Skip to content

[4.0.x] [GH-11772] Fail-fast consumer POM validation for non-4.0.0 model versions#12236

Merged
gnodet merged 1 commit into
apache:maven-4.0.xfrom
gnodet:cherry-pick-11780-to-4.0.x
Jun 4, 2026
Merged

[4.0.x] [GH-11772] Fail-fast consumer POM validation for non-4.0.0 model versions#12236
gnodet merged 1 commit into
apache:maven-4.0.xfrom
gnodet:cherry-pick-11780-to-4.0.x

Conversation

@gnodet

@gnodet gnodet commented Jun 4, 2026

Copy link
Copy Markdown
Contributor

Cherry-pick of #11780

Adaptation for 4.0.x:

  • Removed deployBuildPom() method (constant not yet on 4.0.x)
  • Added missing MavenException import
  • Added super("[4.0.0-rc-1,)") constructor to IT test

…l versions (apache#11780)

* [apacheGH-11772] Fail-fast consumer POM validation for non-4.0.0 model versions

When a POM-packaged project (parent POM) uses Maven 4.1.0 features
like profile conditions that cannot be stripped during consumer POM
transformation, the build now fails fast with actionable guidance
instead of silently deploying a consumer POM that Maven 3 and Gradle
cannot resolve.

The validation applies only to:
- POM-packaged projects (parent POMs) on the non-flatten path
- Projects without preserve.model.version=true

Also adds a maven.consumer.pom.removeUnusedManagedDependencies property
(default: true) to control whether unused managed dependencies are
removed during consumer POM flattening.

* Refactor consumer POM validation error message to use text blocks

Convert string concatenation in the consumer POM model version validation
error message to use Java text blocks for improved readability and
maintainability. The multi-line error message is now expressed as a
text block with .formatted() for parameter substitution.

This change affects the validation that ensures POM-packaged projects
can be downgraded to model version 4.0.0 for Maven 3/Gradle compatibility.

* Fix Spotless formatting violation

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Code <claude@anthropic.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
@gnodet
gnodet merged commit f927773 into apache:maven-4.0.x Jun 4, 2026
@github-actions github-actions Bot added this to the 4.0.0-rc-6 milestone Jun 4, 2026
@github-actions

github-actions Bot commented Jun 4, 2026

Copy link
Copy Markdown

@gnodet Please assign appropriate label to PR according to the type of change.

@ascheman

Copy link
Copy Markdown
Contributor

Real-world adopter feedback — tested apache/plc4x against a current 4.0.x SNAPSHOT (pre-RC-6). Posting here since this backport first ships with RC-6.

The fail-fast works as designed: PLC4X's parent POM (model 4.1.0, using <subprojects> and build <sources> — the latter on this PR's non-strippable list) now stops the very first reactor module on install, where rc-5 "succeeded" but silently installed a model-4.1.0 consumer POM — exactly the #11772 poison. Root-module matrix:

Maven mvn -N install
4.0.0-rc-5 SUCCESS (but consumer POM stays 4.1.0)
4.0.x-SNAPSHOT fail-fast ✔
4.0.x-SNAPSHOT + maven.consumer.pom.flatten=true SUCCESS

With the flatten property in .mvn/maven.config we then ran a full A/B (identical sources, separate local repos, tests on): rc-5 and the SNAPSHOT are behaviorally identical — 113 modules, 4058/4058 tests green on both, identical installed file lists (156), identical consumer-POM model distribution per artifact (28× self-contained 4.0.0, 1× 4.0.0 with parent, 2× 4.1.0 with parent for the pom-packaged aggregators). So the fail-fast is the only rc-5 → RC-6 behavior change here, and the suggested remedy is safe on both versions.

Three observations that may be worth acting on before RC-6:

  1. Release notes: our Maven 4 adoption registry currently tracks ~70–85 GitHub projects declaring the 4.1.0 model (report). Every one of them that installs/deploys a parent POM with non-strippable 4.1.0 features will hard-fail on RC-6 upgrade. A release-notes callout with the three remedies from the error message would soften the landing considerably.

  2. The error text slightly over-promises for pom packaging: option 1 says enabling flattening will "produce a self-contained 4.0.0 consumer POM", but with flattening enabled the pom-packaged project's own consumer POM is still published as model 4.1.0 with <parent> and <subprojects> (identically on rc-5, so not a regression). Children are correctly flattened and no longer reference it — but direct consumers inheriting from such a parent would still hit Consumer POM of parent POMs currently remain at modelVersion 4.1.0, breaking Maven 3 and Gradle consumers #11772-style breakage. If "handles what it can" is the intended semantics, maybe adjust the error text and document the residual limitation.

  3. As a data point for how adopters need to react: PLC4X is now prepared via Enable consumer POM flattening for Maven 4 RC-6 readiness plc4x#2647 (one line in .mvn/maven.config, verified against rc-5 and the SNAPSHOT).

Happy to re-run this against RC-6 staging when it's cut.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport bug Something isn't working mvn40

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants