[Backport] Externalize default lifecycle plugin versions to POM properties by gnodet · Pull Request #13137 · apache/maven

gnodet · 2026-09-15T09:55:00Z

Backport of #13080 to maven-4.0.x.

Cherry-pick of a58de00, applied cleanly with no conflicts.

…he#13080) Move the 13 hardcoded plugin version constants from Java source into POM properties in impl/maven-core/pom.xml. The values are filtered at build time into plugin-versions.properties and loaded at runtime by a new PluginVersions utility class. This makes the default lifecycle plugin versions visible to dependency-update bots (Dependabot, Renovate) that scan POM files for version properties, enabling automated version bump PRs. No behavioral change: all version values are identical to the previous hardcoded constants.

gnodet-bot

Backport of #13080 — the mechanism is sound and the resource-filtering approach is correct. Two issues need fixing before merge.

Suggested label/milestone: enhancement, milestone 4.0.0 (target for maven-4.0.x)

This review was generated by an AI agent, Hermès on behalf of @gnodet.

gnodet-bot · 2026-09-15T09:59:31Z

    // START SNIPPET: versions
-    protected static final String RESOURCES_PLUGIN_VERSION = "3.3.1";
+    /** @deprecated Use {@link PluginVersions#RESOURCES} instead. */
+    @Deprecated(since = "4.1.0", forRemoval = true)


⚠️ Subclasses not migrated — self-contradictory deprecation.

All 11 constants are deprecated with forRemoval = true and Javadoc pointing callers to PluginVersions.*, but none of the 8 subclasses in this package (BomLifecycleMappingProvider, EarLifecycleMappingProvider, EjbLifecycleMappingProvider, JarLifecycleMappingProvider, MavenPluginLifecycleMappingProvider, PomLifecycleMappingProvider, RarLifecycleMappingProvider, WarLifecycleMappingProvider) are updated. Every one of them still references RESOURCES_PLUGIN_VERSION, COMPILER_PLUGIN_VERSION, etc. directly.

This means the module itself will compile with deprecation warnings against its own deprecated API, which is contradictory. Either:

Update all subclasses to use PluginVersions.* directly in this PR (preferred — the constants exist solely to be used by these subclasses, so the migration is self-contained and straightforward), or

Don't deprecate the constants yet — wait until a follow-up PR migrates the consumers first.

Option 1 is the right call here. The constants are protected and internal-only; migrating 8 short files in the same package is low risk and keeps the change complete.

Fixed in 2eaa501: removed all deprecated *_PLUGIN_VERSION constants from AbstractLifecycleMappingProvider and migrated all 8 subclasses (Bom, Ear, Ejb, Jar, MavenPlugin, Pom, Rar, War) to reference PluginVersions.* directly. Since these constants never existed on maven-4.0.x prior to this PR, there is no backward compatibility concern.

gnodet-bot · 2026-09-15T09:59:31Z

+ * Centralising them in the POM makes them visible to dependency-update bots
+ * such as Dependabot and Renovate.
+ *
+ * @since 4.1.0


⚠️ Wrong @since version for a backport to maven-4.0.x.

This class is being introduced for the first time on the maven-4.0.x branch (project version 4.0.0-SNAPSHOT). The @since 4.1.0 tag was correct in the original #13080 (targeting master/4.1.0-SNAPSHOT), but here it should reflect the 4.0.x release in which this class first appears.

Same issue in AbstractLifecycleMappingProvider — all 11 @Deprecated(since = "4.1.0", ...) annotations have the wrong version.

Suggested change

* @since 4.1.0

* @since 4.0.0

Fixed in 2eaa501: changed to @since 4.0.0.

gnodet-bot

Re-review of #13080 backport to maven-4.0.x — the two issues flagged in the previous review remain unaddressed.

Suggested label/milestone: enhancement, milestone 4.0.0

This review was generated by an AI agent, Hermès on behalf of @gnodet.

gnodet-bot · 2026-09-15T10:55:11Z

+ * Centralising them in the POM makes them visible to dependency-update bots
+ * such as Dependabot and Renovate.
+ *
+ * @since 4.1.0


⚠️ Wrong @since version for a backport to maven-4.0.x.

This class is introduced on maven-4.0.x (project version 4.0.0-SNAPSHOT). The @since 4.1.0 tag was correct in the original #13080 targeting master, but here it should reflect the version where this class first appears on this branch.

Suggested change

* @since 4.1.0

* @since 4.0.0

Fixed in 2eaa501: changed to @since 4.0.0.

gnodet-bot · 2026-09-15T10:55:11Z

    // START SNIPPET: versions
-    protected static final String RESOURCES_PLUGIN_VERSION = "3.3.1";
+    /** @deprecated Use {@link PluginVersions#RESOURCES} instead. */
+    @Deprecated(since = "4.1.0", forRemoval = true)


⚠️ Wrong @Deprecated(since = ...) version — applies to all 11 annotations.

All 11 @Deprecated(since = "4.1.0", forRemoval = true) annotations have the wrong version. The deprecation is being introduced in this PR, which targets maven-4.0.x. The correct value is "4.0.0".

This matters: since documents the first version in which the element became deprecated. Callers inspecting the annotation at runtime or via tooling will see a version that doesn't exist on this branch.

Suggested change

@Deprecated(since = "4.1.0", forRemoval = true)

@Deprecated(since = "4.0.0", forRemoval = true)

(Apply the same fix to all 11 occurrences on lines 40, 44, 48, 52, 56, 62, 66, 70, 74, 78, 82.)

Fixed in 2eaa501: the deprecated constants have been removed entirely (see companion reply on the subclass migration comment). Since no external code could reference these constants before this PR, there is no reason to keep a deprecated bridge — the subclasses now use PluginVersions.* directly.

gnodet-bot · 2026-09-15T10:55:11Z

    // START SNIPPET: versions
-    protected static final String RESOURCES_PLUGIN_VERSION = "3.3.1";
+    /** @deprecated Use {@link PluginVersions#RESOURCES} instead. */
+    @Deprecated(since = "4.1.0", forRemoval = true)


⚠️ Subclasses not migrated — deprecated constants immediately used by their own callers.

All 8 subclasses in this package (BomLifecycleMappingProvider, EarLifecycleMappingProvider, EjbLifecycleMappingProvider, JarLifecycleMappingProvider, MavenPluginLifecycleMappingProvider, PomLifecycleMappingProvider, RarLifecycleMappingProvider, WarLifecycleMappingProvider) still reference the deprecated inherited constants (e.g. RESOURCES_PLUGIN_VERSION, COMPILER_PLUGIN_VERSION) directly.

The net result is that the module deprecates constants as forRemoval = true and then immediately continues using them — the deprecation is self-contradictory. Either:

Migrate all subclasses to PluginVersions.* in this PR (preferred — they are all in the same package, the change is mechanical, and it completes the intent of the refactoring), or

Don't add forRemoval = true until a follow-up PR migrates the consumers.

Option 1 is the right call — the constants exist solely to be used by these 8 subclasses.

Fixed in 2eaa501: all 8 subclasses migrated to PluginVersions.* and the deprecated constants block removed from the abstract class.

