation

Maven 4 enforces stricter validation than Maven 3. Projects may need to fix their POMs:

Duplicate XML elements — duplicate <artifactId>, <properties>, etc. are now rejected (Duplicated tag error). Fix the source POM.

Duplicate dependency declarations — same groupId:artifactId declared twice is now rejected (must be unique).

Uninterpolated expressions — ${...} expressions in repository URLs, distribution management IDs, and other fields that Maven 3 silently accepted are now rejected.

Invalid XML in transitive POMs — illegal processing instructions or undeclared namespace prefixes in transitive POMs cause Non-parseable POM errors.

Properties in <module> paths — Maven 4 no longer interpolates properties like ${spark.version} in <module> elements at POM reading time.

CI-friendly versions — projects using ${revision} without flatten-maven-plugin may hit missing dependency version errors.

Invalid Collect Request — transitive dependencies with uninterpolated ${...} version expressions are rejected.

Transitive dependency resolution changes

Maven 4's TransitiveDependencyManager applies dependencyManagement at all transitive depths (Maven 3 only applied it at the first level). This is intentional but can change resolved versions:

Dependencies previously on the classpath may disappear — add explicit declarations. See #12302.

maven-enforcer-plugin version rules may trigger due to downgraded transitive versions.

license-maven-plugin may report new transitive dependencies not in the allow-list.

Karaf feature verification may fail due to OSGi bundle version mismatches.

Plugin and extension compatibility

Some plugins and extensions require specific versions for Maven 4:

Quarkus — versions before 3.20 use ServiceLocator/RepositorySystem patterns incompatible with Maven 4's Sisu-based DI. Upgrade to Quarkus 3.20+.

Tycho — versions before 5.0 use Guice/Sisu injection patterns broken by Maven 4. Upgrade to Tycho 5.0.3+.

Develocity Maven extension — fails to initialize due to SLF4J classloading changes (ClassNotFoundException: SimpleLogger).

pgpverify-maven-plugin — versions before 1.20 hit a ClassCastException with Maven 4's resolver. See resolver#1957.

cyclonedx-maven-plugin — fails with Invalid Version Range Request when using ${revision} CI-friendly versions.

maven-site-plugin — Velocity template rendering may fail with incompatible site plugin versions.

maven-shade-plugin — dependency-reduced-pom.xml can cause The parents form a cycle error.

commons-release-plugin — clean-staging fails under Maven 4.

Classloading changes

Plugins relying on Maven 3's classrealm layout may encounter "foreign imports" errors (e.g., Quarkus, JAXB plugins).

Maven 4's prefix-based repository routing may block artifacts not matching /.meta/prefixes.txt.

Post-mvnup formatting

spotless-maven-plugin and sortpom-maven-plugin may report formatting violations after mvnup modifies POM files. Re-run the formatter after mvnup.

Other

Broken upstream POMs — e.g., hadoop-project 3.1.0–3.3.0 has invalid XML (<Xlint:-unchecked/>) causing parse errors. These need upstream fixes tracked in HADOOP-19923.

Enforcer POM element ordering — Maven 4's model builder reorders POM elements into a canonical order, which can break enforcer rules checking element ordering.

SNAPSHOT handling — SNAPSHOT artifacts may show as "present, but unavailable" under Maven 4's different resolver metadata handling.

🚀 New features and improvements

Backport the use of hardlink instead of file copy (#11564) @desruisseaux

Accept Java module names as attached artifactId even if they differ from the project's artifactId (#11573) @desruisseaux

Add module-aware resource handling for modular sources (#11700) @desruisseaux

[MNG-8507] - Reduce allocation pressure in model building pipeline (#12540) @gnodet

[Backport 4.0.x] Fix #12530: add mvnup upgrade strategies for Maven 4 known compatibility issues (#12560) @gnodet

Introduce validation control (#12548) @cstamas

Backport #12505: mvnup: widen exact Maven version pins to allow Maven 4 (#12508) @gnodet

[MNG-5913] - Allow defining aliases for existing server configurations in settings.xml (#12473) @slawekjaranowski

Backport #12454: mvnup upgrade strategies and compatibility improvements (#12467) @gnodet

In failed build limit reactor summary to only failed modules (#12469) @slawekjaranowski

[Backport 4.0.x] Add mvnup SourceStrategy for migrating to elements (#12357) @gnodet

[Backport 4.0.x][#12353] Add jaxb2-maven-plugin to mvnup plugin upgrade list (#12356) @gnodet

[Backport 4.0.x] Switch default resolver transport from JDK/methanol to Apache HttpClient (#12341) @gnodet

Feat: Pull out maven-executor into its own project (#12004) (#12186) @cstamas

[maven-4.0.x] Add maven-surefire-report-plugin to PluginUpgradeStrategy (#12114) @gnodet

[maven-4.0.x] Fix #12087: add surefire and failsafe plugins to PluginUpgradeStrategy (#12109) @gnodet

Backport: Maven Executor Fixes (#11987) @cstamas

Promote java version in JavaToolchain (#11971) @slawekjaranowski

Add time zone to Maven startup banner (#11781) @slawekjaranowski

Update formatting of prerequisites-requirements error to improve readability (#11525) @slawekjaranowski

🐛 Bug Fixes

Remove an optimization on PathSelector producing false negatives (#12623) @desruisseaux

Remove erroneous path normalization optimization + regression test (#12621) @gnodet

Fix #12583: Inverted file existence check in DefaultTransport.put() (#12619) @gnodet @elharo

[MNG-8507] mvnup: skip dedup inside plugin <configuration> elements (#12582) @gnodet

Fix BOM consumer POM leaving property references unresolved (#12627) @gnodet

Use resource filtering for mng-12534 IT plugin mavenVersion to avoid hardcoded versions (58cb473) @gnodet

[MNG-8425] Fix mvnenc init saving invalid master source configuration (#12564) @gnodet

Consumer POM of multi-module project should exclude and elements (#11764) @desruisseaux

Fix #12045: fix mvnup plugin upgrade strategy for inherited plugins from remote parent POMs (#12054) @gnodet

Backport #12538: Handle Ctrl+C on Windows terminals (#12550) @gnodet

[Backport 4.0.x] Fix #12531: filter NO_REPOSITORY sentinel from mapped exceptions in ArtifactResolverResult (#12561) @gnodet

[Backport 4.0.x] Fix #12534: Wire up @after annotation processing in Maven core (#12566) @gnodet

[Backport 4.0.x] Fix #12427: Reject path-traversal segments in coordinate ids and versions (#12565) @gnodet

[Backport 4.0.x] [MNG-11147] - Fix BOM version inference for sibling modules in dependencyManagement (#12569) @gnodet

Backport #12523 to 4.0.x: preserve unresolved ${...} in CLI -D values (#12524) @ascheman

[Backport 4.0.x] Avoid IllegalStateException on duplicate profile ids in DefaultModelBuilder (#12506) @ascheman

Backport #12446: Fix deadlock in AbstractRequestCache (#12468) @gnodet

Fix #12464: Skip MAVEN_ARGS for non-default main classes (backport to 4.0.x) (#12466) @gnodet

Bugfix: use GAV and not GAPV in source labels for profiles (#12406) (#12424) @cstamas

[#11449] Fix Mockito agent: use late binding @{} interpolation (backport to 4.0.x) (#12415) @gnodet

Make LookupContext#closeables thread safe (backport to 4.0.x) (#12414) @gnodet

[#11683] Install JUL-to-SLF4J bridge to route java.util.logging through Maven logging (#12345) @gnodet

[#12303] Fix CI-friendly ${revision} not interpolated for non-build POM reads (#12322) @gnodet

[4.0.x] Fix mvn.cmd jvm.config read failing silently on Windows CI (#12379) @gnodet

[Backport 4.0.x] Fix mvnup spurious pluginManagement injection for remote parent plugins (#12351) @gnodet

[MNG-8650] - Fix MAVEN_ARGS backslash stripping on Windows (#12349) @gnodet

Port #11908: Do not force metadata download for plugin prefix resolution (#11905) (#12343) @gnodet

[Backport 4.0.x] Fix NPE in DefaultLookup.lookupOptional() when container returns null (#12340) @gnodet

[#12301] Use stack-passed Set for activeModelReads cycle detection (#12325) @gnodet

[Backport 4.0.x] Sync DefaultTypeProvider and dependency-types docs across impl and compat (#12326) @gnodet

[#12301] Fix StackOverflowError with internal parent and CI-friendly revision (#12314) @gnodet

[Backport 4.0.x] [#12288] Add -P !profile deactivation regression guard (#12298) (#12315) @gnodet

[maven-4.0.x] Fix #12305: filter uninterpolated deps in ArtifactDescriptorReaderDelegate (#12309) @gnodet

[maven-4.0.x] Fix #12304: replace deprecated property expressions in mvnup (#12308) @gnodet

[maven-4.0.x] Fix #12306: normalize targetPath in DefaultSourceRoot (#12307) @gnodet

[Backport 4.0.x] [#12288] Pass settings.xml profile properties to LRM (#12299) @gnodet

Fix thread-safety in DefaultModelValidator (backport to 4.0.x) (#12284) @gnodet

Fix MojoExtension.beforeEach to use merged model instead of raw parsed model (backport to 4.0.x) (#12287) @gnodet

Fix BUILD_CONSUMER profile activation for locally-resolved parent POMs (backport to 4.0.x) (#12286) @gnodet

Fix NPE in DefaultModelBuilder when POM resolved from repository (backport to 4.0.x) (#12285) @gnodet

Backport #12053: Tokenize arithmetic operators as delimiters in ConditionParser (#12275) @gnodet

Backport #12117: Support sealed parameter implementation hints (#12258) @gnodet

Backport #12038: Fix ConditionParser to handle newlines before && operator (#12259) @gnodet

Backport #12146: Handle missing package metadata in model ids (#12257) @gnodet

Backport #11742: Fix #11715: preserve 4.1.0 namespace/schema in help:effective-pom (#12255) @gnodet

Backport #12237: Add XmlService classloader fallback for ServiceLoader discovery (#12254) @gnodet

Avoid reflective InputSource modelId mutation (#12147) @Will-thom

Fix MavenITConsumerPomBomFromSettingsRepoTest missing super constructor call (#12253) @gnodet

fix reportSet inheritance in Maven 4 model building (#12245) @hboutemy

[4.0.x] [GH-11772] - Fail-fast consumer POM validation for non-4.0.0 model versions (#12236) @gnodet

[4.0.x] Fix Source.targetPath incorrectly aligned to basedir (#12235) @gnodet

[4.0.x] Fix #11856: Improve error message for prefix-based remote repository filtering errors (#12234) @gnodet

[4.0.x] Fix #11796: Preserve default-phases bindings for standard lifecycle phases (#12233) @gnodet

[4.0.x] Fix @PreDestroy ClassNotFoundException from premature ClassRealm disposal (#12232) @gnodet

[4.0.x] [MNG-6772] - Re-enable integration test for nested import scope repository override (#12231) @gnodet

Fix deadlocks in request cache (unstable hashCode, re-entrant self-deadlock, mutable properties) (#12166) @gnodet

[maven-4.0.x] Backport bug fixes from #11741 and #11733 (#12144) @gnodet

[backport maven-4.0.x] Fix logging setup/teardown order (#12137) @gnodet

Fix domtrip API breakage after 1.5.1 upgrade (#12138) @gnodet

Update binary distribution LICENSE with complete Apache License 2.0 text (#12116) @slawekjaranowski

Fix #11899: Default addLocationInformation to false in Settings and Toolchains XML writers (#12123) @gnodet

[maven-4.0.x] Fix mvn script expanding ${...} in CLI arguments (#12095) @gnodet

[maven-4.0.x] Fix consumer POM serialization of prefixed XML attributes (fixes #11760) (#12110) @gnodet

Fix #11885: Disable ANSI colors when stdout is piped on JDK 22+ (backport) (#12111) @gnodet

[maven-4.0.x] Fix #12085: regression tests for version inheritance from remote parent (#12101) @gnodet

Fix #12074: prevent false parent cycle with shade plugin's dependency-reduced-pom.xml (#12079) @gnodet

Fix #12075: skip expression validation for distributionManagement repository IDs (#12076) (#12077) @gnodet

[maven-4.0.x] fix: restore buildConfiguration() callback in deprecated build() methods (#12094) @gnodet

[maven-4.0.x] fix: propagate addResource() to model Build for Maven 3 compat (#12093) @gnodet

[maven-4.0.x] Filter transitive repositories with uninterpolated IDs (#12049) (#12070) @gnodet

Downgrade plexus-classworlds from 2.11.0 to 2.9.0 (#12092) @gnodet

[maven-4.0.x] Fix #11920: skip expression validation for profile repository URLs (#12055) @gnodet

