Jetty 9, 10 and 11 are end of life: where the estate is exposed

[slachiewicz]

Webtide announced in jetty/jetty.project#13918 that Jetty 9, 10 and 11 — and CometD 5, 6 and 7 — stopped being published to Maven Central on 1 January 2026. This issue records where the Maven estate still uses those lines, and what each repository can actually do about it.

What this does and does not mean

Nothing breaks. Every Jetty artifact already on Central stays there, so no build fails and no release is blocked. What ends is the supply of new releases: Jetty 9.4 finished at 9.4.58.v20250814, Jetty 10 at 10.0.26, Jetty 11 at 11.0.26. A CVE found in any of those lines will not be fixed publicly.

The exposure that matters is therefore the Jetty we put on a user's classpath, not the Jetty we compile our own tests against.

Where we still use an EOL line

Repository	Artifacts	Version	Scope	Exposure
maven-site-plugin	org.eclipse.jetty:jetty-server, -http, -servlet, -webapp, -util	9.4.58.v20250814	compile	Shipped to users; backs site:run
maven-wagon	org.eclipse.jetty.aggregate:jetty-all	9.2.30.v20200428	compile in wagon-provider-test and wagon-tck-http, test in the four providers	Both are published artifacts, so the uber-jar reaches the compile classpath of anything built against them
maven-indexer	org.eclipse.jetty:jetty-webapp	10.0.24	test	Build only
maven-javadoc-plugin	jetty-server, -proxy, -servlet, -util	9.4.55.v20240627	test	Build only
maven-dependency-plugin	jetty-server, -util, -security	9.4.58.v20250814	test	Build only

Already on a supported line, nothing to do: maven-resolver (12.1.11, including maven-resolver-transport-jetty), the core IT suite on master and 4.0.x (12.1.12), and maven-dist-tool (12.1.12).

Deliberately left alone: the Maven 3 core IT suite (9.4.50), a frozen line nobody is being asked to support.

Adjacent, and outside this announcement, but found in the same sweep and filed separately: maven-project-info-reports-plugin has a test dependency on org.mortbay.jetty:jetty:6.1.26, and maven-archetype pins org.mortbay.jetty:maven-jetty-plugin:6.1.26 in pluginManagement. That coordinate ended at 6.1.26 in November 2010, so it is not a version to bump but a fixture to replace or delete. maven-surefire's jetty-war-test-passing / jetty-war-test-failing fixtures are recorded too — they pin 9.2.2.v20140723, which is inside the announcement but is an IT fixture rather than exposure.

Correction to the first version of this issue: it said generated projects inherit maven-archetype's Jetty 6 reference. They do not. The only consumer is archetype-samples, which is not a <module>, is excluded from RAT, and has a parent version that was never released — it is not built or published. The released archetypes live in apache/maven-archetypes and are unaffected.

Clean, checked and with nothing to report: maven-doxia and doxia-sitetools (the only match is an exclusion of a transitive htmlunit dependency), the plexus and sisu components, maven shared and shared-4, and maven-site. The plexus hits are hardcoded javac error-message strings inside a parser test fixture, not dependencies.

CometD: no usage anywhere in the estate.

Two constraints, not one

Jetty 12 needs Java 17.

Jetty line	Class file major	Requires
9.4	52	Java 8
10.x, 11.x	55	Java 11
12.0, 12.1	61	Java 17

Verified: read the class file major version of org.eclipse.jetty.server.Server from each jetty-server release on Central → 52 / 55 / 61

maven-site-plugin, maven-dependency-plugin, maven-javadoc-plugin and maven-wagon all build with javaVersion 8; maven-indexer uses 11.

JDK 8 is still in the CI matrix. This is the sharper of the two, because it closes the obvious escape hatch. Test-scope Jetty does not have to obey the shipped baseline — maven.compiler.testRelease can be set independently — but it does have to compile and run on every JDK in the build matrix. The shared workflow defaults to [ "21", "25", "8" ], which maven-site-plugin, maven-dependency-plugin and maven-wagon inherit, and maven-javadoc-plugin pins [ "17", "21", "8", "25" ]. While JDK 8 is in that list, Jetty 12 cannot enter the build in any scope.

maven-indexer is the exception: it already pins [ "17", "21" ], which is why it is the one repository that can move today.

Two things that are not blockers, to head off the obvious objections:

• The servlet API is not the problem. Jetty 12 still ships a javax.servlet environment as org.eclipse.jetty.ee8:*, current at 12.1.12, so a port does not force jakarta.servlet.
• It is still a port, not a version bump. org.eclipse.jetty:jetty-webapp does not exist above the 11 line; the Jetty 12 equivalent is org.eclipse.jetty.ee8:jetty-ee8-webapp (or ee10/ee11), and the handler API changed underneath it — HandlerList and friends are gone.

Plan

Test-scope usage is low priority: the worst case is an unpatched CVE inside our own build, and where a newer release of the same line exists, taking it is free. Compile-scope usage in maven-site-plugin and maven-wagon is where the real work is, and the two cases need different answers — site:run has an option that removes the dependency altogether, while wagon genuinely needs a Jetty on the compile classpath because HttpWagonTestCase builds servers in src/main/java.

Per-repository detail:

Repository	Issue	What it asks for
maven-site-plugin	apache/maven-site-plugin#1298	Decide between accepting the EOL dependency, porting to Jetty 12 after a baseline bump, or replacing the embedded container with the JDK's com.sun.net.httpserver
maven-wagon	apache/maven-wagon#943	Move off the final Jetty 9.2 release (April 2020) to the end of the 9.4 line, and stop publishing jetty-all as a compile dependency
maven-indexer	apache/maven-indexer#760	Bump to the final Jetty 10 release now; the only repository whose CI matrix already allows a Jetty 12 move
maven-javadoc-plugin	apache/maven-javadoc-plugin#1363	Bump test-scope Jetty 9.4.55 to the final 9.4.58
maven-dependency-plugin	apache/maven-dependency-plugin#1685	Nothing today — already on the final 9.4 release; recorded so the constraint is not re-derived
maven-project-info-reports-plugin	apache/maven-project-info-reports-plugin#652	Replace the Jetty 6.1.26 test fixture; the JDK's own HTTP server covers what the one test needs
maven-archetype	apache/maven-archetype#1012	Delete the dead Jetty 6 pluginManagement entry and the unbuilt archetype-samples tree
maven-surefire	apache/maven-surefire#3437	Registered for a decision: leave the 2014 IT fixture, or bump it within the Jetty 9 line

This issue was created with AI assistance.