@SInCE

…rsions - Fix @SInCE 4.1.0 -> @SInCE 4.0.0 in PluginVersions (class introduced on maven-4.0.x, not on master) - Remove deprecated *_PLUGIN_VERSION constants from AbstractLifecycleMappingProvider (they were never public API on this branch; deprecating brand-new constants with forRemoval=true on the same PR that introduces them is self-contradictory) - Migrate all 8 subclasses (Bom, Ear, Ejb, Jar, MavenPlugin, Pom, Rar, War) to reference PluginVersions.* directly

gnodet-bot

Re-review of #13080 backport to maven-4.0.x — all three issues from the previous review are resolved in commit 2eaa501:

✅ @since version corrected to 4.0.0 in PluginVersions.java
✅ Deprecated constants block entirely removed from AbstractLifecycleMappingProvider (cleaner than a deprecated bridge since these constants never existed on maven-4.0.x before this PR)
✅ All 8 subclasses (Bom, Ear, Ejb, Jar, MavenPlugin, Pom, Rar, War) now reference PluginVersions.* directly

The implementation is sound: resource filtering is already enabled on maven-4.0.x for src/main/resources, the ${...} placeholder guard in PluginVersions will fail-fast at class load time if filtering was skipped, and the new PluginVersionsTest validates all 13 constants are resolved. The pluginManagement entries in pom.xml are the correct mechanism to make the properties visible to Dependabot/Renovate. No behavioral change.

Suggested label/milestone: enhancement, milestone 4.0.0

This review was generated by an AI agent, Hermès on behalf of @gnodet.

Remove the deprecated *_PLUGIN_VERSION constants from AbstractLifecycleMappingProvider and update all subclasses to reference PluginVersions.* constants directly, as was done in the 4.0.x backport (apache#13137). The deprecated constants were introduced as a bridge in apache#13080 but the subclasses were never updated to stop using them. This completes the migration.

…13138) Remove the deprecated *_PLUGIN_VERSION constants from AbstractLifecycleMappingProvider and update all subclasses to reference PluginVersions.* constants directly, as was done in the 4.0.x backport (#13137). The deprecated constants were introduced as a bridge in #13080 but the subclasses were never updated to stop using them. This completes the migration.

gnodet-bot suggested changes Sep 15, 2026

View reviewed changes

gnodet-bot approved these changes Sep 15, 2026

View reviewed changes

gnodet mentioned this pull request Sep 15, 2026

Migrate lifecycle mapping providers to use PluginVersions directly #13138

Merged

gnodet added this to the 4.0.0-rc-7 milestone Sep 15, 2026

gnodet added the enhancement New feature or request label Sep 15, 2026

gnodet merged commit 3f0ed3f into apache:maven-4.0.x Sep 15, 2026
19 checks passed

github-actions Bot assigned gnodet Sep 15, 2026

gnodet mentioned this pull request Sep 15, 2026

Fix default-bindings doc snippet to reference PluginVersions #13140

Merged

gnodet deleted the backport/13080-to-4.0.x branch September 15, 2026 12:51

ascheman mentioned this pull request Sep 17, 2026

chore: add versions:update-properties workflow for lifecycle plugin versions #13166

Merged

Navigation Menu

[Backport] Externalize default lifecycle plugin versions to POM properties - #13137

[Backport] Externalize default lifecycle plugin versions to POM properties#13137
gnodet merged 2 commits into
apache:maven-4.0.xfrom
gnodet:backport/13080-to-4.0.x

gnodet commented Sep 15, 2026

Uh oh!

gnodet-bot left a comment

Uh oh!

gnodet-bot Sep 15, 2026

Uh oh!

gnodet Sep 15, 2026

Uh oh!

gnodet-bot Sep 15, 2026

Uh oh!

gnodet Sep 15, 2026

Uh oh!

gnodet-bot left a comment

Uh oh!

gnodet-bot Sep 15, 2026

Uh oh!

gnodet Sep 15, 2026

Uh oh!

gnodet-bot Sep 15, 2026

Uh oh!

gnodet Sep 15, 2026

Uh oh!

gnodet-bot Sep 15, 2026

Uh oh!

gnodet Sep 15, 2026

Uh oh!

gnodet-bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	@Deprecated(since = "4.1.0", forRemoval = true)
	@Deprecated(since = "4.0.0", forRemoval = true)

Conversation

gnodet commented Sep 15, 2026

Uh oh!

gnodet-bot left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gnodet-bot left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gnodet-bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants