MartijnVisser opened a new pull request, #29009: URL: https://github.com/apache/flink/pull/29009
## What is the purpose of the change Bumps the build/enforced Maven version from 3.8.6 to 3.9.16, as discussed and agreed on dev@ (https://lists.apache.org/thread/g0fkfw6lrz0clk1jr0j650tht9m5drlf) and tracked in [FLINK-40459](https://issues.apache.org/jira/browse/FLINK-40459). This was left open when the Apache Parent POM 35 was adopted (FLINK-39427); moving to Maven 3.9 is a prerequisite for adopting Apache Parent POM 36+. ## Brief change log - `pom.xml`: the `enforce-maven` execution's `requireMavenVersion` pin goes from `[3.8.6]` to `[3.9.16]` (exact pin retained, no other enforcer rule touched) - `.mvn/wrapper/maven-wrapper.properties`: `distributionUrl` and `distributionSha256Sum` updated to Apache Maven 3.9.16 (the `wrapperUrl`/`wrapperSha256Sum` for maven-wrapper 3.3.2 stay as they are) - `README.md`: documented required Maven version updated to 3.9.16 - `AGENTS.md`: documented prerequisite Maven version updated to 3.9.16 - `docs/content/docs/dev/configuration/maven.md` and `docs/content.zh/docs/dev/configuration/maven.md`: documented Maven version updated to 3.9.16 - `.github/workflows/docs.sh`: the three bare `mvn` invocations now use the Maven wrapper `./mvnw` On the last point: the `apache/flink-ci-docker:...maven_386_jammy` image tags are deliberately left unchanged. All CI compile/test paths already build through the wrapper (`tools/ci/maven-utils.sh` -> `./mvnw`, used by `.github/actions/run_mvn`), so the image's baked-in Maven is unused there. `docs.sh` (run inside that image by `docs.yml` and `docs-legacy.yml`) was the only remaining bare-`mvn` consumer, so switching it to the wrapper lets this bump land self-contained, without requiring a new flink-ci-docker image first. Release scripts under `tools/releasing/` keep using the system `mvn`, which is exactly where the new pin is intended to bite: release managers must use 3.9.16. ## Verifying this change This change is a trivial rework / code cleanup without any test coverage. It was validated with a local red/green differential (3.8.6 vs 3.9.16) on JDK 17 and JDK 11, covering the full `flink-dist` reactor plus a Java 11 `-Prelease` build. The comparison showed byte-identical shaded uber-jar contents, byte-identical dependency-reduced POMs, and byte-identical aggregated `NOTICE` files. That specifically re-validates the maven-shade / immutable-dependency-tree concern from the Flink ["Dependencies" wiki page](https://cwiki.apache.org/confluence/spaces/FLINK/pages/89067294/Dependencies), which is the historical reason Flink's Maven version was pinned so conservatively: since Maven 3.3 the dependency tree is immutable during a build, so bundled dependencies can leak as transitives unless they are marked `optional`. `tools/ci/verify_bundled_optional.sh` guards that invariant and also runs through the wrapper in CI, so it re-validates the bundled/optional marking on 3.9.16 as well. The only artifact-level difference found is that the published `flink-parent` pom no longer re-inlines the release-profile plugin configuration it inherits from Apache Parent POM 35. This was verified to be cosmetic: downstream effective POMs are byte-identical either way, cross-checked against the published `flink-parent-2.3.0.pom`. Two known benign warnings appear on 3.9 and are not introduced by this change: - a Maven-4 `testCompileSourceRoots` deprecation warning (FLINK-39565 territory) - the pre-existing `maven-gpg-plugin` 1.4 `gpgArguments` warning (a separate JIRA will follow) Local verification run for this PR, all passing: - `./mvnw -version` downloads Apache Maven 3.9.16 with the wrapper's own SHA-256 verification - `./mvnw -N clean validate` -> enforcer passes - negative check with a system Maven 3.8.6: `mvn -N validate` now fails with `Detected Maven Version: 3.8.6 is not in the allowed range [3.9.16,3.9.16]` - shading-heavy smoke build: `./mvnw clean install -DskipTests -pl flink-filesystems/flink-s3-fs-hadoop -am` - fast full-reactor build: `./mvnw clean install -DskipTests -Dfast -Pskip-webui-build -T1C` ## Does this pull request potentially affect one of the following parts: - Dependencies (does it add or upgrade a dependency): **no** (build tool only, no dependency changes) - The public API, i.e., is any changed class annotated with `@Public(Evolving)`: **no** - The serializers: **no** - The runtime per-record code paths (performance sensitive): **no** - Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: **no** - The S3 file system connector: **no** ## Documentation - Does this pull request introduce a new feature? **no** - If yes, how is the feature documented? **not applicable** - the existing documentation references to the required Maven version are updated in this PR --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes (please specify the tool below) Generated-by: Claude Code (Claude Opus 5) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