Mvn4: Remove extracted Mac OS JLine binaries from Maven distro (#11997) @kwin

Fixes issue #11827 - Maven DI crashes if the file org.apache.maven.api.di.Inject contains empty lines (#11830) @slawekjaranowski

Backport the simplification and fixes of PathSelector (#11565) @desruisseaux

[maven-4.0.x] Fix special characters in .mvn/jvm.config (fix #11363, #11485 and #11486) (#11365) (#11537) @gnodet

Improve DefaultModelProcessor error reporting for alternative parsers (#11529) @gnodet

Allow ${project.basedir} in profile activation.condition (#11528) @gnodet

[maven-4.0.x] Fix profile source tracking in multi-module projects (fixes #11409) (#11440) (#11466) @gnodet

[maven-4.0.x] Fix BOM packaging in consumer POMs (#11427) (#11464) @gnodet

[maven-4.0.x] Fix field accessibility leak in EnhancedCompositeBeanHelper (#11425) (#11433) @gnodet

Fix a ConcurrentModificationException (#11429) @desruisseaux

📝 Documentation updates

[Backport 4.0.x] Fix Javadoc about default value of consumer POM flattening (#12562) @gnodet

[Backport 4.0.x] [ISSUE-10329] - Document behaviour of UrlNormalizer (#12296) @gnodet

Add deprecation Javadoc to XmlNode constants and methods (backport #11576) (#12295) @gnodet

[Backport 4.0.x] Update lifecycles reference to point to LifecycleRegistry (#12292) @gnodet

[Backport 4.0.x] Document deprecation rationale for Artifact version constants (#12290) @gnodet

fix doc cross references (#12273) @hboutemy

document modelVersion supported values (#11810) @hboutemy

[maven-4.0.x] improve align in dependency graph (#12015)
Note truncated.

From the same repository

apache/maven

One column per quarter.

4.0.0-rc-57 Nov 2025pre-release

Nothing published for this version

4.0.0-rc-418 Jun 2025pre-release

Nothing published for this version

4.0.0-rc-35 Mar 2025pre-release

Nothing published for this version

4.0.0-rc-213 Dec 2024pre-release

Nothing published for this version

4.0.0-rc-125 Nov 2024pre-release

Nothing published for this version

4.0.0-beta-519 Oct 2024pre-release

Nothing published for this version

4.0.0-beta-430 Aug 2024pre-release

Nothing published for this version

4.0.0-beta-322 May 2024pre-release

Nothing published for this version

4.0.0-alpha-136 Mar 2024pre-release

Nothing published for this version

4.0.0-alpha-1212 Jan 2024pre-release

Nothing published for this version

4.0.0-alpha-1018 Dec 2023pre-release

Nothing published for this version

4.0.0-alpha-98 Dec 2023pre-release

Nothing published for this version

4.0.0-alpha-820 Oct 2023pre-release

Nothing published for this version

4.0.0-alpha-724 Jun 2023pre-release

Nothing published for this version

4.0.0-alpha-515 Mar 2023pre-release

Nothing published for this version

4.0.0-alpha-427 Jan 2023pre-release

Nothing published for this version

4.0.0-alpha-312 Dec 2022pre-release

Nothing published for this version

4.0.0-alpha-215 Oct 2022pre-release

Nothing published for this version

3.10.0-rc-19 Jul 2026pre-releaseDeprecated

Remove deprecated plugin management from super POM ( #11986 ) @slawekjaranowski

💥 Breaking changes

Remove release-profile from super POM (#11999) @slawekjaranowski
Remove deprecated plugin management from super POM (#11986) @slawekjaranowski

🚀 New features and improvements

Feat: Align Maven 3.10.x and 4.0.x (#12442) @cstamas
Feat: Align CP ordering with Maven 4 (#12327) @cstamas
Feat: Apply latest Resolver 2.0.19 changes (#12246) @cstamas
Feat: Maven 3.10.x super POM (#12032) @cstamas
In failed build limit reactor summary to only failed modules (#11977) @slawekjaranowski
Add time zone to Maven startup banner (#11972) @slawekjaranowski
Feat: Version range filters plus (#11955) @cstamas
Feat: Ability to disable site lifecycle (#11970) @cstamas
Optimize log level rendering in MavenSimpleLogger (#11969) @slawekjaranowski
Feat: Resolver 2.x update policy control via CLI (#11948) @cstamas
Promote java version in JavaToolchain (#11968) @slawekjaranowski
Feat: Transitive dep manager (#11939) @cstamas
3.10.x Upgrade slf4j to 2.0.17 (#11880) @olamy
Do not force md download always (#11908) @cstamas
Feat: user relocations backport (#11937) @cstamas
Feat: Version range filtering (#11936) @cstamas
Promote project.rootDirectory for interpolation and profile activation (#11930) @slawekjaranowski
Feat: new artifact handler: fatjar (#11928) @cstamas
Feat: migrate core to JSR330 (#11916) @cstamas
Migrate from JAnsi to JLine, introduce MessageBuilderFactory (#11874) @slawekjaranowski
Feat: Promote session.topDirectory and session.rootDirectory (#11779) @cstamas
Feat: Maven 3.x with Resolver 2.x (#11778) @cstamas
Feat: Generalize Maven 3.x extension handling (#11777) @cstamas

🐛 Bug Fixes

[#12288] Backport: settings.xml activeByDefault profile props to LRM (#12333) @ascheman
Fix illegal reflective access warning on JDK 11 (fixes #12167) (#12339) @gnodet
Issue #12188 redirection of log output to a file does not redirect everything (#12189) @olamy
Update binary distribution LICENSE with complete Apache License 2.0 text (#12063) @slawekjaranowski
Bug: RSS was seeded but not exposed (#12033) @cstamas
Export scope package from resolver-api 2.x (#12023) @slawekjaranowski
Ensure MavenProject#getPluginManagement never returns null (#12010) @slawekjaranowski
Remove redundant required attributes from Settings model (#12005) @slawekjaranowski
Remove redundant required attributes from Maven model (#11985) @slawekjaranowski
Bug: Settings interpolation and strict parsing (#11776) @cstamas
Trim threadConfiguration to accept input surrounded with spaces (#11851) @pzygielo

📝 Documentation updates

Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (#12444) @potiuk
document default plugin versions (#12382) @hboutemy
Maven 3.10.x site (#12370) @cstamas
[[ISSUE-10329] - ](https://issues.apache.org/jira/browse/ISSUE-10329) - Document behaviour of UrlNormalizer (backport) (#12294) @gnodet
Update Maven deps diagram for maven-jline (#12068) @Will-thom
document the only supported value: 4.0.0 (#11859) @slawekjaranowski

👻 Maintenance

push-to-atr profile for source+binaries in apache-maven subproject (#12450) @hboutemy
Add AGENTS.md + SECURITY.md security-model pointer for scanner discoverability (#12444) @potiuk
Remove deprecated methods use (#12328) @cstamas
Make def session builder have interface (#11967) @cstamas
Feat: Add Automatic Module Names to Maven JAR Manifests (#11921) @cstamas
Configure CI for 3.10.x branch (#11834) @slawekjaranowski

📦 Dependency updates

Bump resolverVersion from 2.0.20-SNAPSHOT to 2.0.20 (#12426) @dependabot[bot]
Bump jlineVersion from 3.30.14 to 3.30.15 (#12409) @dependabot[bot]
Bump jlineVersion from 3.30.13 to 3.30.14 (#12400) @dependabot[bot]
Bump org.apache.maven:maven-parent from 48 to 49 (#12399) @dependabot[bot]
Bump actions/cache from 5.0.5 to 6.1.0 (#12362) @dependabot[bot]
Bump actions/setup-java from 5.3.0 to 5.4.0 (#12374) @dependabot[bot]
Bump version.sisu-maven-plugin from 1.0.0 to 1.0.1 (#12366) @dependabot[bot]
Bump actions/checkout from 6.0.3 to 7.0.0 (#12321) @dependabot[bot]
Bump actions/setup-java from 5.2.0 to 5.3.0 (#12283) @dependabot[bot]
Bump xmlunitVersion from 2.11.0 to 2.12.0 (#12198) @dependabot[bot]
Bump actions/checkout from 6.0.2 to 6.0.3 (#12212) @dependabot[bot]
Bump org.ow2.asm:asm from 9.10 to 9.10.1 (#12153) @dependabot[bot]
Bump org.codehaus.plexus:plexus-classworlds from 2.11.0 to 2.12.0 (#12127) @dependabot[bot]
Bump org.ow2.asm:asm from 9.9.1 to 9.10 (#12060) @dependabot[bot]
Deps: Resolver 2.0.18 and drop unused stuff (#12036) @cstamas
Bump resolverVersion from 2.0.17 to 2.0.18 (#12104) @dependabot[bot]
Deps: Bump Slf4j to 2.0.18 (#12048) @cstamas
Bump org.codehaus.plexus:plexus-classworlds from 2.9.0 to 2.11.0 (#12041) @dependabot[bot]
[3.10.x] Bump to parent POM 48 (#12025) @cstamas
Bump jlineVersion from 3.30.12 to 3.30.13 (#12013) @dependabot[bot]
Bump jlineVersion from 3.30.11 to 3.30.12 (#12003) @dependabot[bot]
Bump resolverVersion from 2.0.17-SNAPSHOT to 2.0.17 (#12008) @dependabot[bot]
Bump jlineVersion from 3.30.9 to 3.30.11 (#11996) @dependabot[bot]
Bump commons-io:commons-io from 2.21.0 to 2.22.0 (#11982) @dependabot[bot]
Bump com.google.guava:guava from 33.5.0-jre to 33.6.0-jre (#11964) @dependabot[bot]
Bump org.codehaus.modello:modello-maven-plugin from 2.6.0 to 2.7.0 (#11935) @dependabot[bot]
Bump actions/cache from 5.0.4 to 5.0.5 (#11946) @dependabot[bot]
Bump actions/upload-artifact from 7.0.0 to 7.0.1 (#11934) @dependabot[bot]
Update Resolver to 2.0.16 (#11907) @cstamas
Bump org.codehaus.plexus:plexus-utils from 3.6.0 to 3.6.1 (#11878) @dependabot[bot]
Bump org.fusesource.jansi:jansi from 2.4.2 to 2.4.3 (#11867) @dependabot[bot]
Bump actions/download-artifact from 8.0.0 to 8.0.1 (#11837) @dependabot[bot]
Bump actions/cache from 5.0.3 to 5.0.4 (#11839) @dependabot[bot]

Open source →

3.9.1613 May 2026

Trim threadConfiguration to accept input surrounded with spaces ( #12042 ) @slawekjaranowski

🐛 Bug Fixes

Trim threadConfiguration to accept input surrounded with spaces (#12042) @slawekjaranowski
Backport: Maven 3.10.x fixed plugin resolution (#12022) @cstamas

📦 Dependency updates

Bump org.codehaus.plexus:plexus-classworlds from 2.9.0 to 2.11.0 (#12039) @dependabot[bot]
[3.9.x] Bump to parent POM 48 (#12024) @cstamas
Bump commons-io:commons-io from 2.21.0 to 2.22.0 (#11980) @dependabot[bot]
Bump com.google.guava:guava from 33.5.0-jre to 33.6.0-jre (#11951) @dependabot[bot]
Bump actions/cache from 5.0.4 to 5.0.5 (#11943) @dependabot[bot]

Open source →

3.9.1513 Apr 2026

Use new Maven logos in documentation ( #11938 ) @slawekjaranowski

📝 Documentation updates

Use new Maven logos in documentation (#11938) @slawekjaranowski
document modelVersion only supported value: 4.0.0 (#11809) @hboutemy

📦 Dependency updates

Bump actions/upload-artifact from 7.0.0 to 7.0.1 (#11932) @dependabot[bot]
Bump org.codehaus.plexus:plexus-utils from 3.6.0 to 3.6.1 (#11876) @dependabot[bot]
Bump org.fusesource.jansi:jansi from 2.4.2 to 2.4.3 (#11865) @dependabot[bot]
Bump actions/cache from 5.0.3 to 5.0.4 (#11813) @dependabot[bot]
Bump actions/download-artifact from 8.0.0 to 8.0.1 (#11790) @dependabot[bot]

Open source →

3.9.149 Mar 2026

plexus-testing dependencies should be use in test scope ( #11761 ) @slawekjaranowski

🐛 Bug Fixes

plexus-testing dependencies should be use in test scope (#11761) @slawekjaranowski

📦 Dependency updates

Bump actions/upload-artifact from 6.0.0 to 7.0.0 (#11747) @dependabot[bot]
Bump actions/download-artifact from 7.0.0 to 8.0.0 (#11748) @dependabot[bot]

Open source →

3.9.133 Mar 2026

Bug: SecDispatcher is managed by legacy Plexus DI ( #11711 ) @cstamas

🐛 Bug Fixes

Bug: SecDispatcher is managed by legacy Plexus DI (#11711) @cstamas
[3.9.x] MavenPluginJavaPrerequisiteChecker: Handle 8/1.8 Java version in ranges as well (#11577) @cstamas

👻 Maintenance

Update Maven plugin versions in default-bindings.xml (#11721) @slachiewicz
Migrate to JUnit 5 - avoid using TestCase (#11547) @slawekjaranowski

📦 Dependency updates

Maven Resolver 1.9.27 (#11732) @cstamas
Bump resolverVersion from 1.9.25 to 1.9.26 (#11725) @dependabot[bot]
Update Maven plugin versions in default-bindings.xml (#11721) @slachiewicz
Bump version.sisu-maven-plugin from 0.9.0.M4 to 1.0.0 (#11706) @dependabot[bot]
Bump actions/cache from 5.0.2 to 5.0.3 (#11688) @dependabot[bot]
Bump org.apache.maven:maven-parent from 45 to 47 (#11647) @dependabot[bot]
Bump actions/checkout from 6.0.1 to 6.0.2 (#11666) @dependabot[bot]
Bump actions/setup-java from 5.1.0 to 5.2.0 (#11667) @dependabot[bot]
Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.26 to 1.27 (#11658) @dependabot[bot]
Bump org.codehaus.mojo:buildnumber-maven-plugin from 3.2.1 to 3.3.0 (#11657) @dependabot[bot]
Bump actions/cache from 5.0.1 to 5.0.2 (#11659) @dependabot[bot]
Bump org.codehaus.plexus:plexus-testing from 2.0.2 to 2.1.0 (#11620) @dependabot[bot]
Bump org.ow2.asm:asm from 9.9 to 9.9.1 (#11585) @slachiewicz
Bump actions/upload-artifact from 5.0.0 to 6.0.0 (#11557) @dependabot[bot]
Bump actions/download-artifact from 6.0.0 to 7.0.0 (#11556) @dependabot[bot]
Bump actions/cache from 5.0.0 to 5.0.1 (#11558) @dependabot[bot]

Open source →

3.9.1213 Dec 2025Deprecated

Use MavenRepositorySystem in ProjectBuildingHelper instead of deprecated RepositorySystem ( #11358 ) @slawekjaranowski

🚀 New features and improvements

[3.9.x] Apply resolver changes and improvements (#11536) @cstamas
Update formatting of prerequisites-requirements error to improve readability (#11523) @slawekjaranowski
Allow a Maven plugin to require a Java version (#11479) @slawekjaranowski
Use MavenRepositorySystem in ProjectBuildingHelper instead of deprecated RepositorySystem (#11358) @slawekjaranowski
Make maven.config use UTF8 (#11264) @cstamas
Simplify prefix resolution (#11197) @slawekjaranowski

🐛 Bug Fixes

Add default implementation for new method in MavenPluginManager (#11522) @slawekjaranowski
Repository layout should be used in MavenRepositorySystem (#11495) @slawekjaranowski
Fix plugin prefix resolution when metadata is not available from repository (#11290) @slawekjaranowski
Improve source root modification warning message (#11105) @gnodet
Bug: bad cache isolation between two sessions (#11082) @cstamas
Set Guice class loading to CHILD - avoid using terminally deprecated methods (#11003) @slawekjaranowski
Avoid parsing MAVEN_OPTS (3.9.x) (#10969) @BobVul

📝 Documentation updates

clarify repository vs deployment repository (#11492) @hboutemy
add maintained branches (#11448) @hboutemy

👻 Maintenance

Add IntelliJ icon (#11408) @Bukama
Build by JDK 25 (#11187) @slawekjaranowski
Deprecate org.apache.maven.repository.RepositorySystem in 3.9.x (#11096) @slawekjaranowski

🔧 Build

Bump actions/download-artifact from 5.0.0 to 6.0.0 (#11335) @dependabot[bot]
Bump actions/upload-artifact from 4.6.2 to 5.0.0 (#11336) @dependabot[bot]

