Require Maven 3.6.3

[TheSnoozer]

Describe the question / problem (required)

https://maven.apache.org/docs/history.html
Maven before 3.6.3 has now reached its end of life. New plugin releases will require Maven 3.6.3 or later.

Context (optional)

No response

[hazendaz]

Maven assembly plugin is voting now and required 3.6.3. I'm sure others may already too. So worth going for. I don't know that major jumps really mean much. Maven isn't jumping major revisions but they are also having heated discussions on plugin version numbers between maven 3 and 4.

I wonder how many actually really use such an old version anyways. I work for a company with 52k developers and we already dumped anything before maven 3.8.8.

[TheSnoozer]

Thanks for your insights!
Yeah that is I guess always a problem that you don't really have any insights on what the users of your tools use, or how they use it. You never know if there is some weird old workflow hiding on some svn repository somewhere.

So everytime a default value, or the require maven version changes it is technically a breaking change in the plugin. I don't have any issues to require maven 3.6.3. In fact I'll do that with the next major breaking change.

Perhaps there are better statistics about this, but I recently stumbled over those https://github.com/jvm-repo-rebuild/reproducible-central?tab=readme-ov-file#tool-x-jdk-statistics. That is a project that attempts to check if a published project (like this) is a reproducible build. For those porjects (yours seem to be there too) it records the maven/java version used....

[TheSnoozer]

Maven plugins now require this version:

#727
https://github.com/git-commit-id/git-commit-id-maven-plugin/actions/runs/8417333148/job/23045614959?pr=727

Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.13.0:compile (default-compile) on project git-commit-id-maven-plugin: The plugin org.apache.maven.plugins:maven-compiler-plugin:3.13.0 requires Maven version 3.6.3 -> [Help 1]

[hazendaz]

Thanks for your insights! Yeah that is I guess always a problem that you don't really have any insights on what the users of your tools use, or how they use it. You never know if there is some weird old workflow hiding on some svn repository somewhere.

So everytime a default value, or the require maven version changes it is technically a breaking change in the plugin. I don't have any issues to require maven 3.6.3. In fact I'll do that with the next major breaking change.

Perhaps there are better statistics about this, but I recently stumbled over those https://github.com/jvm-repo-rebuild/reproducible-central?tab=readme-ov-file#tool-x-jdk-statistics. That is a project that attempts to check if a published project (like this) is a reproducible build. For those porjects (yours seem to be there too) it records the maven/java version used....

I think their stats are based on what was used to release. All mine should be maven 3.9.6 + jdk 21 when I'm running releases. I think they read that from the metadata and not necessarily users might be using. I've also started bumping my plugins up to 3.6.3 on patch releases. I think for most part no one would notice much post 3.6 until they get to 3.9. At that point it might differ some what. Anyway, I'm just glad maven is formally dropping old versions.

FWIW in the past when I went to fast say on spotbugs-maven-plugin, I ended up relaxing back after I got feedback from community of it being too strict due to systems I'm not aware of. Having said that, looking there now I still had it on 3.3.9 currently and have a GHA to run that, that now fails due to Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.13.0:compile (default-compile) on project spotbugs-maven-plugin: The plugin org.apache.maven.plugins:maven-compiler-plugin:3.13.0 requires Maven version 3.6.3 -> [Help 1]. So maven did minor release but still, I'll start bumping things up. I'll let you know how spotbugs maven plugin handles doing so.

[TheSnoozer]

Now theorg.apache.maven.plugins:maven-jar-plugin joins the party and requires Maven version 3.6.3.
See: #735

Time to require this too.