# Apache Maven changelog

> A software project management and comprehension tool.

- Vendor: Apache Software Foundation
- Category: Developer Tools
- Official site: https://maven.apache.org
- Tracked by: What's New (https://whatsnew.fyi/product/maven)
- Harvested from: GitHub (apache/maven)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### maven-4.0.0-rc-6 — Maven 4.0.0-rc-6

- Date: 2026-07-30
- Version: maven-4.0.0-rc-6
- Original notes: https://github.com/apache/maven/releases/tag/maven-4.0.0-rc-6
- Permalink: https://whatsnew.fyi/product/maven/releases/maven-4.0.0-rc-6
- Labels: Pre-release

- **fixed** — Fixed bean configuration bug where field accessibility state was cached globally, causing plugin configuration injection failures
- **fixed** — Fixed concurrency issue in the v4 API that caused ConcurrentModificationException
- **fixed** — Fixed BOM packaging consumer POM conversion to correctly preserve dependency versions
- **fixed** — Removed extracted JLine native binaries from distribution that triggered macOS Gatekeeper
- **changed** — Maven 4 now enforces stricter POM validation, rejecting duplicate XML elements like artifactId and properties
- **changed** — Maven 4 now rejects duplicate dependency declarations with the same groupId:artifactId
- **changed** — Maven 4 no longer silently accepts uninterpolated expressions in repository URLs, distribution management IDs, and other fields
- **changed** — Maven 4 no longer interpolates properties in module elements at POM reading time
- **changed** — Maven 4 applies dependencyManagement at all transitive depths instead of only at the first level
- **added** — Accept Java module names as attached artifactId even if they differ from the project's artifactId
- **added** — Add module-aware resource handling for modular sources
- **changed** — Use hardlink instead of file copy for improved performance
- **changed** — Reduce allocation pressure in model building pipeline

##### Notes

This new release candidate of Maven 4 is released to get feedback from users.
Maven 4 has restricted a few things compared to Maven 3, so make sure to run the [`mvnup`](https://maven.apache.org/tools/mvnup.html#Plugin_Compatibility_.26_Upgrades) tool before trying your project with Maven 4.

###### Issues fixed since RC-5

All known issues reported in the RC-5 release notes have been fixed:

- **Bean configuration bug** — field accessibility state was cached globally, causing plugin configuration injection failures. Fixed in [#11433](https://github.com/apache/maven/pull/11433).
- **Concurrency issue in the v4 API** — a `ConcurrentModificationException` was fixed in [#11429](https://github.com/apache/maven/pull/11429).
- **BOM packaging** — consumer POM conversion for BOM projects now correctly preserves dependency versions. Fixed in [#11464](https://github.com/apache/maven/pull/11464).
- **macOS Gatekeeper** — the extracted JLine native binaries that triggered Gatekeeper have been removed from the distribution ([#11997](https://github.com/apache/maven/pull/11997)). The `xattr` workaround from RC-5 is no longer needed.

###### Known compatibility issues

The following are known compatibility issues when using Maven 4. Running
[`mvnup`](https://maven.apache.org/tools/mvnup.html) before building with
Maven 4 will fix many common plugin version issues automatically. The issues
below are those that require manual intervention or upstream fixes.

###### Stricter POM validation

Maven 4 enforces stricter validation than Maven 3. Projects may need to fix their POMs:

- **Duplicate XML elements** — duplicate `<artifactId>`, `<properties>`, etc. are now rejected (`Duplicated tag` error). Fix the source POM.
- **Duplicate dependency declarations** — same `groupId:artifactId` declared twice is now rejected (`must be unique`).
- **Uninterpolated expressions** — `${...}` expressions in repository URLs, distribution management IDs, and other fields that Maven 3 silently accepted are now rejected.
- **Invalid XML in transitive POMs** — illegal processing instructions or undeclared namespace prefixes in transitive POMs cause `Non-parseable POM` errors.
- **Properties in `<module>` paths** — Maven 4 no longer interpolates properties like `${spark.version}` in `<module>` elements at POM reading time.
- **CI-friendly versions** — projects using `${revision}` without `flatten-maven-plugin` may hit missing dependency version errors.
- **Invalid Collect Request** — transitive dependencies with uninterpolated `${...}` version expressions are rejected.

###### Transitive dependency resolution changes

Maven 4's `TransitiveDependencyManager` applies `dependencyManagement` at all transitive depths (Maven 3 only applied it at the first level). This is intentional but can change resolved versions:

- Dependencies previously on the classpath may disappear — add explicit declarations. See [#12302](https://github.com/apache/maven/issues/12302).
- `maven-enforcer-plugin` version rules may trigger due to downgraded transitive versions.
- `license-maven-plugin` may report new transitive dependencies not in the allow-list.
- Karaf feature verification may fail due to OSGi bundle version mismatches.