📦 Dependency updates

Bump actions/cache from 4.3.0 to 5.0.0 (#11542) @dependabot[bot]
Bump resolverVersion from 1.9.24 to 1.9.25 (#11533) @dependabot[bot]
Bump actions/checkout from 6.0.0 to 6.0.1 (#11512) @dependabot[bot]
Bump actions/setup-java from 5.0.0 to 5.1.0 (#11519) @dependabot[bot]
Bump actions/checkout from 5.0.1 to 6.0.0 (#11476) @dependabot[bot]
Bump actions/checkout from 5.0.0 to 5.0.1 (#11458) @dependabot[bot]
Bump commons-cli:commons-cli from 1.10.0 to 1.11.0 (#11438) @dependabot[bot]
Bump org.codehaus.plexus:plexus-interpolation from 1.28 to 1.29 (#11416) @dependabot[bot]
Bump commons-io:commons-io from 2.20.0 to 2.21.0 (#11417) @dependabot[bot]
Bump xmlunitVersion from 2.10.4 to 2.11.0 (#11331) @dependabot[bot]
Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.24 to 1.26 (#11231) @dependabot[bot]
Bump org.ow2.asm:asm from 9.8 to 9.9 (#11203) @dependabot[bot]
Bump actions/cache from 4.2.4 to 4.3.0 (#11172) @dependabot[bot]
Bump com.google.guava:guava from 33.4.8-jre to 33.5.0-jre (#11143) @dependabot[bot]
Bump xmlunitVersion from 2.10.3 to 2.10.4 (#11121) @dependabot[bot]
Bump actions/cache from 4.2.3 to 4.2.4 (#11032) @dependabot[bot]
Bump commons-cli:commons-cli from 1.9.0 to 1.10.0 (#11018) @dependabot[bot]
Bump commons-io:commons-io from 2.19.0 to 2.20.0 (#10966) @dependabot[bot]

Open source →

3.9.1112 Jul 2025

Nothing published for this version

3.9.101 Jun 2025

Nothing published for this version

3.9.914 Aug 2024

Nothing published for this version

3.9.813 Jun 2024

Nothing published for this version

3.9.722 May 2024

Nothing published for this version

3.9.628 Nov 2023

Nothing published for this version

3.9.52 Oct 2023

Nothing published for this version

3.9.431 Jul 2023

Nothing published for this version

3.9.323 Jun 2023

Nothing published for this version

3.9.28 May 2023

Nothing published for this version

3.9.115 Mar 2023

Nothing published for this version

3.9.031 Jan 2023

Nothing published for this version

3.8.914 Jun 2025

Nothing published for this version

3.8.88 Mar 2023

Nothing published for this version

3.8.724 Dec 2022

Nothing published for this version

3.8.66 Jun 2022

Nothing published for this version

3.8.55 Mar 2022

Nothing published for this version

3.8.414 Nov 2021

Nothing published for this version

3.8.327 Sept 2021

Nothing published for this version

3.8.24 Aug 2021

Nothing published for this version

3.8.130 Mar 2021

Nothing published for this version

3.6.319 Nov 2019

Nothing published for this version

3.6.227 Aug 2019

Nothing published for this version

3.6.14 Apr 2019

Nothing published for this version

3.6.024 Oct 2018

Nothing published for this version

3.5.417 Jun 2018

Nothing published for this version

3.5.324 Feb 2018

Nothing published for this version

3.5.218 Oct 2017

Nothing published for this version

3.5.03 Apr 2017

Nothing published for this version

3.5.0-beta-120 Mar 2017pre-release

Nothing published for this version

3.5.0-alpha-123 Feb 2017pre-release

Nothing published for this version

3.3.910 Nov 2015

Nothing published for this version

3.3.322 Apr 2015

Nothing published for this version

3.3.113 Mar 2015

Nothing published for this version

3.2.514 Dec 2014

Nothing published for this version

Your coding agent can read these notes before it upgrades. Set up the MCP server →

Per-directory local and remote repository metadata.

org.apache.maven:maven-model-builder

Release timeline

Releases

Notes

Issues fixed since RC-5

Known compatibility issues

Stricter POM validation

Transitive dependency resolution changes

Plugin and extension compatibility

Classloading changes

Post-mvnup formatting

Other

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

From the same repository

💥 Breaking changes

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

📦 Dependency updates

🐛 Bug Fixes

📦 Dependency updates

📝 Documentation updates

📦 Dependency updates

🐛 Bug Fixes

📦 Dependency updates

🐛 Bug Fixes

👻 Maintenance

📦 Dependency updates

🚀 New features and improvements

🐛 Bug Fixes

📝 Documentation updates

👻 Maintenance

🔧 Build

📦 Dependency updates