Skip to content

Instantly share code, notes, and snippets.

@gnodet
Created July 24, 2026 16:44
Show Gist options
  • Select an option

  • Save gnodet/ea3d354b3ea581b83aaedc3111cd47e9 to your computer and use it in GitHub Desktop.

Select an option

Save gnodet/ea3d354b3ea581b83aaedc3111cd47e9 to your computer and use it in GitHub Desktop.
Maven Plugin Ecosystem: 4.0.x Migration & Dual-Branch Analysis (2026-07-24)

Maven Plugin Ecosystem: 4.0.x Migration & Dual-Branch Analysis

Date: 2026-07-24 | Scope: All 40 apache/maven-*-plugin repos + 5 infrastructure components

Migration Scorecard

Only 7 of 40 plugins (17.5%) have migrated master to Maven 4.x API.

Status Count Plugins
Migrated to 4.x 7 compiler, jar, deploy, install, clean, resources, source
Still 3.x 33 assembly, shade, dependency, war, javadoc, gpg, site, ear, ejb, invoker, help, pmd, checkstyle, antrun, artifact, changelog, changes, doap, jarsigner, jdeprscan, jdeps, jlink, jmod, patch, pdf, project-info-reports, rar, remote-resources, scm-publish, scripting, stage, toolchains, verifier

The migrated plugins are the lifecycle core — the ones that compile, package, install, and deploy. Everything else is unmigrated.

Infrastructure Status

Component Migrated? Branches Open PRs Key person
maven-surefire NO — abandoned mvn4 branch from 2022 3 active 45 Olivier Lamy (sole release manager)
maven-plugin-tools ✅ 4.0.0-beta-3 2 6 Slawomir Jaranowski
maven-filtering ✅ 4.0.0-beta-2 2 7 Guillaume Nodet
maven-archiver ✅ 4.0.0-beta-6 2 5 Nodet + Boutemy
maven-shared-utils ❌ (likely never) 1 14 Elliotte Rusty Harold

Surefire is the elephant in the room. Every Maven project depends on it. It has 45 open PRs, 3 maintenance branches, and the only Maven 4 attempt was abandoned in 2022.

Detailed Plugin API Versions (master branch)

Migrated plugins:

Plugin mavenVersion on master 3.x maintenance branch
maven-compiler-plugin 4.0.0-rc-4 maven-compiler-plugin-3.x
maven-jar-plugin 4.0.0-rc-4 maven-jar-plugin-3.x
maven-deploy-plugin 4.0.0-rc-5 maven-deploy-plugin-3.x
maven-install-plugin 4.0.0-rc-5 maven-install-plugin-3.x
maven-clean-plugin 4.0.0-rc-5 maven-clean-plugin-3.x + maven-clean-plugin-3.6.x
maven-resources-plugin 4.0.0-rc-4 maven-resources-plugin-3.x
maven-source-plugin 4.0.0-beta-3 maven-source-plugin-3.x

Unmigrated plugins (selected):

Plugin mavenVersion on master 3.x branch (if any)
maven-assembly-plugin 3.9.16 none
maven-dependency-plugin 3.9.16 maven-dependency-plugin-3.7.x
maven-shade-plugin 3.9.16 none
maven-war-plugin 3.9.16 none
maven-javadoc-plugin 3.6.3 maven-javadoc-plugin-3.8.x
maven-gpg-plugin 3.9.16 none
maven-site-plugin 3.6.3 maven-site-plugin-3.12.x
maven-ear-plugin 3.9.16 none
maven-pmd-plugin 3.9.16 maven-pmd-plugin-3.24.x
maven-checkstyle-plugin 3.6.3 maven-checkstyle-plugin-3.4.x

6 plugins (assembly, shade, war, gpg, ear, ejb) have no 3.x branch at all — master is still 3.x, so dual maintenance hasn't even begun for them.


Who's Doing the Work (Last 3 Months)

~6 humans maintain the entire 40-plugin + infrastructure ecosystem across 2–4 branches each.

Person Role ~Commits Repos touched Primary focus
Slawomir Jaranowski 3.x maintainer-in-chief ~60+ everywhere JUnit 5 migration, release-drafter, 3.x fixes
Guillaume Nodet Maven 4 architect ~34 filtering, archiver, core Drove the 4.x API migration for infra libs
Olivier Lamy Surefire gatekeeper ~26 surefire Sole release manager, 45-PR backlog
Hervé Boutemy Architecture ~23 deploy, archiver, site, core ATR config, reproducible builds
Gerd Aschemann Maven 4 plugin compat ~10 7 plugins "Fix ITs for Maven 4" across the board — solo
Elliotte Rusty Harold shared-utils hardener ~44 shared-utils Systematic bug-fix campaign
Sylwester Lachiewicz Cross-repo contributor ~30 filtering, archiver, compiler, jar DI refactoring, module-info

Key observations

  • Same people, both branches — there is no "3.x team" vs "4.x team"
  • Dependabot is the #1 "committer" in 4 of 5 infrastructure repos and most plugins (human:bot ratio ≈ 1:2)
  • Single points of failure everywhere: Surefire → Lamy, 3.x maintenance → Jaranowski, Maven 4 plugin readiness → Aschemann
  • Only ~6 external contributors in 3 months, each with exactly 1 commit
  • Several plugins had exactly 1 human committer in 3 months (install, clean, resources)
  • 3 maintenance branches are already abandoned: dependency-plugin-3.7.x (dormant since Aug 2024), javadoc-plugin-3.8.x (Aug 2024), site-plugin-3.12.x (Mar 2025)

Is the Dual Branch a Real Pain?

Yes, quantifiably.

1. Double work on bug fixes

The compiler-plugin's "Fix incremental detection of empty sources" was submitted as two separate PRs — #1076 for master/4.x and #1075 for 3.x. Same patch, twice. Cherry-pick markers appear throughout 3.x branches. In Maven core itself, there are 25+ backport PRs in recent history.

2. Dependabot PR multiplication

Every dependency bump generates 2–4 PRs (one per branch). For Surefire with 3 branches, every dep bump = 3 PRs.

3. Branch explosion

Repo Active branches
maven-plugin-tools 4 (master, 3.x, 3.14.x, 3.7.x)
maven-surefire 3 (master, 3.5.x, 3.4.x) + 28 total branches
maven-clean-plugin 3 (master, 3.x, 3.6.x)
Most migrated plugins 2 (master + 3.x)

4. Maven 3.10.0 adds a third line

Released 2026-07-13 as a "bridge" version (Resolver 2.x, JSR330), it already breaks plugins — flatten-maven-plugin has 14 test failures, jaxws-maven-plugin throws ClassNotFoundException. Maven core itself now maintains 3 active branches: 3.9.x, 3.10.x, 4.x.

5. Abandoned maintenance branches

Three 3.x branches are already dead:

  • maven-dependency-plugin-3.7.x — no human commits since Aug 2024
  • maven-javadoc-plugin-3.8.x — no human commits since Aug 2024
  • maven-site-plugin-3.12.x — no human commits since Mar 2025

6. No EOL date

Maven 3.9.17 is still in milestone, 3.10.0 just came out, 4.0.0 is at RC-5 with RC-6/RC-7 milestones open. No milestone has a due date. The 3.x line will continue indefinitely.


What Actually Breaks (The 4.x API Changes)

Breaking change Severity Fix difficulty
Immutable model objectsgetCompileSourceRoots().add() throws UnsupportedOperationException 🔴 High — #1 issue Easy (copy list before mutating)
Removed internal APIsDependencyGraphBuilder, direct Aether calls 🔴 High Medium–hard rewrite
Stricter POM validation — duplicate elements, uninterpolated expressions 🟡 Medium Easy (fix POM)
Deprecated property expressions${version}${project.version} 🟡 Medium Easy (find/replace)
UTF-8 resource filtering strictness — binary files cause MalformedInputException 🟡 Medium Easy (add exclusions)
HTTP repository blocking 🟢 Low Easy (switch to HTTPS)
Enforcer version ranges[3.8.8,4) blocks Maven 4 🟢 Low Easy (widen to [3.8.8,5))

The migration path

The recommended strategy (from PR #12529 by gnodet) is "compile for 3, enhance for 4":

  • Compile against Maven 3.9.x API
  • Use Maven 4's typed API (Session, Project) at runtime via a MavenSession.getSession() bridge call
  • Fall back gracefully on Maven 3

The mvnup tool automates POM-level fixes across 8 prioritized strategies:

Priority Strategy What it does
10 PluginUpgradeStrategy Bumps 15+ known-broken plugins to Maven 4-compatible minimum versions
15 RepositoryHttpsUpgradeStrategy HTTP → HTTPS for repository URLs
17 ResourceFilteringStrategy Adds binary file extension exclusions
18 EnforcerVersionRangeStrategy Widens requireMavenVersion ranges
20 CompatibilityFixStrategy Fixes deprecated expressions, invalid attributes, incorrect relativePaths
20 SourceStrategy Migrates compiler config to Maven 4.1.0+ <source> elements
30 InferenceStrategy Removes redundant POM elements Maven 4 can infer
40 ModelUpgradeStrategy POM model version 4.0.0 → 4.1.0, namespace changes, <modules><subprojects>

Compatibility testing at scale

The gnodet/maven4-testing project tested 966 Apache projects against Maven 4.0.0-rc-5:

  • 602 (62.4%) successful
  • 315 (32.6%) already fail on Maven 3.x (broken regardless)
  • 3 (0.3%) genuine Maven 4 failures
  • 45 (4.7%) known issues (38 documented categories)

Plugins known to need minimum versions for Maven 4 compatibility

Plugin Minimum version
maven-compiler-plugin ≥ 3.2
maven-surefire/failsafe-plugin ≥ 3.5.2
maven-enforcer-plugin ≥ 3.5.0
maven-shade-plugin ≥ 3.5.0
maven-remote-resources-plugin ≥ 3.0.0
maven-resources-plugin ≥ 3.3.1
flatten-maven-plugin ≥ 1.2.7
exec-maven-plugin ≥ 3.5.0
scala-maven-plugin ≥ 4.9.5
gmavenplus-plugin ≥ 4.2.0
quarkus-maven-plugin ≥ 3.26.0
jaxb2-maven-plugin ≥ 3.2.0
extra-enforcer-rules ≥ 1.4

The Big Picture

Maven 4 has been alpha/beta/RC for 4+ years (alpha-1 through RC-5). The ecosystem is in a liminal state:

  • The core lifecycle plugins (7/40) have migrated — you can compile, jar, install, deploy
  • The "everything else" plugins (33/40) haven't — you can't shade, assemble, generate javadoc, or run checkstyle/PMD with a 4.x-native plugin
  • Surefire — the universal dependency — hasn't even started migrating, and the one attempt was abandoned 4 years ago
  • 5–6 people maintain it all, the same people on both lines, with no reinforcements
  • The compatibility layer works, so there's less urgency — but the dual-branch tax is real and growing
  • No published EOL for 3.x means the dual maintenance horizon is indefinite

The bottleneck isn't technical (the migration path exists and mvnup automates much of it). It's human bandwidth — 5 people can't migrate 33 more plugins while maintaining 3.x for all 40 simultaneously.


Analysis performed 2026-07-24 by examining all 40 apache/maven-*-plugin GitHub repositories, 5 infrastructure repos, recent commit history, branch structures, POM configurations, and open issues/PRs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment