You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Tracking issue for retiring BeanShell across the Maven estate: deprecate it now, migrate what we own, remove it in the next majors.
Why
The bsh artifact we ship is dead on Central: org.apache-extras.beanshell:bsh last published 2.0b6 on 2016-02-05 (the CVE-2016-2510 fix). The GitHub project released 2.1.1 in 2022 but never to Central; nothing since.
Every use we have is a test-script or expression language for which Groovy is already the second engine in the same component, and the newer ITs are written in Groovy.
maven-plugin-tools already dropped BeanShell mojos for 4.0.0 (MPLUGIN-525).
Gone on master (MPLUGIN-525); ends with the 3.x line
Our own ITs
549 .bsh scripts in the 3.x plugin lines (444 verify.bsh, 70 setup.bsh) against 1 009 .groovy
Largest holders: assembly 107, invoker 79, install 47, dependency 44, shade 36, javadoc 28, war 24, deploy 22, site 21, clean 16
Outside the estate, GitHub code search finds 1 628 src/it/**/verify.bsh against 3 240 verify.groovy.
Status (2026-09-30)
50 of the 54 PRs linked here are merged. On the default branches of every apache/maven-* repository the only .bsh files left are engine coverage: maven-invoker-plugin's 17 script-* fixtures, maven-script-interpreter's 7 test resources, and maven-archetype's verify-script-beanshell-rejected fixture, which checks that BeanShell is refused.
maven-archetype has already removed BeanShell on master: verify scripts run through Groovy directly and maven-script-interpreter is gone (f4e8441fb).
maven-invoker-plugin keeps 17 .bsh files under the beanshell/ fixture directories of its script-* ITs on purpose: they exercise the plugin's own interpreter detection and are the engine's coverage until it is removed.
What actually needed changing when porting (everything else was byte-identical after the rename): "$…" in double-quoted strings interpolates in Groovy (literal-placeholder assertions → single quotes); String[] x = { … } initialisers do not parse (→ list literals); typed redeclarations in one scope are a compile error; a script-level method cannot see typed script locals (→ @Field).
Remaining .bsh ITs, whole estate (3.x lines and, where master is the Maven 4 line, master too):
Left as .bsh on purpose, all engine coverage: maven-invoker-plugin's 17 script-*/src/it/beanshell/ fixtures, maven-script-interpreter's 7 test resources, and maven-plugin-tools 3.x's two BeanShell mojo sources. After these merge, no other .bsh remains in the estate.
More Groovy differences met on the way, beyond the four above: in is a keyword; File + String throws at runtime (no File.plus(String)); '/' is a String, so File.separatorChar == '/' needs as char; an import of a class that does not exist fails compilation even when unused; a script-level method needs a return type; BeanShell's x == void becomes !binding.hasVariable('x'); a println of a never-declared variable throws instead of printing void. The last three only show up when the IT actually runs, not under groovyc.
Remove: maven-script-interpreter 2.0 drops bsh, the fallback becomes an error; maven-invoker-plugin follows on its next minor after that. maven-archetype-plugin is done on master (f4e8441fb).
Tracking issue for retiring BeanShell across the Maven estate: deprecate it now, migrate what we own, remove it in the next majors.
