Measure the impact of porting Maven components and plugins to the Maven 4 API

[slachiewicz]

Description

Tracks porting the Apache Maven components and plugins from the Maven 3 API (MavenProject, org.apache.maven.artifact, maven-compat, Sisu and Plexus components) to the Maven 4 API at 4.0.0-rc-7. This is an impact study, not a migration: it measures what ports cleanly, where the Maven 4 API has no equivalent, and which components are better kept on Maven 3, or retired, than ported.

The work is organised as follows:

• Each component gets a branch agent/mvn4-api: one commit switches CI to Maven 4 only (maven4-build: true, version from the maven-gh-actions-shared@v5 default), the next ports the code. Where a PR is open, it is a draft labelled not-for-merge; the tables below link it.
• Findings are kept in comments below, edited in place: one per shared component and Doxia component, and five grouped comments with a collapsed section per component for the rest.
• A component whose PR is labelled wontfix has its PR closed and is marked "completed: migration not needed".
• Gaps feed issues against apache/maven and fix PRs in the estate, listed under "Filed from this work".
• On 2026-10-06 every agent/mvn4-api branch was rebased onto its default branch. A component's findings give its measurements from before the rebase, unless they include a rebase note.

Status

Needs migration	Ported	Partial	Blocked	In progress	No migration needed	Already on the Maven 4 API
36	16	18	2	0	16	12

Closed as wontfix, migration to the Maven 4 API not needed: maven-build-cache-extension, maven-common-artifact-filters, maven-dependency-analyzer, maven-dependency-tree, maven-doxia, maven-doxia-converter, maven-doxia-sitetools, maven-file-management, maven-fluido-skin, maven-invoker, maven-jarsigner, maven-mapping, maven-reporting-api, maven-reporting-exec, maven-reporting-impl, maven-script-interpreter, maven-shared-jar, maven-shared-resources, maven-shared-utils.

Gaps found so far (rc-7)

Each row names the components where the gap was hit; details are in their findings comments below.

In the Maven 4 API: needs apache/maven

Gap	Hit in
No public Session outside a Maven runtime: the only route is ApiRunner in maven-impl (internal), with no transporter and no way to supply a RepositorySystem or ModelResolver	resolver-ant-tasks, test fixtures everywhere
No SPI to skip or replace a mojo execution, and no lifecycle participant; Listener only observes	build-cache-extension
No plugin manager, forked-lifecycle API or mojo-parameter expression evaluator: nothing resolves, configures or runs another plugin's mojo, so a Maven 4 site plugin cannot run reports (confirmed from inside a plugin realm)	build-cache-extension, plugin-tools, site
Mojo-descriptor model lacks threadSafe, instantiationStrategy, executionStrategy, requiresReports and component requirements, so it cannot carry a Maven 3 plugin.xml	plugin-tools, jdeps
PackagingProvider not honoured: packaging lookup still goes through the Sisu LifecycleMapping (#13306)	acr, rar, jmod
No MavenExecutionRequest data on Session: -e, -ff/-fae/-fn, requested (-P) profile ids, settings and toolchains file locations (-s, -gs, -t, -gt)	surefire, enforcer, javadoc
No original (pre-interpolation) model on Project, and no version resolution for plugins, report plugins and extensions (RELEASE/LATEST)	release, enforcer
No settings encryption or decryption API: a plugin cannot decrypt a {...} value it reads itself, nor re-encrypt passwords it writes into a settings.xml for a forked build	release, gpg
Resolution: no metadata resolution; RemoteRepository has no policies; no pre-managed version, declared version constraint, conflict or trail data and no parent link on Node; no way to configure conflict resolution or scope selection for a verbose collection; Project has no getArtifacts() or project references	archetype, resolver-ant-tasks, dependency-tree, dependency, enforcer, plugin-tools, surefire
No factory for Dependency, Type or Version outside a Session, and no public test fixtures	dependency-tree, mapping, plugin-tools, surefire
Toolchains: no service turns a ToolchainModel into a Toolchain inside a plugin, and a ToolchainFactory contributed by an extension is found only through the Sisu index	toolchains
JavaPathType classifies each dependency alone: no main-module-aware module-path/class-path split (addOutputDirectory is documented as not called)	jmod
A plugin cannot replace the project's POM file: Project has no setter, and the consumer POM is generated from the model	shade
DependencyCoordinatesFactory.create(Session, model.Dependency) drops scope, optional and exclusions	shade
Local repository: Session.withLocalRepository inherits the build's resolver configuration and cannot override the split layout; Project.getParent() returns reactor parents only; no settings merge; no view of the plugin's own artifacts	invoker
Session.resolveArtifact no longer fetches the POM or follows relocation; resolved dependencies come level by level rather than in tree order	dependency
Repository access: ProjectBuilder cannot build a project from coordinates (a Source request returns empty with no problem reported); Transport has no existence check; no remote-layout service	doap
Resolution ignores the includesDependencies of war, ear and rar types, and lists an artifact reached by several paths only under its nearest parent; no timestamped snapshot version on a resolved artifact; no session start time	ear
No ArtifactHandler equivalent	mapping (file-name tokens), surefire
Expressions not evaluated: ${plugin.artifactMap}, ${project.artifactMap}, ${plugin}, ${basedir}, ${session.parallel}, ${project.name}-style defaults	surefire, scm-publish, changelog
No path from Session/Project to MavenProject or RepositorySystemSession for code that still needs them	reporting-exec, reporting-impl, changelog
Mojo configuration: an XmlNode parameter drops XML attributes, also hit in checkstyle and ear (#13305); PlexusConfiguration parameters are not supported at all; MojoExecution.getPlugin().getDependencies() throws when the plugin realm comes from the cache (#13307)	antrun
A model without <name> gives a null name where Maven 3 fell back to the artifactId	site (fix belongs in the doxia-sitetools port)
Immutable model: configuration cannot populate v4 model types; builders do not clear a value set to null; the strict reader rejects <reports> and plugin <goals>	surefire, archetype
Maven 4 DI is invisible to Sisu, cannot inject an empty List, requires a value on @Named (a bare @Named is the empty key, not default), and cannot inject Sisu or Plexus components (#13326)	every port; scm-publish, changelog (ScmManager), plugin-tools (ArchiverManager, VelocityComponent), surefire (LocationManager)

