Date: 2026-07-24 | Scope: All 40
apache/maven-*-pluginrepos + 5 infrastructure components
Only 7 of 40 plugins (17.5%) have migrated master to Maven 4.x API.
| Status | Count | Plugins |
|---|---|---|
| ✅ Migrated to 4.x | 7 | compiler, jar, deploy, install, clean, resources, source |
| ❌ Still 3.x | 33 | assembly, shade, dependency, war, javadoc, gpg, site, ear, ejb, invoker, help, pmd, checkstyle, antrun, artifact, changelog, changes, doap, jarsigner, jdeprscan, jdeps, jlink, jmod, patch, pdf, project-info-reports, rar, remote-resources, scm-publish, scripting, stage, toolchains, verifier |
The migrated plugins are the lifecycle core — the ones that compile, package, install, and deploy. Everything else is unmigrated.
| Component | Migrated? | Branches | Open PRs | Key person |
|---|---|---|---|---|
| maven-surefire | ❌ NO — abandoned mvn4 branch from 2022 |
3 active | 45 | Olivier Lamy (sole release manager) |
| maven-plugin-tools | ✅ 4.0.0-beta-3 | 2 | 6 | Slawomir Jaranowski |
| maven-filtering | ✅ 4.0.0-beta-2 | 2 | 7 | Guillaume Nodet |
| maven-archiver | ✅ 4.0.0-beta-6 | 2 | 5 | Nodet + Boutemy |
| maven-shared-utils | ❌ (likely never) | 1 | 14 | Elliotte Rusty Harold |
Surefire is the elephant in the room. Every Maven project depends on it. It has 45 open PRs, 3 maintenance branches, and the only Maven 4 attempt was abandoned in 2022.
Migrated plugins:
| Plugin | mavenVersion on master | 3.x maintenance branch |
|---|---|---|
| maven-compiler-plugin | 4.0.0-rc-4 | maven-compiler-plugin-3.x |
| maven-jar-plugin | 4.0.0-rc-4 | maven-jar-plugin-3.x |
| maven-deploy-plugin | 4.0.0-rc-5 | maven-deploy-plugin-3.x |
| maven-install-plugin | 4.0.0-rc-5 | maven-install-plugin-3.x |
| maven-clean-plugin | 4.0.0-rc-5 | maven-clean-plugin-3.x + maven-clean-plugin-3.6.x |
| maven-resources-plugin | 4.0.0-rc-4 | maven-resources-plugin-3.x |
| maven-source-plugin | 4.0.0-beta-3 | maven-source-plugin-3.x |
Unmigrated plugins (selected):
| Plugin | mavenVersion on master | 3.x branch (if any) |
|---|---|---|
| maven-assembly-plugin | 3.9.16 | none |
| maven-dependency-plugin | 3.9.16 | maven-dependency-plugin-3.7.x |
| maven-shade-plugin | 3.9.16 | none |
| maven-war-plugin | 3.9.16 | none |
| maven-javadoc-plugin | 3.6.3 | maven-javadoc-plugin-3.8.x |
| maven-gpg-plugin | 3.9.16 | none |
| maven-site-plugin | 3.6.3 | maven-site-plugin-3.12.x |
| maven-ear-plugin | 3.9.16 | none |
| maven-pmd-plugin | 3.9.16 | maven-pmd-plugin-3.24.x |
| maven-checkstyle-plugin | 3.6.3 | maven-checkstyle-plugin-3.4.x |
6 plugins (assembly, shade, war, gpg, ear, ejb) have no 3.x branch at all — master is still 3.x, so dual maintenance hasn't even begun for them.
~6 humans maintain the entire 40-plugin + infrastructure ecosystem across 2–4 branches each.
| Person | Role | ~Commits | Repos touched | Primary focus |
|---|---|---|---|---|
| Slawomir Jaranowski | 3.x maintainer-in-chief | ~60+ | everywhere | JUnit 5 migration, release-drafter, 3.x fixes |
| Guillaume Nodet | Maven 4 architect | ~34 | filtering, archiver, core | Drove the 4.x API migration for infra libs |
| Olivier Lamy | Surefire gatekeeper | ~26 | surefire | Sole release manager, 45-PR backlog |
| Hervé Boutemy | Architecture | ~23 | deploy, archiver, site, core | ATR config, reproducible builds |
| Gerd Aschemann | Maven 4 plugin compat | ~10 | 7 plugins | "Fix ITs for Maven 4" across the board — solo |
| Elliotte Rusty Harold | shared-utils hardener | ~44 | shared-utils | Systematic bug-fix campaign |
| Sylwester Lachiewicz | Cross-repo contributor | ~30 | filtering, archiver, compiler, jar | DI refactoring, module-info |
- Same people, both branches — there is no "3.x team" vs "4.x team"
- Dependabot is the #1 "committer" in 4 of 5 infrastructure repos and most plugins (human:bot ratio ≈ 1:2)
- Single points of failure everywhere: Surefire → Lamy, 3.x maintenance → Jaranowski, Maven 4 plugin readiness → Aschemann
- Only ~6 external contributors in 3 months, each with exactly 1 commit
- Several plugins had exactly 1 human committer in 3 months (install, clean, resources)
- 3 maintenance branches are already abandoned: dependency-plugin-3.7.x (dormant since Aug 2024), javadoc-plugin-3.8.x (Aug 2024), site-plugin-3.12.x (Mar 2025)
Yes, quantifiably.
The compiler-plugin's "Fix incremental detection of empty sources" was submitted as two separate PRs — #1076 for master/4.x and #1075 for 3.x. Same patch, twice. Cherry-pick markers appear throughout 3.x branches. In Maven core itself, there are 25+ backport PRs in recent history.
Every dependency bump generates 2–4 PRs (one per branch). For Surefire with 3 branches, every dep bump = 3 PRs.
| Repo | Active branches |
|---|---|
| maven-plugin-tools | 4 (master, 3.x, 3.14.x, 3.7.x) |
| maven-surefire | 3 (master, 3.5.x, 3.4.x) + 28 total branches |
| maven-clean-plugin | 3 (master, 3.x, 3.6.x) |
| Most migrated plugins | 2 (master + 3.x) |
Released 2026-07-13 as a "bridge" version (Resolver 2.x, JSR330), it already breaks plugins — flatten-maven-plugin has 14 test failures, jaxws-maven-plugin throws ClassNotFoundException. Maven core itself now maintains 3 active branches: 3.9.x, 3.10.x, 4.x.
Three 3.x branches are already dead:
maven-dependency-plugin-3.7.x— no human commits since Aug 2024maven-javadoc-plugin-3.8.x— no human commits since Aug 2024maven-site-plugin-3.12.x— no human commits since Mar 2025
Maven 3.9.17 is still in milestone, 3.10.0 just came out, 4.0.0 is at RC-5 with RC-6/RC-7 milestones open. No milestone has a due date. The 3.x line will continue indefinitely.
| Breaking change | Severity | Fix difficulty |
|---|---|---|
Immutable model objects — getCompileSourceRoots().add() throws UnsupportedOperationException |
🔴 High — #1 issue | Easy (copy list before mutating) |
Removed internal APIs — DependencyGraphBuilder, direct Aether calls |
🔴 High | Medium–hard rewrite |
| Stricter POM validation — duplicate elements, uninterpolated expressions | 🟡 Medium | Easy (fix POM) |
Deprecated property expressions — ${version} → ${project.version} |
🟡 Medium | Easy (find/replace) |
UTF-8 resource filtering strictness — binary files cause MalformedInputException |
🟡 Medium | Easy (add exclusions) |
| HTTP repository blocking | 🟢 Low | Easy (switch to HTTPS) |
Enforcer version ranges — [3.8.8,4) blocks Maven 4 |
🟢 Low | Easy (widen to [3.8.8,5)) |
The recommended strategy (from PR #12529 by gnodet) is "compile for 3, enhance for 4":
- Compile against Maven 3.9.x API
- Use Maven 4's typed API (
Session,Project) at runtime via aMavenSession.getSession()bridge call - Fall back gracefully on Maven 3
The mvnup tool automates POM-level fixes across 8 prioritized strategies:
| Priority | Strategy | What it does |
|---|---|---|
| 10 | PluginUpgradeStrategy | Bumps 15+ known-broken plugins to Maven 4-compatible minimum versions |
| 15 | RepositoryHttpsUpgradeStrategy | HTTP → HTTPS for repository URLs |
| 17 | ResourceFilteringStrategy | Adds binary file extension exclusions |
| 18 | EnforcerVersionRangeStrategy | Widens requireMavenVersion ranges |
| 20 | CompatibilityFixStrategy | Fixes deprecated expressions, invalid attributes, incorrect relativePaths |
| 20 | SourceStrategy | Migrates compiler config to Maven 4.1.0+ <source> elements |
| 30 | InferenceStrategy | Removes redundant POM elements Maven 4 can infer |
| 40 | ModelUpgradeStrategy | POM model version 4.0.0 → 4.1.0, namespace changes, <modules> → <subprojects> |
The gnodet/maven4-testing project tested 966 Apache projects against Maven 4.0.0-rc-5:
- 602 (62.4%) successful
- 315 (32.6%) already fail on Maven 3.x (broken regardless)
- 3 (0.3%) genuine Maven 4 failures
- 45 (4.7%) known issues (38 documented categories)
| Plugin | Minimum version |
|---|---|
| maven-compiler-plugin | ≥ 3.2 |
| maven-surefire/failsafe-plugin | ≥ 3.5.2 |
| maven-enforcer-plugin | ≥ 3.5.0 |
| maven-shade-plugin | ≥ 3.5.0 |
| maven-remote-resources-plugin | ≥ 3.0.0 |
| maven-resources-plugin | ≥ 3.3.1 |
| flatten-maven-plugin | ≥ 1.2.7 |
| exec-maven-plugin | ≥ 3.5.0 |
| scala-maven-plugin | ≥ 4.9.5 |
| gmavenplus-plugin | ≥ 4.2.0 |
| quarkus-maven-plugin | ≥ 3.26.0 |
| jaxb2-maven-plugin | ≥ 3.2.0 |
| extra-enforcer-rules | ≥ 1.4 |
Maven 4 has been alpha/beta/RC for 4+ years (alpha-1 through RC-5). The ecosystem is in a liminal state:
- The core lifecycle plugins (7/40) have migrated — you can compile, jar, install, deploy
- The "everything else" plugins (33/40) haven't — you can't shade, assemble, generate javadoc, or run checkstyle/PMD with a 4.x-native plugin
- Surefire — the universal dependency — hasn't even started migrating, and the one attempt was abandoned 4 years ago
- 5–6 people maintain it all, the same people on both lines, with no reinforcements
- The compatibility layer works, so there's less urgency — but the dual-branch tax is real and growing
- No published EOL for 3.x means the dual maintenance horizon is indefinite
The bottleneck isn't technical (the migration path exists and mvnup automates much of it). It's human bandwidth — 5 people can't migrate 33 more plugins while maintaining 3.x for all 40 simultaneously.
Analysis performed 2026-07-24 by examining all 40 apache/maven-*-plugin GitHub repositories, 5 infrastructure repos, recent commit history, branch structures, POM configurations, and open issues/PRs.