Bump default plugin versions to latest stable 3.x - #13076
Conversation
Refresh the compiled-in default lifecycle plugin versions to the latest stable 3.x releases (Maven 3+4 compatible, JDK 8+). The 4.x lines hardcode these as Java constants with no refresh mechanism and had drifted to ~mid-2024 values.
gnodet
left a comment
gnodet
left a comment
There was a problem hiding this comment.
Thanks for the version bump, Gerd — the intent is exactly right and CI is green across the board.
One miss: maven-plugin-plugin 3.16.0 was released on Sep 6 (two days before this PR), so 3.15.2 → 3.16.0 should be included.
Also, the PR description still says "Draft — held intentionally" but the PR is no longer a draft. Might want to update the description now that it's ready for review.
The follow-up idea (converging onto a plugin-versions.properties mechanism) would be a nice improvement — these constants are invisible to Dependabot as-is.
gnodet
left a comment
gnodet
left a comment
There was a problem hiding this comment.
Verified all 13 plugin versions against Maven Central — each is the latest stable 3.x release as of today, with one exception already noted by @gnodet:
| Plugin | PR version | Latest 3.x | ✓ |
|---|---|---|---|
| clean | 3.5.0 | 3.5.0 | ✅ |
| resources | 3.5.0 | 3.5.0 | ✅ |
| compiler | 3.16.0 | 3.16.0 | ✅ |
| surefire | 3.6.0 | 3.6.0 | ✅ |
| install | 3.1.4 | 3.1.4 | ✅ |
| deploy | 3.1.4 | 3.1.4 | ✅ |
| jar | 3.5.1 | 3.5.1 | ✅ |
| ear | 3.4.0 | 3.4.0 | ✅ |
| ejb | 3.3.0 | 3.3.0 | ✅ |
| plugin | 3.15.2 | 3.16.0 (Sep 6) | |
| rar | 3.1.0 | 3.1.0 | ✅ |
| war | 3.5.1 | 3.5.1 | ✅ |
| site | 3.22.0 | 3.22.0 | ✅ |
All targeted versions require Maven ≥ 3.6.3 and Java ≥ 8 — safe as defaults on the 4.0.x line.
Only action needed: bump PLUGIN_PLUGIN_VERSION from 3.15.2 → 3.16.0 as @gnodet flagged.
📋 PR Metadata
| Aspect | Current | Suggested |
|---|---|---|
| Category | (unlabeled) | maintenance |
| Milestone | (none) | 4.0.0-rc-7 or next 4.0.x |
Backport status: NOT_NEEDED — these are 4.x-specific hardcoded constants with no equivalent in the 3.x line.
This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.
Claude on behalf of @gnodet
|
|
||
| protected static final String WAR_PLUGIN_VERSION = "3.4.0"; | ||
| protected static final String WAR_PLUGIN_VERSION = "3.5.1"; | ||
| // END SNIPPET: versions |
There was a problem hiding this comment.
maven-plugin-plugin 3.16.0 was released on Sep 6, 2026 — two days before this PR. Should be:
| // END SNIPPET: versions | |
| protected static final String PLUGIN_PLUGIN_VERSION = "3.16.0"; |
2 participants
The 4.x lines bind a fixed version to every plugin of the
default,cleanandsitelifecycles, hardcoded as Java constants in two files:impl/maven-core/src/main/java/org/apache/maven/lifecycle/providers/packaging/AbstractLifecycleMappingProvider.java(11 plugins)impl/maven-core/src/main/java/org/apache/maven/internal/impl/DefaultLifecycleRegistry.java(clean, site)Unlike the 3.10 line (which inherits
version.maven-*from the ASF parent), these constants have no refresh mechanism and had drifted to ~mid-2024 values. This bumps all 13 to the latest stable 3.x:All targets are the latest
< 4.0.0release on Central, each requiring Maven >= 3.6.3 and Java >= 8, so they are safe as defaults on this line; the 3.x plugin lines keep the Maven 3+4 compatibility layer, delivering accumulated fixes without breaking changes.Notably
maven-compiler-pluginmoves off 3.13.0, which carries MCOMPILER-592 (emptyproject.build.outputTimestamp->IndexOutOfBoundsException, fixed in 3.14.0) — reachable with default settings.Follow-up (separate): these constants live in two files with no bot-visible coordinate, so nothing keeps them current. Converging them onto the 3.10 filtered-
plugin-versions.propertiesmechanism would let Dependabot propose future bumps.