In estate tooling and libraries: fixable by PR

Gap	Hit in	Fix
maven-plugin-tools writes no <resolutions>, so @Resolution fields stay null (a port that relies on it silently resolves nothing); mojo constructor injection unsupported (apache/maven-plugin-tools#1229); dependencyResolutionPathScopes not extracted; @Mojo(dependencyCollection = true) and @Execute(phase = "none") crash the generator	jdeps, acr, ejb, rar, dependency, javadoc	plugin-tools
ScmManager obtainable only through Sisu	scm-publish, changelog, release	none once #13326 lands: the port injects it through javax.inject; apache/maven-scm#1418 closed
Archivers from plexus-archiver's ServiceLoaderArchiverManager throw a NullPointerException when unpacking, because AbstractArchiver gets its ArchiverManager only by injection; plexus-archiver 4.x has no Sisu-free ArchiverManager at all	assembly, dependency	codehaus-plexus/plexus-archiver#500, merged, not yet released (issue codehaus-plexus/plexus-archiver#499)
Legacy BuildContext (org.sonatype.plexus:plexus-build-api 0.0.7) forces org.eclipse.sisu.plexus at compile scope	resources (master), acr, ejb	apache/maven-filtering#363, waiting on #12576
Dependency-reduced POM rejected by Maven 4	doxia-converter, any shaded build	apache/maven-shade-plugin#813
<proc>none</proc> in the maven-shared-components parent: the Maven 4 DI index is written by hand	every shared-component port	parent POM
Report mojos: maven-site-plugin 3.x runs only Maven 3 mojos	changelog, reporting-impl	reporting chain, see below
plugin-tools writes <requirements> from @Component fields inherited from AbstractMavenReport into a 2.0.0 plugin.xml, which rc-7 rejects for every goal of the plugin, so report and non-report goals cannot share an artifact	pmd	plugin-tools, reporting-impl
maven-shared-utils JavaTool/findTool calls the toolchain reflectively; the v4 toolchain class is not public, so it warns and silently runs the Maven JDK	jarsigner (fixed with an adapter); likely jmod, jlink, jdeps, jdeprscan	maven-shared-utils

