[infeo]

Maven 3.10.0 changes what ends up in the bundle that central-publishing-maven-plugin 0.11.0 uploads, and Maven Central rejects the result.

central-publishing-plugin "installs" artifacts into a staging directory laid out like a Maven repository, then zips that directory into central-bundle.zip. With maven 3.10.0 that staging directory also gets the bookkeeping files a normal local repository (~/.m2) keeps (i.e maven-metadata-local.xml). Central repo requires every directory with content to contain a .pom, and org/cryptomator/cryptofs/ has only the metadata file, leading to rejection.

There's no config workaround yet. 0.11.0 is the newest plugin version and doesn't filter these files out. No Maven property brings back the old layout, since -llr is gone. So pinning the wrapper to 3.9.16 and blocking dependabot from bumping past it is the fix for now. The issue suggests revisiting this once the plugin handles 3.10.

Sources:

• Maven 3.10.0 release notes
• Do not depend on maven-resolver-supplier-mvn3 apache/maven#13266 – Do not depend on maven-resolver-supplier-mvn3
• Central rejects release bundles built with Maven 3.10: pin 3.9.16 ctggames/yaml-flock#26 – Central rejects release bundles built with Maven 3.10: pin 3.9.16
• Maven 3.10.0 issue mavenplugins/central-publishing-maven-plugin#78 – Maven 3.10.0 issue
• ci(publish): pin Maven 3.9.16 (runner's 3.10.0 broke the Central bundle) miguelperezcolom/mateu#724 – pin Maven 3.9.16
• SchweizerischeBundesbahnen/…generic#716 – Deploy to Maven Central with Maven 3.9.16

[Copilot]

🟢 Approval recommended

The pin, checksum, and Dependabot dependency rule are consistent with the documented publishing incompatibility.

0 open findings

What changed in this PR

Pins Maven to 3.9.16 to keep Maven Central publishing compatible.

Changes:

• Downgrades Maven Wrapper from 3.10.0 to 3.9.16 with the matching checksum.
• Prevents Dependabot from upgrading Maven to 3.10.0 or later.

File	Description
.mvn/​wrapper/​maven-wrapper.properties	Pins Maven 3.9.16.
.github/​dependabot.yml	Blocks incompatible Maven upgrades.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2b2ebefe-705a-4024-b50f-8e3783a6f404

📥 Commits

Reviewing files that changed from the base of the PR and between 2e63636 and 829db23.

📒 Files selected for processing (2)

• .github/dependabot.yml
• .mvn/wrapper/maven-wrapper.properties

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

---

Walkthrough

The Maven wrapper distribution changes from version 3.10.0 to 3.9.16, and its checksum is updated. Dependabot is configured to ignore org.apache.maven:apache-maven versions 3.10.0 and later.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 829db

The release workflow uses Maven 3.9.16, avoiding the described Maven 3.10 publishing issue. The checksum and update exclusion are consistent, and no actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the primary change: pinning the Maven wrapper to version 3.9.16.
Description check	✅ Passed	The description explains the Maven 3.10.0 incompatibility with central-publishing-maven-plugin, the Maven Central rejection, and the reason for pinning Maven to 3.9.16 and blocking Dependabot upgrades…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}