###### Plugin and extension compatibility

Some plugins and extensions require specific versions for Maven 4:

- **Quarkus** — versions before 3.20 use `ServiceLocator`/`RepositorySystem` patterns incompatible with Maven 4's Sisu-based DI. Upgrade to Quarkus 3.20+.
- **Tycho** — versions before 5.0 use Guice/Sisu injection patterns broken by Maven 4. Upgrade to Tycho 5.0.3+.
- **Develocity Maven extension** — fails to initialize due to SLF4J classloading changes (`ClassNotFoundException: SimpleLogger`).
- **pgpverify-maven-plugin** — versions before 1.20 hit a `ClassCastException` with Maven 4's resolver. See [resolver#1957](https://github.com/apache/maven-resolver/pull/1957).
- **cyclonedx-maven-plugin** — fails with `Invalid Version Range Request` when

_[Truncated at 4000 characters — full notes: https://github.com/apache/maven/releases/tag/maven-4.0.0-rc-6]_

### maven-3.10.0-rc-1 — 3.10.0-rc-1

- Date: 2026-07-13
- Version: maven-3.10.0-rc-1
- Original notes: https://github.com/apache/maven/releases/tag/maven-3.10.0-rc-1
- Permalink: https://whatsnew.fyi/product/maven/releases/maven-3.10.0-rc-1

- **removed** — Remove release-profile from super POM
- **removed** — Remove deprecated plugin management from super POM
- **changed** — Align Maven 3.10.x and 4.0.x
- **changed** — Align CP ordering with Maven 4
- **changed** — Apply latest Resolver 2.0.19 changes
- **added** — Add Maven 3.10.x super POM
- **changed** — In failed build limit reactor summary to only failed modules
- **added** — Add time zone to Maven startup banner
- **added** — Add version range filters plus
- **added** — Add ability to disable site lifecycle
- **changed** — Optimize log level rendering in MavenSimpleLogger
- **added** — Add Resolver 2.x update policy control via CLI
- **changed** — Promote java version in JavaToolchain
- **added** — Add transitive dep manager
- **changed** — Upgrade slf4j to 2.0.17
- **changed** — Do not force md download always
- **added** — Add user relocations backport
- **added** — Add version range filtering
- **added** — Promote project.rootDirectory for interpolation and profile activation
- **added** — Add new artifact handler: fatjar

<!-- Optional: add a release summary here -->
##### :boom: Breaking changes

- Remove release-profile from super POM ([#11999](https://github.com/apache/maven/pull/11999)) @slawekjaranowski
- Remove deprecated plugin management from super POM ([#11986](https://github.com/apache/maven/pull/11986)) @slawekjaranowski

##### 🚀 New features and improvements

- Feat: Align Maven 3.10.x and 4.0.x ([#12442](https://github.com/apache/maven/pull/12442)) @cstamas
- Feat: Align CP ordering with Maven 4 ([#12327](https://github.com/apache/maven/pull/12327)) @cstamas
- Feat: Apply latest Resolver 2.0.19 changes ([#12246](https://github.com/apache/maven/pull/12246)) @cstamas
- Feat: Maven 3.10.x super POM ([#12032](https://github.com/apache/maven/pull/12032)) @cstamas
- In failed build limit reactor summary to only failed modules ([#11977](https://github.com/apache/maven/pull/11977)) @slawekjaranowski
- Add time zone to Maven startup banner ([#11972](https://github.com/apache/maven/pull/11972)) @slawekjaranowski
- Feat: Version range filters plus ([#11955](https://github.com/apache/maven/pull/11955)) @cstamas
- Feat: Ability to disable site lifecycle ([#11970](https://github.com/apache/maven/pull/11970)) @cstamas
- Optimize log level rendering in MavenSimpleLogger ([#11969](https://github.com/apache/maven/pull/11969)) @slawekjaranowski
- Feat: Resolver 2.x update policy control via CLI ([#11948](https://github.com/apache/maven/pull/11948)) @cstamas
- Promote java version in JavaToolchain ([#11968](https://github.com/apache/maven/pull/11968)) @slawekjaranowski
- Feat: Transitive dep manager ([#11939](https://github.com/apache/maven/pull/11939)) @cstamas
- 3.10.x Upgrade slf4j to 2.0.17 ([#11880](https://github.com/apache/maven/pull/11880)) @olamy
- Do not force md download always ([#11908](https://github.com/apache/maven/pull/11908)) @cstamas
- Feat: user relocations backport ([#11937](https://github.com/apache/maven/pull/11937)) @cstamas
- Feat: Version range filtering ([#11936](https://github.com/apache/maven/pull/11936)) @cstamas
- Promote `project.rootDirectory` for interpolation and profile activation ([#11930](https://github.com/apache/maven/pull/11930)) @slawekjaranowski
- Feat: new artifact handler: fatjar ([#11928](https://github.com/apache/maven/pull/11928)) @cstamas
- Feat: migrate core to JSR330 ([#11916](https://github.com/apache/maven/pull/11916)) @cstamas
- Migrate from JAnsi to JLine, introduce MessageBuilderFactory ([#11874](https://github.com/apache/maven/pull/11874)) @slawekjaranowski
- Feat: Promote session.topDirectory and session.rootDirectory ([#11779](https://github.com/apache/maven/pull/11779)) @cstamas
- Feat: Maven 3.x with Resolver 2.x ([#11778](https://github.com/apache/maven/pull/11778)) @cstamas
- Feat: Generalize Maven 3.x extension handling ([#11777](https://github.com/apache/maven/pull/11777)) @cstamas

