slachiewicz opened a new issue, #12768: URL: https://github.com/apache/maven/issues/12768
Webtide announced in [jetty/jetty.project#13918](https://github.com/jetty/jetty.project/issues/13918) that Jetty 9, 10 and 11 — and CometD 5, 6 and 7 — stopped being published to Maven Central on 1 January 2026. This issue records where the Maven estate still uses those lines, and what each repository can actually do about it. ## What this does and does not mean Nothing breaks. Every Jetty artifact already on Central stays there, so no build fails and no release is blocked. What ends is the supply of new releases: Jetty 9.4 finished at `9.4.58.v20250814`, Jetty 10 at `10.0.26`, Jetty 11 at `11.0.26`. A CVE found in any of those lines will not be fixed publicly. The exposure that matters is therefore the Jetty we put on a user's classpath, not the Jetty we compile our own tests against. ## Where we still use an EOL line | Repository | Artifacts | Version | Scope | Exposure | |---|---|---|---|---| | maven-site-plugin | `org.eclipse.jetty:jetty-server`, `-http`, `-servlet`, `-webapp`, `-util` | 9.4.58.v20250814 | **compile** | Shipped to users; backs `site:run` | | maven-wagon | `org.eclipse.jetty.aggregate:jetty-all` | 9.2.30.v20200428 | **compile** in `wagon-provider-test` and `wagon-tck-http`, test in the four providers | Both are published artifacts, so the uber-jar reaches the compile classpath of anything built against them | | maven-indexer | `org.eclipse.jetty:jetty-webapp` | 10.0.24 | test | Build only | | maven-javadoc-plugin | `jetty-server`, `-proxy`, `-servlet`, `-util` | 9.4.55.v20240627 | test | Build only | | maven-dependency-plugin | `jetty-server`, `-util`, `-security` | 9.4.58.v20250814 | test | Build only | Already on a supported line, nothing to do: maven-resolver (12.1.11, including `maven-resolver-transport-jetty`), the core IT suite on master and 4.0.x (12.1.12), and maven-dist-tool (12.1.12). Deliberately left alone: the Maven 3 core IT suite (9.4.50, frozen line) and the `jetty-war-test-passing` / `jetty-war-test-failing` integration-test fixtures in maven-surefire (9.2.2.v20140723). Both are self-contained build fixtures on lines nobody is being asked to support. Adjacent, but outside this announcement: maven-project-info-reports-plugin has a test dependency on `org.mortbay.jetty:jetty:6.1.26`, and maven-archetype carries the same coordinates in `pluginManagement` and in the `webapp` archetype sample, so generated projects inherit it. Jetty 6 has been dead far longer than 9.4; that deserves its own cleanup rather than being folded in here. CometD: no usage anywhere in the estate. ## Two constraints, not one **Jetty 12 needs Java 17.** | Jetty line | Class file major | Requires | |---|---|---| | 9.4 | 52 | Java 8 | | 10.x, 11.x | 55 | Java 11 | | 12.0, 12.1 | 61 | **Java 17** | `Verified: read the class file major version of org.eclipse.jetty.server.Server from each jetty-server release on Central → 52 / 55 / 61` maven-site-plugin, maven-dependency-plugin, maven-javadoc-plugin and maven-wagon all build with `javaVersion` 8; maven-indexer uses 11. **JDK 8 is still in the CI matrix.** This is the sharper of the two, because it closes the obvious escape hatch. Test-scope Jetty does not have to obey the shipped baseline — `maven.compiler.testRelease` can be set independently — but it does have to compile and run on every JDK in the build matrix. The shared workflow defaults to `[ "21", "25", "8" ]`, which maven-site-plugin, maven-dependency-plugin and maven-wagon inherit, and maven-javadoc-plugin pins `[ "17", "21", "8", "25" ]`. While JDK 8 is in that list, Jetty 12 cannot enter the build in *any* scope. maven-indexer is the exception: it already pins `[ "17", "21" ]`, which is why it is the one repository that can move today. Two things that are *not* blockers, to head off the obvious objections: - The servlet API is not the problem. Jetty 12 still ships a `javax.servlet` environment as `org.eclipse.jetty.ee8:*`, current at 12.1.12, so a port does not force `jakarta.servlet`. - It is still a port, not a version bump. `org.eclipse.jetty:jetty-webapp` does not exist above the 11 line; the Jetty 12 equivalent is `org.eclipse.jetty.ee8:jetty-ee8-webapp` (or `ee10`/`ee11`), and the handler API changed underneath it — `HandlerList` and friends are gone. ## Plan Test-scope usage is low priority: the worst case is an unpatched CVE inside our own build, and where a newer release of the same line exists, taking it is free. Compile-scope usage in maven-site-plugin and maven-wagon is where the real work is, and the two cases need different answers — `site:run` has an option that removes the dependency altogether, while wagon genuinely needs a Jetty on the compile classpath because `HttpWagonTestCase` builds servers in `src/main/java`. Per-repository detail: <!--CHILDREN--> *This issue was created with AI assistance.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