Findings so far

• A port is rarely a type swap. The immutable Maven 4 model forced redesigns (maven-release edits the POM as a DOM; maven-shade-plugin can no longer publish its dependency-reduced POM), and three enforcer rules were removed rather than silently weakened.
• Reporting must move as a chain: doxia-sitetools → maven-site-plugin → reporting-impl → reporting-exec. Site plugin 3.x runs only Maven 3 mojos as reports, so every report goal is blocked; the non-report goals of the same plugins port.
• Maven 3 and 4 cannot share one line for ported components: Maven 4 DI (org.apache.maven.api.di) is invisible to Sisu, so every ported component needs a 3.x line while its consumers run on Maven 3.
• Not every component should adopt Maven 4 DI. indexer-core is used outside Maven (IDEs, repository managers); dropping its Maven dependency serves it better than a port.
• Green tests do not prove a port. A @Resolution field that stayed null passed every maven-rar-plugin test until an IT with real dependencies was added, and maven-shade-plugin stays green while publishing the original POM instead of the reduced one.

Filed from this work

• Changes for the Maven 3 lines that simplify the port: Simplifications for the 3.x lines #13309.
• Maven core bugs: XmlNode mojo parameters lose their XML attributes #13305 (XmlNode parameters lose attributes), PackagingProvider is ignored by DefaultPackagingRegistry #13306 (PackagingProvider ignored; fix proposed in Fix PackagingProvider lookup for project extensions #13319), MojoExecution.getPlugin().getDependencies() throws NPE when the plugin realm is cached #13307 (plugin dependencies NPE on a cached realm; fix proposed in Keep the plugin dependency node in the realm cache #13312), Maven 4 API mojos cannot inject Sisu components from their plugin realm #13326 (Maven 4 API mojos cannot inject Sisu components from their plugin realm; fix in Fix #13326: inject Sisu components from the plugin realm into Maven 4 API mojos #13327, 4.0.x in [4.0.x] Fix #13326: inject Sisu components from the plugin realm into Maven 4 API mojos #13328).
• Estate bugs: Generated factory for a Maven 4 API mojo requires a no-arg constructor maven-plugin-tools#1229 (the generated factory of a Maven 4 API mojo requires a no-arg constructor), MarkdownParser$MarkdownHtmlParser is registered as a Parser component through its bare @Named maven-doxia#1111 (MarkdownHtmlParser is registered as a Parser through its bare @Named).
• Dropped: building an ScmManager (Build an ScmManager without Sisu through ServiceLoader maven-scm#1418), the Doxia parser managers (Build the parser, parser module and macro managers through ServiceLoader maven-doxia#1110) and a CompilerManager (Build a CompilerManager through ServiceLoader codehaus-plexus/plexus-compiler#524) without Sisu. Once Maven 4 API mojos cannot inject Sisu components from their plugin realm #13326 lands, Maven 4 API mojos inject Sisu components from their plugin realm through javax.inject, as on Maven 3.
• Waiting on others: [NOT FOR MERGE] Experiment: migrate to Maven 4 BuildContext API maven-filtering#363 replaces the legacy BuildContext; it depends on Add incremental build context API and implementation #12576.
• Merged: Add Maven 4 to the CI matrix maven-shared-resources#87 builds with Maven 3 and 4; Unpack archived file sets in archivers created without a container codehaus-plexus/plexus-archiver#500 lets archivers created without a container unpack (issue Archivers created without a container fail in addArchivedFileSet codehaus-plexus/plexus-archiver#499), not yet released.

Components

Counts are src/main files importing the Maven 3 API on the default branch, excluding a plugin's own org.apache.maven.plugins.* packages; for the shared components the count is imports. For repositories that hold both a library and a plugin (surefire, release, enforcer, plugin-tools, archetype, scm, jxr, wrapper), only the library modules are counted and ported; the plugin modules are consumers.

Migration needed

Component	Maven 3 API use	PR	Status
maven-acr-plugin	1		ported, green locally (4 ITs); app-client packaging still registered through Plexus components.xml: rc-7 ignores PackagingProvider
maven-antrun-plugin	7		ported, green locally (4 unit, 29 ITs); Ant reference maven.project is now the v4 Project, maven.project.helper removed
maven-archetype	archetype-common 11		partial: archetype-common ported; archetype plugin excluded, does not compile; remote catalog loses cache and update policy
maven-artifact-plugin	11		partial: 25 unit tests; ITs 13 → 12 passed (buildinfo-dir: a pom project has no main artifact); check-buildplan approximated with no execution-plan service; reproducible-central report blocked by the reporting chain
maven-assembly-plugin	21		ported, green locally (271 unit, 156 ITs; the one failing IT is excluded from run-its by the POM); needs an unreleased plexus-archiver: its archivers cannot unpack without a container
maven-build-cache-extension	31	apache/maven-build-cache-extension#544	✅ completed: migration not needed; PR closed as wontfix
maven-changelog-plugin	3		blocked: compiles, but maven-site-plugin 3.x cannot run a v4 report mojo (Cannot cast ChangeLogReportFactory to org.apache.maven.plugin.Mojo); ITs 4 of 4 → 0 of 4
maven-changes-plugin	28		partial: the four non-report goals ported (54 unit tests, 16 ITs incl. 11 new); report goals excluded
maven-checkstyle-plugin	8		partial: check ported (16 unit, 30 ITs; 4 ITs no longer run the report first); report goals blocked, 19 report ITs excluded; plexus-resources built without Sisu
maven-common-artifact-filters	16	apache/maven-common-artifact-filters#130	✅ completed: migration not needed; PR closed as wontfix
maven-dependency-analyzer	14	apache/maven-dependency-analyzer#305	✅ completed: migration not needed; PR closed as wontfix
maven-dependency-plugin	75		partial: 25 of 29 goals ported (174 unit tests; about 265 Maven 3 harness tests excluded, not deleted); add, remove, list-repositories, analyze-report have no route; tree -Dverbose loses conflict data
maven-dependency-tree	12	apache/maven-dependency-tree#149	✅ completed: migration not needed; PR closed as wontfix
maven-doap-plugin	3		ported, green locally (15 unit, 4 ITs); five behavioural approximations: repository policies, metadata, existence checks
maven-doxia-sitetools	5 (integration-tools, site-renderer)	apache/maven-doxia-sitetools#701	✅ completed: migration not needed; PR closed as wontfix
maven-ear-plugin	20		partial: 49 unit tests, 103 EarMojoIT cases and 17 of 18 ITs pass; skinny-wars-timestamp fails (no timestamped snapshot version); includesDependencies ignored by the resolver
maven-ejb-plugin	1		ported, green locally (36 unit, 9 ITs); needs sisu.plexus at compile scope for the legacy BuildContext, as maven-resources-plugin does
maven-enforcer	enforcer-rules 38, enforcer-api 2, enforcer-extension 1		partial: api and rules ported (347 tests, 0 failures); 3 rules removed for lack of API (requireUpperBoundDeps, banDynamicVersions, requireProfileIdsExist); plugin and extension excluded
maven-gpg-plugin	9		partial: green locally (13 ITs + 4 Bouncy Castle ITs; gpg signer ITs not runnable here); encrypted {...} passphrases have no API route and now fail explicitly
maven-help-plugin	12		ported, green locally (61 unit, 36 ITs); describe prefix lookup and evaluate rebuilt without a plugin manager or expression evaluator; effective-pom properties now sorted
maven-indexer	indexer-core 3		partial: indexer-core ported (model only); indexer-cli and search-backend-indexer still wired through Sisu and fail at runtime
maven-invoker-plugin	18		partial: 67 unit tests; 70 of 71 ITs run pass (22 not run); MINVOKER-377 fails because an alternate local repository cannot override the split layout; report goal blocked by the reporting chain
maven-jarsigner-plugin	3		ported, green locally (52 unit, 9 ITs); settings decryption rebuilt from plexus-sec-dispatcher internals
maven-javadoc-plugin	24		partial: every goal runs directly (75 unit tests; ITs 79 → 75 passed, the 4 new failures are mvn site runs); as a site report blocked by the reporting chain
maven-jdeprscan-plugin	5		ported, green locally (6 unit, 6 ITs)
maven-jdeps-plugin	3		ported, green locally (11 unit, 7 ITs); @Resolution fields stay null because plugin-tools writes no <resolutions>
maven-jlink-plugin	5		ported, green locally (17 unit, 28 ITs); module path now from DependencyResolver, LocationManager dropped
maven-jmod-plugin	5		ported, green locally (18 ITs); main-module-aware module path still from plexus-java LocationManager
maven-mapping	1	apache/maven-mapping#77	✅ completed: migration not needed; PR closed as wontfix
maven-plugin-tools	tools-api 13, annotations 4, generators 3		partial: all but the descriptor model ported; maven-plugin-plugin and plugin-report excluded, do not compile
maven-pmd-plugin	26		partial: check goals ported (20 unit, 5 new ITs); report goals blocked; check depended on the report only through @Execute, now removed
maven-project-info-reports-plugin	26		blocked: every goal is a report; ProjectBuilder cannot build a project from a repository artifact, and conflict data exists only as text
maven-rar-plugin	4		ported, green locally (4 ITs, one new covering dependencies); rar packaging still registered through Maven 3 components
maven-release	release-manager 59, release-api 7, oddeven-policy 1		partial: libraries ported (791 tests, 0 failures); immutable model forced a DOM-editing redesign; maven-release-plugin excluded, does not compile
maven-remote-resources-plugin	8		ported, green locally (11 unit, 9 + 7 ITs); supplemental-model merging reduced; a project resource can no longer exclude a bundle resource
maven-reporting-exec	21	apache/maven-reporting-exec#167	✅ completed: migration not needed; PR closed as wontfix
maven-reporting-impl	8	apache/maven-reporting-impl#254	✅ completed: migration not needed; PR closed as wontfix
maven-resolver-ant-tasks	10		partial: model and settings ported; relies on internal ApiRunner for a Session outside Maven
maven-scm-publish-plugin	2		ported, green locally (5 ITs); ScmManager built from the Sisu index by hand, maven-scm has no non-Sisu factory
maven-scripting-plugin	4		ported, green locally (5 ITs); script binding project is now the v4 Project
maven-shade-plugin	10		partial: green locally (72 unit, 85 ITs), but the dependency-reduced POM can no longer become the published POM (the original is installed); transformer SPI unchanged, Shader SPI changes
maven-shared-jar	4	apache/maven-shared-jar#182	✅ completed: migration not needed; PR closed as wontfix
maven-site-plugin	24		partial: 10 goals run (deploy, stage, effective-site, attach-descriptor fully; site, jar, run without reports); 40 of 62 ITs, the other 22 lose report pages; reports need a plugin-manager API
maven-surefire	maven-surefire-common 8; the forked-JVM modules use none		partial: maven-surefire-common ported; it holds the mojo base class, so surefire and failsafe plugins cannot move separately
maven-toolchains-plugin	9		ported, green locally (8 ITs); an extension's toolchain factory is found only through the Sisu index

✅ Migration not needed: no Maven API used

16 components

These use no import from Maven core, model, plugin or artifact packages and no org.apache.maven:* dependency (Doxia is not Maven API). They work on Maven 4 as they are; the branch only switches CI to Maven 4.

Component	PR	Status
maven-archetypes		green locally, 18 archetype builds; only archetype templates use the Maven API
maven-doxia	apache/maven-doxia#1109	✅ completed: migration not needed; PR closed as wontfix
maven-doxia-converter	apache/maven-doxia-converter#165	✅ completed: migration not needed; PR closed as wontfix
maven-executor		green locally, 62 tests
maven-file-management	apache/maven-file-management#119	✅ completed: migration not needed; PR closed as wontfix
maven-fluido-skin	apache/maven-fluido-skin#351	✅ completed: migration not needed; PR closed as wontfix
maven-invoker	apache/maven-invoker#189	✅ completed: migration not needed; PR closed as wontfix
maven-jarsigner	apache/maven-jarsigner#117	✅ completed: migration not needed; PR closed as wontfix
maven-jxr		✅ completed: migration not needed; only maven-jxr-plugin uses the Maven API (34 tests green on Maven 4)
maven-reporting-api	apache/maven-reporting-api#88	✅ completed: migration not needed; PR closed as wontfix
maven-scm		green locally, 340 tests; only maven-scm-plugin uses the Maven API
maven-script-interpreter	apache/maven-script-interpreter#223	✅ completed: migration not needed; PR closed as wontfix
maven-shared-resources	apache/maven-shared-resources#89	✅ completed: migration not needed; PR closed as wontfix
maven-shared-utils	apache/maven-shared-utils#442	✅ completed: migration not needed; PR closed as wontfix
maven-wagon		green locally, 1035 tests
maven-wrapper		green locally, 34 tests; only maven-wrapper-plugin uses the Maven API

✅ Already on the Maven 4 API

5 entries

• maven-archiver and maven-filtering: CI pinned to rc-6 dropped (Build with the shared workflow's Maven 4 version instead of rc-6 maven-archiver#416, Build with the shared workflow's Maven 4 version instead of rc-6 maven-filtering#411, both merged)
• maven-xinclude-extension
• maven-mvnd (its mavenVersion is still 4.0.0-rc-6)
• maven-clean-plugin, maven-compiler-plugin, maven-deploy-plugin, maven-install-plugin, maven-jar-plugin, maven-resources-plugin and maven-source-plugin on master, each with a -3.x maintenance branch
• maven-war-plugin on its 4.0.x branch (master is still 3.x)

The 2022 mvn4 prototype branches, written against an earlier API, were checked against the agent/mvn4-api ports and deleted (61 branches).

