Downgrade plexus-classworlds from 2.11.0 to 2.9.0

[gnodet]

Summary

• Downgrade plexus-classworlds from 2.11.0 to 2.9.0 to fix all integration test failures on ubuntu-latest

Root Cause

Classworlds 2.11.0 introduced a bug in ConfigurationParser.loadGlob() (commit 4f4cfe64) where an automated code cleanup incorrectly changed && to || in the glob file filter. This causes load maven-*.jar in m2.conf to match all .jar files instead of only those starting with maven-.

On Linux ext4, File.listFiles() returns non-deterministic ordering (inode hash order). After a recent GitHub Actions runner image update (ubuntu24/20260513.135), org.eclipse.sisu.plexus-1.0.0.jar loads before maven-embedder-4.0.0-SNAPSHOT.jar, causing Sisu's PlexusXmlBeanConverter (without XmlNode handling) to win the class collision. This breaks lifecycle configuration injection for any component using XmlNode fields (e.g., LifecycleMojo.configuration).

This is the root cause of all 5 backport PR failures (#12071, #12070, #12073, #12077, #12079) — they are all innocent bystanders.

Upstream fix: codehaus-plexus/plexus-classworlds#147

Once classworlds ships a fix (2.11.1+), we can upgrade again.

Claude Code on behalf of Guillaume Nodet

[slawekjaranowski]

Does 3.x also affected?

[gnodet]

Maven 3.9.x also uses classworlds 2.11.0, so the loadGlob bug is technically present. However, 3.9.x is not practically affected because:

1. Its m2.conf uses load ${maven.home}/lib/*.jar (empty prefix), so the || vs && distinction doesn't matter — "".startsWith("") is always true regardless.
2. There is no PlexusXmlBeanConverter class collision in 3.9.x (the custom version only exists in 4.0.x's maven-embedder).

The 4.0.x m2.conf uses load ${maven.home}/lib/maven-*.jar followed by load ${maven.home}/lib/*.jar — the first glob's maven- prefix is what triggers the bug (matching all jars instead of only maven-* jars), defeating the intended load ordering.

That said, it would still be good to align 3.9.x with the fix once classworlds ships 2.11.1, to avoid any future surprises.

Claude Code on behalf of Guillaume Nodet

[github-actions]

@gnodet Please assign appropriate label to PR according to the type of change.