Why
bshartifact we ship is dead on Central:org.apache-extras.beanshell:bshlast published 2.0b6 on 2016-02-05 (the CVE-2016-2510 fix). The GitHub project released 2.1.1 in 2022 but never to Central; nothing since.maven-plugin-toolsalready dropped BeanShell mojos for 4.0.0 (MPLUGIN-525).System.out/System.errand serialize all script runs behind a static lock (Global System.out/System.err redirection and static lock serialize all script runs JVM-wide maven-script-interpreter#205); fixing that for one engine is cheaper than for two.Where BeanShell is used
BeanShellScriptInterpreter, registered asbshnext togroovyScriptRunner)setup/prebuild/postbuild/selectorscriptsarchetype:integration-testverify scriptsevaluateBeanshellrule, directbshdependencypom.xmlon GitHub use the rulemaven-script-beanshell,maven-plugin-tools-beanshell.bshscripts in the 3.x plugin lines (444verify.bsh, 70setup.bsh) against 1 009.groovyOutside the estate, GitHub code search finds 1 628
src/it/**/verify.bshagainst 3 240verify.groovy.Status (2026-09-30)
50 of the 54 PRs linked here are merged. On the default branches of every
apache/maven-*repository the only.bshfiles left are engine coverage: maven-invoker-plugin's 17script-*fixtures, maven-script-interpreter's 7 test resources, and maven-archetype'sverify-script-beanshell-rejectedfixture, which checks that BeanShell is refused.maven-archetype has already removed BeanShell on master: verify scripts run through Groovy directly and maven-script-interpreter is gone (f4e8441fb).
Still open:
evaluateGroovyruleSystem.out(stacked on #217, fixes apache/maven-script-interpreter#205)The three maven-script-interpreter PRs missed 1.9 (2026-09-19), so the deprecation ships in 1.10.
Plan
Deprecate now in maven-invoker-plugin and maven-archetype-plugin: docs and parameter javadoc say BeanShell scripts are deprecated, port to Groovy. — Deprecate BeanShell hook scripts maven-invoker-plugin#768, Deprecate BeanShell verify scripts for archetype:integration-test maven-archetype#1030
maven-script-interpreter 1.10:
@DeprecatedonBeanShellScriptInterpreter, warning on every BeanShell run, site note — Deprecate BeanShell scripts maven-script-interpreter#216; unknown extensions run as Groovy instead of BeanShell — Run scripts with an unknown extension as Groovy maven-script-interpreter#217 (stacked). Next: 1.11 makesbshan optional dependency.maven-enforcer: deprecate
evaluateBeanshell(@Deprecated, runtime warning, docs). — Deprecate the evaluateBeanshell rule maven-enforcer#1034. Replacement decided:evaluateGroovy, Add the evaluateGroovy rule maven-enforcer#1035 (Groovy is an optional dependency users add to the plugin declaration; the deprecation notices point at it).Migrate our ITs:
.bsh→.groovy, one PR per repo, rename commit first. Done for the September-round repos and the small MojoHaus ones:maven-invoker-plugin keeps 17
.bshfiles under thebeanshell/fixture directories of itsscript-*ITs on purpose: they exercise the plugin's own interpreter detection and are the engine's coverage until it is removed.What actually needed changing when porting (everything else was byte-identical after the rename):
"$…"in double-quoted strings interpolates in Groovy (literal-placeholder assertions → single quotes);String[] x = { … }initialisers do not parse (→ list literals); typed redeclarations in one scope are a compile error; a script-level method cannot see typed script locals (→@Field).Remaining
.bshITs, whole estate (3.x lines and, where master is the Maven 4 line, master too):Left as
.bshon purpose, all engine coverage: maven-invoker-plugin's 17script-*/src/it/beanshell/fixtures, maven-script-interpreter's 7 test resources, and maven-plugin-tools 3.x's two BeanShell mojo sources. After these merge, no other.bshremains in the estate.More Groovy differences met on the way, beyond the four above:
inis a keyword;File + Stringthrows at runtime (noFile.plus(String));'/'is a String, soFile.separatorChar == '/'needsas char; an import of a class that does not exist fails compilation even when unused; a script-level method needs a return type; BeanShell'sx == voidbecomes!binding.hasVariable('x'); aprintlnof a never-declared variable throws instead of printing void. The last three only show up when the IT actually runs, not undergroovyc.Remove: maven-script-interpreter 2.0 drops
bsh, the fallback becomes an error; maven-invoker-plugin follows on its next minor after that. maven-archetype-plugin is done on master (f4e8441fb).PRs and per-repo issues link back here.