Out of scope: maven (core), maven-integration-testing and maven-resolver (core or below it); maven-verifier (superseded by maven-executor); maven-shared-incremental (retirement vote open) and maven-shared-io (retired); maven-doxia-linkcheck and maven-default-skin (archived); maven-plugin-testing (master is empty); parent POMs, maven-apache-resources, maven-gh-actions-shared, maven-site, maven-sources and maven-dist-tool (no library code).

Related: #12709 (minimum Maven baseline).

[slachiewicz]

maven-shared-utils

Completed: migration to the Maven 4 API not needed; apache/maven-shared-utils#442 closed as wontfix.

PR: apache/maven-shared-utils#442 (CI only)

✅ Migration not needed: no Maven API used (no org.apache.maven import outside its own packages, no org.apache.maven dependency).

No Maven API in src/main; nothing to port. CI switched to maven4-build.
Verified locally: mvn verify with Maven 4.0.0-rc-7, JDK 21 → 803 tests, 0 failures, 19 skipped.

[slachiewicz]

maven-file-management

Completed: migration to the Maven 4 API not needed; apache/maven-file-management#119 closed as wontfix.

PR: apache/maven-file-management#119 (CI only)

✅ Migration not needed: no Maven API used (no org.apache.maven import outside its own packages, no org.apache.maven dependency).

No Maven API in src/main; nothing to port. CI switched to maven4-build.
Verified locally: mvn verify with Maven 4.0.0-rc-7, JDK 21 → 14 tests, 0 failures.

[slachiewicz]

maven-invoker

Completed: migration to the Maven 4 API not needed; apache/maven-invoker#189 closed as wontfix.

PR: apache/maven-invoker#189 (CI only)

✅ Migration not needed: no Maven API used (no org.apache.maven import outside its own packages, no org.apache.maven dependency).

No Maven API in src/main; nothing to port. CI switched to maven4-build.
Verified locally: mvn verify with Maven 4.0.0-rc-7, JDK 21 → 108 tests, 0 failures, 1 skipped.

[slachiewicz]

maven-jarsigner

Completed: migration to the Maven 4 API not needed; apache/maven-jarsigner#117 closed as wontfix.

PR: apache/maven-jarsigner#117 (CI only)

✅ Migration not needed: no Maven API used (no org.apache.maven import outside its own packages, no org.apache.maven dependency).

No Maven API in src/main; nothing to port. CI switched to maven4-build.
Verified locally: mvn verify with Maven 4.0.0-rc-7, JDK 21 → 13 tests, 0 failures.

[slachiewicz]

maven-script-interpreter

Completed: migration to the Maven 4 API not needed; apache/maven-script-interpreter#223 closed as wontfix.

PR: apache/maven-script-interpreter#223 (CI only)

✅ Migration not needed: no Maven API used (no org.apache.maven import outside its own packages, no org.apache.maven dependency).

No Maven API in src/main; nothing to port. CI switched to maven4-build.
Verified locally: mvn verify with Maven 4.0.0-rc-7, JDK 21 → 35 tests, 0 failures.

[slachiewicz]

maven-shared-resources

Completed: migration to the Maven 4 API not needed; apache/maven-shared-resources#89 closed as wontfix.

PR: apache/maven-shared-resources#89 (CI only; supersedes apache/maven-shared-resources#87)

✅ Migration not needed: no Maven API used (no org.apache.maven import outside its own packages, no org.apache.maven dependency).

Resource bundle only, no Java code. CI switched to maven4-build.
Verified locally: mvn verify with Maven 4.0.0-rc-7, JDK 21 → BUILD SUCCESS (no tests).

[slachiewicz]

maven-archiver

PR: apache/maven-archiver#416 (CI pin only)

Already on the Maven 4 API on master. CI pinned maven4-version: 4.0.0-rc-6 while the project compiles against rc-7 since apache/maven-archiver#408; the PR drops the pin.
Verified locally: mvn verify with Maven 4.0.0-rc-7, JDK 21 → 97 tests, 0 failures.

[slachiewicz]

maven-filtering

PR: apache/maven-filtering#411 (CI pin only)

Already on the Maven 4 API on master. CI pinned maven4-version: 4.0.0-rc-6 while the project compiles against rc-7 since apache/maven-filtering#402; the PR drops the pin.
Verified locally: mvn verify with Maven 4.0.0-rc-7, JDK 21 → 137 tests, 0 failures.

[slachiewicz]

maven-reporting-api

Completed: migration to the Maven 4 API not needed; apache/maven-reporting-api#88 closed as wontfix.

PR: apache/maven-reporting-api#88 (CI only)

✅ Migration not needed: no Maven API used. src/main imports only the Doxia sink API (Sink, SinkFactory), and the only dependency is doxia-sink-api.

Optional cleanup, not required for Maven 4: the Plexus lookup constant MavenReport.ROLE has no users in the plugins, shared components or Doxia; removing it would be a breaking change for a major release only.
Verified locally: mvn verify with Maven 4.0.0-rc-7, JDK 21 → BUILD SUCCESS (no tests).

[slachiewicz]

maven-shared-jar

PR: apache/maven-shared-jar#182. Status: ported, 4.0.0-SNAPSHOT, Java 17.

Verified locally: mvn verify with Maven 4.0.0-rc-7, JDK 21 → 91 tests before and after, 0 failures; spotless clean.

Public API changes

• RepositoryHashSearch.searchFileHash/searchBytecodeHash (and EmptyRepositoryHashSearch): List<org.apache.maven.artifact.Artifact> → List<org.apache.maven.api.Artifact>.
• EmbeddedMavenModelExposer gains an injected ModelXmlFactory and reads the POM into the immutable v4 Model.
• @Named/@Singleton/@Inject move from javax.inject to org.apache.maven.api.di, so Sisu no longer discovers these components; they cannot be injected under Maven 3.
• JarAnalyzer, JarData, JarClasses*, JarIdentification* unchanged.

Gaps

• maven-shared-components parent sets <proc>none</proc>, so the maven-api-di index processor never runs; META-INF/maven/org.apache.maven.api.di.Inject is maintained by hand (as maven-filtering does). A new @Named class missing from it fails with "No binding".
• ModelXmlFactory is implemented only in maven-impl, so the model exposer needs a Maven 4 container; the v4 MavenStaxReader lives in maven-support, which is not API.

Consumers that break: maven-project-info-reports-plugin (DependenciesReport injects JarClassesAnalysis; Dependencies, DependenciesRenderer use unchanged types). It compiles, but under Maven 3 the component is no longer found.

Improvements: drops javax.inject, sisu-maven-plugin, plexus-xml, maven-model, maven-artifact.

Recommendation: port for Maven 4 plugins; keep a 3.x line while project-info-reports runs on Maven 3.

[slachiewicz]

maven-mapping

PR: apache/maven-mapping#77. Status: ported, 4.0.0-SNAPSHOT, Java 17.

Verified locally: mvn verify with Maven 4.0.0-rc-7, JDK 21 → 8 tests before, 10 after (new: timestamped SNAPSHOT baseVersion, non-jar extension), 0 failures; spotless clean.

Public API change: MappingUtils.evaluateFileNameMapping(String, org.apache.maven.artifact.Artifact) → (String, org.apache.maven.api.Artifact). Dependencies drop to maven-api-core only.

Gaps: tokens that no longer resolve

• The v4 Artifact has no ArtifactHandler: @{packaging}@, @{language}@, @{directory}@, @{addedToClasspath}@, @{includesDependencies}@ are gone. @{extension}@ now comes from Artifact.getExtension().
• No counterpart for the reflective @{type}@, @{scope}@, @{file}@. The path is available only via ArtifactManager or DownloadedArtifact.
• No plugin source or site doc in the estate uses the removed tokens; user POMs are unknown.
• Tests use a record stub because Session.createArtifact needs an InternalSession, so no public test fixture exists for a v4 Artifact.

Consumers that break (compile): maven-war-plugin AbstractWarPackagingTask; maven-ear-plugin EarMojo, AbstractEarModule. Both must move to the v4 Artifact together.

Recommendation: port; small change and every commonly used token keeps a source. Keep 3.x for the Maven 3 lines of war and ear.

[slachiewicz]

maven-reporting-exec

PR: apache/maven-reporting-exec#167. Status: partial, 3.0.0-SNAPSHOT, Java 17. Public API ported; implementation stays on maven-core.

Verified locally: mvn verify with Maven 4.0.0-rc-7, JDK 21 → 4 unit tests, 0 failures; ITs 0 of 5 pass (5 before). Every IT runs the released maven-site-plugin 3.22.0 against this snapshot and fails with NoSuchMethodError: MavenReportExecutorRequest.setMavenSession(MavenSession). Spotless clean.

Public API changes

• MavenReportExecutorRequest: get/setMavenSession(MavenSession) → get/setSession(org.apache.maven.api.Session); get/setProject(MavenProject) → org.apache.maven.api.Project; setReportPlugins(org.apache.maven.model.ReportPlugin[]) → org.apache.maven.api.model.ReportPlugin[].
• MavenReportExecution: Plugin → org.apache.maven.api.model.Plugin.
• MavenReportExecutor.buildMavenReports throws unchecked MojoException instead of checked MojoExecutionException.

Gaps: the v4 API has no equivalent for what this component does

• MavenPluginManager, PluginDescriptor, MojoDescriptor, MojoExecution, PluginVersionResolver, plugin realm setup, and LifecycleExecutor.calculateForkedExecutions/executeForkedExecutions. DefaultMavenReportExecutor and MavenPluginManagerHelper therefore stay on maven-core.
• Session → MavenSession and Project → MavenProject only via internal classes (InternalMavenSession.from(...), DefaultProject.getProject()).
• MavenProject.isExecutionRoot() has no equivalent; Project.isRootProject() means the .mvn directory. This affects canAggregate.
• Tests stay on @PlexusTest, since maven-testing targets v4-DI mojos. They need maven-compat for ToolchainManager and plexus-xml 4.2.0, because parent 50 manages 3.0.1, which fails with NoClassDefFoundError: Xpp3Dom$ChildrenTracking on Maven 4.

Consumers that break: maven-site-plugin only (AbstractSiteRenderingMojo, AutoRefreshMojo, SiteMojo, SiteJarMojo, SiteRunMojo, ReportDocumentRenderer); shown at runtime by the ITs above.

Recommendation: keep a 3.x line; this port is a facade only. A real Maven 4 version needs a report-execution or plugin-manager API in org.apache.maven.api. If the Maven 4 site plugin gets one, retire this component in its favour.

[slachiewicz]

maven-common-artifact-filters

PR: apache/maven-common-artifact-filters#130. Status: ported, one feature removed, 4.0.0-SNAPSHOT, Java 17.

Verified locally: mvn verify with Maven 4.0.0-rc-7, JDK 21 → 231 tests before, 226 after, 0 failures. Six tests covered the removed actTransitively; one is new. Spotless clean.

Public API changes

• ArtifactFilter → Predicate<org.apache.maven.api.Dependency> in Pattern{In,Ex}cludesArtifactFilter, Strict*, ScopeArtifactFilter and ArtifactIncludeFilterTransformer.
• collection.* filters work on Set<Dependency> instead of Set<Artifact>.
• Pattern{In,Ex}cludesArtifactFilter(Collection, boolean actTransitively) removed.
• ArtifactTransitivityFilter(Artifact, ProjectBuildingRequest, ProjectBuilder) → (Session, Artifact), collecting via TEST_RUNTIME; this approximates the old project-build resolution.
• resolve.Node.getDependency() returns the immutable org.apache.maven.api.model.Dependency.
• The EclipseAether* transformers stay on the resolver API; nothing in org.apache.maven.api models exclusions on a DependencyFilter.

Gaps

• No dependency trail or parent link on Artifact, Dependency or Node, so actTransitively is removed. This is the largest loss; maven-assembly-plugin useTransitiveFiltering depends on it.
• Version ranges: VersionParser is only reachable through a Session, and filters are built without one; the port uses resolver-util GenericVersionScheme.
• type, scope and optional live only on Dependency, so every filter moves from Artifact to Dependency.
• No public factory for Dependency, Type or Version without a Session; tests and consumers need stubs or Mockito.
• The new scopes (COMPILE_ONLY, TEST_ONLY, TEST_RUNTIME) have no defined behaviour in ScopeArtifactFilter; they are included, like unknown scopes before.

Consumers that break (compile): maven-dependency-plugin, maven-assembly-plugin, maven-javadoc-plugin (ResourceResolver), maven-project-info-reports-plugin, maven-remote-resources-plugin, maven-surefire-common.

Recommendation: port for 4.0.0 alongside a 3.x line, once a parent-aware replacement for actTransitively is agreed.