##### 🐛 Bug Fixes

- [#12288] Backport: settings.xml activeByDefault profile props to LRM ([#12333](https://github.com/apache/maven/pull/12333)) @ascheman
- Fix illegal reflective access warning on JDK 11 (fixes #12167) ([#12339](https://github.com/apache/maven/pull/12339)) @gnodet
- Issue #12188 redirection of log output to a file does not redirect everything ([#12189](https://github.com/apache/maven/pull/12189)) @olamy
- Update binary distribution LICENSE with complete Apache License 2.0 text ([#12063](https://github.com/apache/maven/pull/12063)) @slawekjaranowski
- Bug: RSS was seeded but not exposed ([#12033](https://github.com/apache/maven/pull/12033)) @cstamas
- Export scope package from resolver-api 2.x ([#12023](https://github.com/apache/maven/pull/12023)) @slawekjaranowski
- Ensure `MavenProject#getPluginManagement` never returns null ([#12010](https://github.com/apache/maven/pull/12010)) @slawekjaranowski
- Remove redundant required attributes from Settings model ([#12005](https://github.com/apache/maven/pull/12005)) @slawekjaranowski
- Remove redundant req

_[Truncated at 4000 characters — full notes: https://github.com/apache/maven/releases/tag/maven-3.10.0-rc-1]_

### maven-3.9.16 — 3.9.16

- Date: 2026-05-17
- Version: maven-3.9.16
- Original notes: https://github.com/apache/maven/releases/tag/maven-3.9.16
- Permalink: https://whatsnew.fyi/product/maven/releases/maven-3.9.16

- **fixed** — Trim threadConfiguration to accept input surrounded with spaces
- **fixed** — Fixed plugin resolution
- **changed** — Bump org.codehaus.plexus:plexus-classworlds from 2.9.0 to 2.11.0
- **changed** — Bump commons-io:commons-io from 2.21.0 to 2.22.0
- **changed** — Bump com.google.guava:guava from 33.5.0-jre to 33.6.0-jre

<!-- Optional: add a release summary here -->
##### 🐛 Bug Fixes

- Trim `threadConfiguration` to accept input surrounded with spaces ([#12042](https://github.com/apache/maven/pull/12042)) @slawekjaranowski
- Backport: Maven 3.10.x fixed plugin resolution ([#12022](https://github.com/apache/maven/pull/12022)) @cstamas

##### 📦 Dependency updates

- Bump org.codehaus.plexus:plexus-classworlds from 2.9.0 to 2.11.0 ([#12039](https://github.com/apache/maven/pull/12039)) @[dependabot[bot]](https://github.com/apps/dependabot)
- [3.9.x] Bump to parent POM 48 ([#12024](https://github.com/apache/maven/pull/12024)) @cstamas
- Bump commons-io:commons-io from 2.21.0 to 2.22.0 ([#11980](https://github.com/apache/maven/pull/11980)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump com.google.guava:guava from 33.5.0-jre to 33.6.0-jre ([#11951](https://github.com/apache/maven/pull/11951)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump actions/cache from 5.0.4 to 5.0.5 ([#11943](https://github.com/apache/maven/pull/11943)) @[dependabot[bot]](https://github.com/apps/dependabot)

### maven-3.9.15 — 3.9.15

- Date: 2026-04-17
- Version: maven-3.9.15
- Original notes: https://github.com/apache/maven/releases/tag/maven-3.9.15
- Permalink: https://whatsnew.fyi/product/maven/releases/maven-3.9.15

<!-- Optional: add a release summary here -->
##### 📝 Documentation updates

- Use new Maven logos in documentation ([#11938](https://github.com/apache/maven/pull/11938)) @slawekjaranowski
- document modelVersion only supported value: 4.0.0 ([#11809](https://github.com/apache/maven/pull/11809)) @hboutemy

##### 📦 Dependency updates

- Bump actions/upload-artifact from 7.0.0 to 7.0.1 ([#11932](https://github.com/apache/maven/pull/11932)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump org.codehaus.plexus:plexus-utils from 3.6.0 to 3.6.1 ([#11876](https://github.com/apache/maven/pull/11876)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump org.fusesource.jansi:jansi from 2.4.2 to 2.4.3 ([#11865](https://github.com/apache/maven/pull/11865)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump actions/cache from 5.0.3 to 5.0.4 ([#11813](https://github.com/apache/maven/pull/11813)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump actions/download-artifact from 8.0.0 to 8.0.1 ([#11790](https://github.com/apache/maven/pull/11790)) @[dependabot[bot]](https://github.com/apps/dependabot)

### maven-3.9.14 — 3.9.14

- Date: 2026-03-12
- Version: maven-3.9.14
- Original notes: https://github.com/apache/maven/releases/tag/maven-3.9.14
- Permalink: https://whatsnew.fyi/product/maven/releases/maven-3.9.14

- **fixed** — plexus-testing dependencies should be used in test scope

<!-- Optional: add a release summary here -->
##### 🐛 Bug Fixes

- plexus-testing dependencies should be use in test scope ([#11761](https://github.com/apache/maven/pull/11761)) @slawekjaranowski

##### 📦 Dependency updates

- Bump actions/upload-artifact from 6.0.0 to 7.0.0 ([#11747](https://github.com/apache/maven/pull/11747)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump actions/download-artifact from 7.0.0 to 8.0.0 ([#11748](https://github.com/apache/maven/pull/11748)) @[dependabot[bot]](https://github.com/apps/dependabot)

### maven-3.9.13 — 3.9.13

- Date: 2026-03-06
- Version: maven-3.9.13
- Original notes: https://github.com/apache/maven/releases/tag/maven-3.9.13
- Permalink: https://whatsnew.fyi/product/maven/releases/maven-3.9.13

- **fixed** — Fix SecDispatcher being managed by legacy Plexus DI
- **fixed** — Handle 8/1.8 Java version in ranges in MavenPluginJavaPrerequisiteChecker
- **changed** — Update to Maven Resolver 1.9.27

<!-- Optional: add a release summary here -->
##### 🐛 Bug Fixes

- Bug: SecDispatcher is managed by legacy Plexus DI ([#11711](https://github.com/apache/maven/pull/11711)) @cstamas
- [3.9.x] MavenPluginJavaPrerequisiteChecker: Handle 8/1.8 Java version in ranges as well ([#11577](https://github.com/apache/maven/pull/11577)) @cstamas

##### 👻 Maintenance

- Update Maven plugin versions in default-bindings.xml ([#11721](https://github.com/apache/maven/pull/11721)) @slachiewicz
- Migrate to JUnit 5 - avoid using TestCase ([#11547](https://github.com/apache/maven/pull/11547)) @slawekjaranowski

##### 📦 Dependency updates

- Maven Resolver 1.9.27 ([#11732](https://github.com/apache/maven/pull/11732)) @cstamas
- Bump resolverVersion from 1.9.25 to 1.9.26 ([#11725](https://github.com/apache/maven/pull/11725)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Update Maven plugin versions in default-bindings.xml ([#11721](https://github.com/apache/maven/pull/11721)) @slachiewicz
- Bump version.sisu-maven-plugin from 0.9.0.M4 to 1.0.0 ([#11706](https://github.com/apache/maven/pull/11706)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump actions/cache from 5.0.2 to 5.0.3 ([#11688](https://github.com/apache/maven/pull/11688)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump org.apache.maven:maven-parent from 45 to 47 ([#11647](https://github.com/apache/maven/pull/11647)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump actions/checkout from 6.0.1 to 6.0.2 ([#11666](https://github.com/apache/maven/pull/11666)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump actions/setup-java from 5.1.0 to 5.2.0 ([#11667](https://github.com/apache/maven/pull/11667)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump org.codehaus.mojo:animal-sniffer-maven-plugin from 1.26 to 1.27 ([#11658](https://github.com/apache/maven/pull/11658)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump org.codehaus.mojo:buildnumber-maven-plugin from 3.2.1 to 3.3.0 ([#11657](https://github.com/apache/maven/pull/11657)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump actions/cache from 5.0.1 to 5.0.2 ([#11659](https://github.com/apache/maven/pull/11659)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump org.codehaus.plexus:plexus-testing from 2.0.2 to 2.1.0 ([#11620](https://github.com/apache/maven/pull/11620)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump org.ow2.asm:asm from 9.9 to 9.9.1 ([#11585](https://github.com/apache/maven/pull/11585)) @slachiewicz
- Bump actions/upload-artifact from 5.0.0 to 6.0.0 ([#11557](https://github.com/apache/maven/pull/11557)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump actions/download-artifact from 6.0.0 to 7.0.0 ([#11556](https://github.com/apache/maven/pull/11556)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump actions/cache from 5.0.0 to 5.0.1 ([#11558](https://github.com/apache/maven/pull/11558)) @[dependabot[bot]](https://github.com/apps/dependabot)

### maven-3.9.12 — 3.9.12

- Date: 2025-12-16
- Version: maven-3.9.12
- Original notes: https://github.com/apache/maven/releases/tag/maven-3.9.12
- Permalink: https://whatsnew.fyi/product/maven/releases/maven-3.9.12

- **added** — Allow a Maven plugin to require a Java version
- **changed** — Apply resolver changes and improvements
- **changed** — Make maven.config use UTF8
- **changed** — Update formatting of prerequisites-requirements error to improve readability
- **changed** — Simplify prefix resolution
- **changed** — Use MavenRepositorySystem in ProjectBuildingHelper instead of deprecated RepositorySystem
- **fixed** — Add default implementation for new method in MavenPluginManager
- **fixed** — Repository layout should be used in MavenRepositorySystem
- **fixed** — Fix plugin prefix resolution when metadata is not available from repository
- **fixed** — Improve source root modification warning message
- **fixed** — Bug: bad cache isolation between two sessions
- **fixed** — Set Guice class loading to CHILD - avoid using terminally deprecated methods
- **fixed** — Avoid parsing MAVEN_OPTS
- **deprecated** — Deprecate org.apache.maven.repository.RepositorySystem in 3.9.x

<!-- Optional: add a release summary here -->
##### 🚀 New features and improvements

- [3.9.x] Apply resolver changes and improvements ([#11536](https://github.com/apache/maven/pull/11536)) @cstamas
- Update formatting of prerequisites-requirements error to improve readability ([#11523](https://github.com/apache/maven/pull/11523)) @slawekjaranowski
- Allow a Maven plugin to require a Java version ([#11479](https://github.com/apache/maven/pull/11479)) @slawekjaranowski
- Use MavenRepositorySystem in ProjectBuildingHelper instead of deprecated RepositorySystem ([#11358](https://github.com/apache/maven/pull/11358)) @slawekjaranowski
- Make maven.config use UTF8 ([#11264](https://github.com/apache/maven/pull/11264)) @cstamas
- Simplify prefix resolution ([#11197](https://github.com/apache/maven/pull/11197)) @slawekjaranowski

##### 🐛 Bug Fixes

- Add default implementation for new method in MavenPluginManager ([#11522](https://github.com/apache/maven/pull/11522)) @slawekjaranowski
- Repository layout should be used in MavenRepositorySystem ([#11495](https://github.com/apache/maven/pull/11495)) @slawekjaranowski
- Fix plugin prefix resolution when metadata is not available from repository ([#11290](https://github.com/apache/maven/pull/11290)) @slawekjaranowski
- Improve source root modification warning message ([#11105](https://github.com/apache/maven/pull/11105)) @gnodet
- Bug: bad cache isolation between two sessions ([#11082](https://github.com/apache/maven/pull/11082)) @cstamas
- Set Guice class loading to CHILD - avoid using terminally deprecated methods ([#11003](https://github.com/apache/maven/pull/11003)) @slawekjaranowski
- Avoid parsing MAVEN_OPTS (3.9.x) ([#10969](https://github.com/apache/maven/pull/10969)) @BobVul

##### 📝 Documentation updates

- clarify repository vs deployment repository ([#11492](https://github.com/apache/maven/pull/11492)) @hboutemy
- add maintained branches ([#11448](https://github.com/apache/maven/pull/11448)) @hboutemy

##### 👻 Maintenance

- Add IntelliJ icon ([#11408](https://github.com/apache/maven/pull/11408)) @Bukama
- Build by JDK 25 ([#11187](https://github.com/apache/maven/pull/11187)) @slawekjaranowski
- Deprecate org.apache.maven.repository.RepositorySystem in 3.9.x ([#11096](https://github.com/apache/maven/pull/11096)) @slawekjaranowski

##### 🔧 Build

- Bump actions/download-artifact from 5.0.0 to 6.0.0 ([#11335](https://github.com/apache/maven/pull/11335)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump actions/upload-artifact from 4.6.2 to 5.0.0 ([#11336](https://github.com/apache/maven/pull/11336)) @[dependabot[bot]](https://github.com/apps/dependabot)

##### 📦 Dependency updates

- Bump actions/cache from 4.3.0 to 5.0.0 ([#11542](https://github.com/apache/maven/pull/11542)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump resolverVersion from 1.9.24 to 1.9.25 ([#11533](https://github.com/apache/maven/pull/11533)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump actions/checkout from 6.0.0 to 6.0.1 ([#11512](https://github.com/apache/maven/pull/11512)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump actions/setup-java from 5.0.0 to 5.1.0 ([#11519](https://github.com/apache/maven/pull/11519)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump actions/checkout from 5.0.1 to 6.0.0 ([#11476](https://github.com/apache/maven/pull/11476)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump actions/checkout from 5.0.0 to 5.0.1 ([#11458](https://github.com/apache/maven/pull/11458)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump commons-cli:commons-cli from 1.10.0 to 1.11.0 ([#11438](https://github.com/apache/maven/pull/11438)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump org.codehaus.plexus:plexus-interpolation from 1.28 to 1.29 ([#11416](https://github.com/apache/maven/pull/11416)) @[dependabot[bot]](https://github.com/apps/dependab

_[Truncated at 4000 characters — full notes: https://github.com/apache/maven/releases/tag/maven-3.9.12]_

### maven-4.0.0-rc-5 — 4.0.0-rc-5

- Date: 2025-11-13
- Version: maven-4.0.0-rc-5
- Original notes: https://github.com/apache/maven/releases/tag/maven-4.0.0-rc-5
- Permalink: https://whatsnew.fyi/product/maven/releases/maven-4.0.0-rc-5
- Labels: Pre-release

<!-- Optional: add a release summary here -->

##### Notes

This new release candidate of Maven 4 is released to get feedback from users.
Maven 4 has a restrained a few things comparent to Maven 3, so make sure to run the [`mvnup`](https://maven.apache.org/tools/mvnup.html#Plugin_Compatibility_.26_Upgrades) tool before trying to project with Maven 4.

###### Bean configuration bug

A bug has been found in the bean configuration system where field accessibility state is cached globally. This can cause plugin configuration injection to fail when the same configuration field is accessed multiple times or in different contexts during a build. This particularly affects the plugin unit tests.

This will be fixed by #11433 in the next release.

###### Concurrency issue in the v4 API

A concurrency issue has been found in the Maven 4 API (still in preview mode) and will be fixed by #11428 in the next release.

###### BOM packaging

Another bug has been found in how BOM projects are processed. When a project uses BOM packaging, the consumer POM is not being properly converted to standard POM packaging, and dependency versions could be lost in some cases.

This will be fixed by #11427 in the next release.

###### macOS: JLine native library may be blocked by Gatekeeper on first use

On macOS (especially Apple Silicon), the first invocation of mvn may fail to load the JLine native terminal library with an error such as:
```
java.lang.UnsatisfiedLinkError: .../libjline-native/Mac/arm64/libjlinenative.jnilib: dlopen(...): code signature ... not valid for use in process: library load disallowed by system policy
```
This occurs when the binary distribution is downloaded via a web browser, which applies the `com.apple.quarantine extended` attribute.
###### Workaround (one-time fix):
```bash
xattr -r -d com.apple.quarantine /path/to/apache-maven-4.0.0-rc-5/lib/jline-native
```
Recommended download method (avoids the issue entirely):
```bash
curl -L -O https://archive.apache.org/dist/maven/maven-4/4.0.0-rc-5/binaries/apache-maven-4.0.0-rc-5-bin.tar.gz
tar -xzf apache-maven-4.0.0-rc-5-bin.tar.gz
```
This is a known issue #10747 and will be addressed in a future release.

##### :boom: Breaking changes

- Disable consumer POM flattening by default and add an opt-in feature (#11347) ([#11370](https://github.com/apache/maven/pull/11370)) @gnodet

##### 🚀 New features and improvements

- Disable consumer POM flattening by default and add an opt-in feature (#11347) ([#11370](https://github.com/apache/maven/pull/11370)) @gnodet
- Make config files use UTF8 (#11263) ([#11265](https://github.com/apache/maven/pull/11265)) @cstamas
- Simplify prefix resolution (#11072) ([#11073](https://github.com/apache/maven/pull/11073)) @cstamas
- Add PathMatcherFactory.includesAll() ([#11008](https://github.com/apache/maven/pull/11008)) @desruisseaux
- Add skipMavenRc to ExecutorRequest and use it in ITs ([#10944](https://github.com/apache/maven/pull/10944)) @slawekjaranowski
- Add PathMatcherFactory service with directory filtering optimization (#10923) ([#10926](https://github.com/apache/maven/pull/10926)) @gnodet
- Allow configurable repository selection for version range resolution (backport) ([#10890](https://github.com/apache/maven/pull/10890)) @cstamas
- Switch resolver to use rwlock-local locks (#2546) ([#2555](https://github.com/apache/maven/pull/2555)) @gnodet

##### 🐛 Bug Fixes

- Fix resource targetPath resolution to be relative to output directory (fixes #11381) (#11394) ([#11406](https://github.com/apache/maven/pull/11406)) @gnodet
- Fix MavenStaxReader location reporting for properties (#11402) ([#11404](https://github.com/apache/maven/pull/11404)) @gnodet
- Fix false parent cycle detection with flatten-maven-plugin ([#11400](https://github.com/apache/maven/pull/11400)) @gnodet
- Resolve property before model reflection to avoid recursion (#11385, fixes #11384) ([#11390](https://github.com/ap

_[Truncated at 4000 characters — full notes: https://github.com/apache/maven/releases/tag/maven-4.0.0-rc-5]_

### maven-3.9.11 — 3.9.11

- Date: 2025-07-15
- Version: maven-3.9.11
- Original notes: https://github.com/apache/maven/releases/tag/maven-3.9.11
- Permalink: https://whatsnew.fyi/product/maven/releases/maven-3.9.11

<!-- Optional: add a release summary here -->
##### 🚀 New features and improvements

- Augment version range resolution used repositories ([#2574](https://github.com/apache/maven/pull/2574)) @cstamas

##### 🐛 Bug Fixes

- Deduplicate filtered dependency graph ([#2489](https://github.com/apache/maven/pull/2489)) @alzimmermsft
- Move ensure in boundaries of project lock ([#2470](https://github.com/apache/maven/pull/2470)) @cstamas

##### 👻 Maintenance

- [[MNGSITE-393]](https://issues.apache.org/jira/browse/MNGSITE-393) - remove references to Maven 2 ([#2438](https://github.com/apache/maven/pull/2438)) @elharo
- Update CONTRIBUTING after GitHub issues enabled ([#2449](https://github.com/apache/maven/pull/2449)) @slawekjaranowski
- Enable Github Issues (3.9.x) ([#2414](https://github.com/apache/maven/pull/2414)) @Bukama
- [[MNG-8763]](https://issues.apache.org/jira/browse/MNG-8763) - Remove name from site bannerLeft ([#2419](https://github.com/apache/maven/pull/2419)) @slawekjaranowski

##### 🔧 Build

- Pin GitHub action versions by hash ([#10898](https://github.com/apache/maven/pull/10898)) @slawekjaranowski
- Build the project by JDK 21 as default ([#10896](https://github.com/apache/maven/pull/10896)) @slawekjaranowski
- Use Maven 3.9.10 for build on GitHub ([#2452](https://github.com/apache/maven/pull/2452)) @slawekjaranowski

##### 📦 Dependency updates

- Bump resolverVersion from 1.9.23 to 1.9.24 ([#2540](https://github.com/apache/maven/pull/2540)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump xmlunitVersion from 2.10.2 to 2.10.3 ([#2500](https://github.com/apache/maven/pull/2500)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump org.apache.maven:maven-parent from 44 to 45 ([#2491](https://github.com/apache/maven/pull/2491)) @[dependabot[bot]](https://github.com/apps/dependabot)
- Bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.0 to 3.6.1 ([#2432](https://github.com/apache/maven/pull/2432)) @[dependabot[bot]](https://github.com/apps/dependabot)

### maven-4.0.0-rc-4 — 4.0.0-rc-4

- Date: 2025-06-25
- Version: maven-4.0.0-rc-4
- Original notes: https://github.com/apache/maven/releases/tag/maven-4.0.0-rc-4
- Permalink: https://whatsnew.fyi/product/maven/releases/maven-4.0.0-rc-4
- Labels: Pre-release

Maven 4.0.0-rc-4 aims at being the last release candidate before Maven 4.0.0 GA. We'll focus on fixing critical bugs raised before GA.
Worth mentioning is the new upgrade tool which can be used to fix your `pom.xml` files and make them usable in Maven 4.

##### 🚀 New features and improvements

- [[MNG-8765]](https://issues.apache.org/jira/browse/MNG-8765) - Maven Upgrade Tool ([#2407](https://github.com/apache/maven/pull/2407)) @gnodet
- Maven4 "legacy" mode and more ([#2380](https://github.com/apache/maven/pull/2380)) @cstamas
- [[MNG-8759]](https://issues.apache.org/jira/browse/MNG-8759) - Restore toString method in DefaultJavaToolchain ([#2411](https://github.com/apache/maven/pull/2411)) @slawekjaranowski
- [[MNG-8572]](https://issues.apache.org/jira/browse/MNG-8572) - Support DI beans in build extensions ([#2274](https://github.com/apache/maven/pull/2274)) @gnodet
- [[MNG-8717]](https://issues.apache.org/jira/browse/MNG-8717) - Remove maven-plugin-plugin:addPluginArtifactMetadata from default binding ([#2294](https://github.com/apache/maven/pull/2294)) @slawekjaranowski

##### 🐛 Bug Fixes

- Deduplicate filtered dependency graph ([#2493](https://github.com/apache/maven/pull/2493)) @alzimmermsft
- User properties are not interpolated for paths ([#2480](https://github.com/apache/maven/pull/2480)) @cstamas
- Move project mutation inside project lock ([#2474](https://github.com/apache/maven/pull/2474)) @cstamas
- [[MNG-8736]](https://issues.apache.org/jira/browse/MNG-8736) - Fix concurrency issue in model building with profile activation ([#2378](https://github.com/apache/maven/pull/2378)) @gnodet
- [[MNG-8767]](https://issues.apache.org/jira/browse/MNG-8767) - Add suppressed exceptions to BatchRequestException in AbstractRequestCache ([#2431](https://github.com/apache/maven/pull/2431)) @gnodet
- [[MNG-8746]](https://issues.apache.org/jira/browse/MNG-8746) - Preserve property insertion order in WrapperProperties ([#2404](https://github.com/apache/maven/pull/2404)) @gnodet
- [[MNG-8764]](https://issues.apache.org/jira/browse/MNG-8764) - Sort injected lists by @Priority annotation ([#2425](https://github.com/apache/maven/pull/2425)) @gnodet
- [[MNG-8761]](https://issues.apache.org/jira/browse/MNG-8761) - Add Maven 3 MavenToolchainsXpp3Reader/Writer ([#2412](https://github.com/apache/maven/pull/2412)) @slawekjaranowski
- [[MNG-8729]](https://issues.apache.org/jira/browse/MNG-8729) - Use correct `outputStream` destination; `request` instead of `path` in `DefaultPluginXmlFactory#write` ([#2312](https://github.com/apache/maven/pull/2312)) @Pankraz76
- [[MNG-8720]](https://issues.apache.org/jira/browse/MNG-8720) - Fix for symlinked project directory ([#2289](https://github.com/apache/maven/pull/2289)) @cstamas
- [[MNG-8653]](https://issues.apache.org/jira/browse/MNG-8653) - Fix 'all' phase and  add 'each' phase ([#2191](https://github.com/apache/maven/pull/2191)) @gnodet
- [[MNG-5668]](https://issues.apache.org/jira/browse/MNG-5668) - Execute after:* phases when build fails ([#2195](https://github.com/apache/maven/pull/2195)) @gnodet
- [[MNG-8629]](https://issues.apache.org/jira/browse/MNG-8629) - bugfix: If POM has parent and repository stanza, it is used un-interpolated ([#2192](https://github.com/apache/maven/pull/2192)) @cstamas
- [[MNG-8645]](https://issues.apache.org/jira/browse/MNG-8645) - Fix dependency management section of consumer POM ([#2183](https://github.com/apache/maven/pull/2183)) @gnodet
- [[MNG-8624]](https://issues.apache.org/jira/browse/MNG-8624) - Fix dependency not being set correctly for unsupported types ([#2153](https://github.com/apache/maven/pull/2153)) @gnodet
- Fix ITs referencing rc-3-SNAPSHOT ([#2164](https://github.com/apache/maven/pull/2164)) @gnodet
- [[MNG-8620]](https://issues.apache.org/jira/browse/MNG-8620) - Fix links in SVG ([#2152](https://github.com/apache/maven/pull/2152)) @kwin

##### 📝 Documentation updates

- [[MNG-8731]](https://issues.apache.org/jira

_[Truncated at 4000 characters — full notes: https://github.com/apache/maven/releases/tag/maven-4.0.0-rc-4]_