Coverage of the 50 most-used Maven plugins

Bleep refuses the plugin system Maven, Gradle, and sbt all settled on. That refusal is load-bearing: the case for build-as-data, the inner-loop guarantee, and the self-editing model all rest on it.

So the obvious next question, especially from a Java team coming off twenty years of Maven, is: what about all my plugins?

This page is the answer. It surveys the 50 most-used Maven plugins by real-world usage and shows where each one lands in bleep's model.

Counted straight off the table below, with no rounding in bleep's favour:

Where it lands	Count	What you do
🟢 Built in	17	Nothing. It's a bleep command or part of one
⚙️ Sourcegen	6	Point bleep's sourcegen at the generator
📝 You write it yourself	19	Write a main in your repo
🟢+📝 / 🟢+⚙️ Part built-in	5	Primitive for the common case, script for the edge
🔧 Meta to Maven	3	Nothing. These only exist to serve Maven's plugin system

Nineteen of the fifty are "write it yourself." That's the number worth arguing about, so the argument is right here rather than buried at the bottom. It's a good deal, but it is a trade, not a freebie, and a page that hid the number would deserve the eye-roll it got.

The other honest caveat is Spring Boot, which an earlier version of this page flagged as the one genuinely hard case. That one is now solved: see Spring Boot proves the model for the design argument and the tutorial for the working setup.

Methodology

Rankings come from mvnrepository.com usage counts. The current site sorts by total Maven Central artifacts that declare the plugin in their pom.xml, which is the right signal for "how many real projects use this."

The top 10 comes from a March 2026 snapshot. Ranks 11 to 50 are reconstructed from a mix of October 2025 and October 2021 Wayback Machine paginated snapshots, since the modern site changed its metric mid-redesign and paginated listings in the new format aren't yet archived. The ranking is approximate from rank 11 down, but the set of plugins is accurate.

Anachronistic plugins (maven-site-plugin, maven-jxr-plugin) and superseded ones (cobertura, findbugs) appear in the raw rankings but are dropped here. They're listed at the end with reasons.

Categories

Symbol	Category	What it means
🟢	Built-in	Bleep handles this out of the box. Either a CLI command (compile, test, run, link, dist, publish, clean, sourcegen, build update-deps) or a library bleep publishes and maintains (PGP signing, Sonatype Central and legacy OSSRH, and dynver live in bleep-core behind bleep publish; bleep-plugin-native-image and bleep-plugin-spring-boot are separate artifacts)
⚙️	Sourcegen	Maps to bleep's sourcegen mechanism. The plugin produces files the compiler reads, which is exactly what sourcegen is for
📝	You write it yourself	A main in your repo. Ordinary code you own, run when you say so. Typical case: distribution concerns (Docker, WAR, uber-JARs, coverage, linters, migrations, CI glue). See the argument for this
🔧	Meta to Maven	Only exists because Maven plugins exist. No equivalent needed

The list

#	Plugin	What it does	Bleep approach	Fit
1	org.apache.maven.plugins:maven-compiler-plugin	Compile Java	bleep compile	🟢 Built-in
2	org.apache.maven.plugins:maven-source-plugin	Source JAR for publishing	Part of bleep publish	🟢 Built-in
3	org.apache.maven.plugins:maven-javadoc-plugin	Javadoc JAR for publishing	Part of bleep publish	🟢 Built-in
4	org.apache.maven.plugins:maven-surefire-plugin	Unit tests	bleep test	🟢 Built-in
5	org.apache.maven.plugins:maven-jar-plugin	Build JAR	Part of bleep publish and bleep dist (bleep.packaging.createJar)	🟢 Built-in
6	org.apache.maven.plugins:maven-gpg-plugin	PGP-sign artifacts	Part of bleep publish (liberated sbt-pgp, in bleep-core)	🟢 Built-in
7	org.sonatype.plugins:nexus-staging-maven-plugin	OSSRH staging (legacy)	bleep publish sonatype with sonatypeCredentialHost: oss.sonatype.org	🟢 Built-in
8	org.apache.felix:maven-bundle-plugin	OSGi bundle and MANIFEST.MF	Script: write manifest, call bleep.packaging.createJar	📝 Script
9	org.apache.maven.plugins:maven-release-plugin	Tag, bump, stage release	DynVer + the liberated sbt-ci-release; version derived from the git tag	🟢 Built-in
10	org.apache.maven.plugins:maven-assembly-plugin	Custom distribution archives	Script using bleep.packaging	📝 Script
11	org.sonatype.central:central-publishing-maven-plugin	Publish to new Sonatype Central Portal	bleep publish sonatype (Central Portal is the default)	🟢 Built-in
12	org.apache.maven.plugins:maven-shade-plugin	Uber-JAR with relocation	Script using bleep packaging	📝 Script
13	org.apache.maven.plugins:maven-dependency-plugin	Tree, copy, unpack, analyze	Native for inspection; script for copy/unpack	🟢 + 📝
14	org.jacoco:jacoco-maven-plugin	Test coverage	Script wires javaagent into bleep's test JVM args	📝 Script
15	org.apache.maven.plugins:maven-enforcer-plugin	Build-time rules	JDK is pinned by jvm: in bleep.yaml; arbitrary rule sets need a script	📝 Script
16	org.apache.maven.plugins:maven-failsafe-plugin	Integration tests	Just another project with isTestProject: true	🟢 Built-in
17	org.apache.maven.plugins:maven-deploy-plugin	Upload artifacts	bleep publish	🟢 Built-in
18	org.apache.maven.plugins:maven-install-plugin	Install to local repo	bleep publish local-ivy	🟢 Built-in
19	org.apache.maven.plugins:maven-clean-plugin	Delete target/	bleep clean	🟢 Built-in
20	org.apache.maven.plugins:maven-resources-plugin	Copy resources, filter	Native (resources); sourcegen (filtering)	🟢 + ⚙️
21	org.springframework.boot:spring-boot-maven-plugin	Fat JAR, run, build-info, build-image, AOT	bleep-plugin-spring-boot — see the tutorial	🟢 Built-in
22	org.codehaus.mojo:versions-maven-plugin	Update dep versions	bleep build update-deps (lossless round-trip)	🟢 Built-in
23	org.codehaus.mojo:exec-maven-plugin	Run main class or external program	bleep run for main; script otherwise	🟢 + 📝
24	org.apache.maven.plugins:maven-war-plugin	WAR file	Script (write WAR layout, package)	📝 Script
25	org.apache.maven.plugins:maven-checkstyle-plugin	Checkstyle report	Pre-commit hook or CI script	📝 Script
26	org.apache.maven.plugins:maven-pmd-plugin	PMD report	Pre-commit hook or CI script	📝 Script
27	org.codehaus.mojo:build-helper-maven-plugin	Misc helpers (source roots, ports)	Source roots native; rest via script	🟢 + 📝
28	org.jetbrains.kotlin:kotlin-maven-plugin	Compile Kotlin	bleep compile (Kotlin is native)	🟢 Built-in
29	org.apache.maven.plugins:maven-antrun-plugin	Run arbitrary tasks (Ant in pom.xml)	Write a Java/Scala script; or call ant from a script	📝 Script
30	com.mycila:license-maven-plugin	License headers	Pre-commit hook	📝 Script
31	com.github.eirslett:frontend-maven-plugin	Install Node, run npm scripts	node: config (native); npm via script	🟢 + 📝
32	org.apache.maven.plugins:maven-scm-plugin	SCM commands as Maven goals	Call git from a script	📝 Script
33	io.fabric8:docker-maven-plugin	Build, run, push Docker images	Script: canonical "run a program" case	📝 Script
34	com.google.cloud.tools:jib-maven-plugin	OCI images without daemon	Script (Jib has Java API and CLI)	📝 Script
35	org.openapitools:openapi-generator-maven-plugin	OpenAPI to client/server stubs	Sourcegen	⚙️ Sourcegen
36	org.apache.avro:avro-maven-plugin	Avro schemas to Java	Sourcegen	⚙️ Sourcegen
37	org.flywaydb:flyway-maven-plugin	Database migrations	Script (Flyway CLI or Java API)	📝 Script
38	org.liquibase:liquibase-maven-plugin	Database migrations	Script (Liquibase CLI or Java API)	📝 Script
39	org.sonarsource.scanner.maven:sonar-maven-plugin	Upload to SonarQube	Script (Sonar Scanner CLI)	📝 Script
40	org.eluder.coveralls:coveralls-maven-plugin	Upload coverage to coveralls.io	Script (HTTP POST to coveralls API)	📝 Script
41	org.apache.maven.plugins:maven-archetype-plugin	New Maven project from template	Bleep needs no archetype mechanism; scaffold from any directory	🔧 Meta
42	org.codehaus.mojo:properties-maven-plugin	Read and write .properties files	Trivial script	📝 Script
43	org.apache.maven.plugins:maven-plugin-plugin	Generate Maven plugin descriptor	Bleep has no plugin system	🔧 Meta
44	org.apache.maven.plugins:maven-invoker-plugin	Nested Maven builds for plugin tests	Bleep has no plugin system	🔧 Meta
45	net.alchim31.maven:scala-maven-plugin	Compile Scala	bleep compile (Scala is core)	🟢 Built-in
46	org.antlr:antlr4-maven-plugin	ANTLR grammars to parsers	Sourcegen	⚙️ Sourcegen
47	org.jvnet.jaxb2.maven2:maven-jaxb2-plugin	XSD to Java	Sourcegen	⚙️ Sourcegen
48	org.mybatis.generator:mybatis-generator-maven-plugin	Database schema to MyBatis Java	Sourcegen	⚙️ Sourcegen
49	org.jsonschema2pojo:jsonschema2pojo-maven-plugin	JSON Schema to Java POJO	Sourcegen	⚙️ Sourcegen
50	de.thetaphi:forbiddenapis	Banned API checker	Pre-commit or CI script	📝 Script

The count

The 50 most-used Maven plugins decompose into five groups:

• 17 are built in (rows 1–7, 9, 11, 16–19, 21, 22, 28, 45). Compile, test, JARs, deploy, install, clean, PGP signing, Sonatype Central and legacy OSSRH staging, the release version dance, integration tests, dependency-version bumps, Kotlin, Scala, and the Spring Boot integration via bleep-plugin-spring-boot. The plugin you would have configured in Maven is something you don't think about in bleep.
• 6 are sourcegen (rows 35, 36, 46–49). Avro, OpenAPI Generator, ANTLR, JAXB2, MyBatis Generator, jsonschema2pojo. Every one is a schema or IDL feeding a code generator, which is exactly the shape sourcegen exists for.
• 19 you write yourself (rows 8, 10, 12, 14, 15, 24, 25, 26, 29, 30, 32–34, 37–40, 42, 50). Container builds, uber-JARs, WARs, OSGi bundles, coverage, linters, license headers, database migrations, analysis uploads, ad-hoc steps, enforcer rules. Argued below.
• 5 are part built-in, part script or sourcegen (rows 13, 20, 23, 27, 31). Resource filtering, dependency inspection, exec, build helpers, frontend tooling. Clean primitive path for the common case, a script for the edge.
• 3 are meta to Maven (rows 41, 43, 44). maven-plugin-plugin and maven-invoker-plugin are infrastructure for authoring and testing Maven plugins; maven-archetype-plugin scaffolds Maven projects from XML archetypes. Without a plugin system or Maven-shaped projects, bleep needs none of them.

So: 20 of 50 need nothing from you — 17 built in, and 3 that evaporate along with the plugin system. 11 more are configuration: 6 sourcegen entries, 5 hybrids where the primitive covers the common case. 19 are a program you write. 20 + 11 + 19 = 50.

The 19 you write yourself

This is the honest cost of refusing a plugin system, and it deserves a straight argument rather than a symbol in a table.

What's actually in the 19. Docker and Jib, WAR and assembly and shade and OSGi bundles, JaCoCo, Checkstyle and PMD and forbiddenapis and license headers, Flyway and Liquibase, Sonar and Coveralls uploads, maven-scm, properties-maven-plugin, antrun, enforcer rules. Not one of them compiles anything. Every one is "run this program, at a moment I choose, over files that already exist."

The work didn't appear; it moved. In Maven you didn't get these for free either. You got someone else's plugin, plus its XML configuration surface to learn, plus its lifecycle binding to get right, plus its version to keep current, plus its transitive dependencies inside your build's classpath. What bleep asks instead is a main you can open in a debugger and step through. You trade reading a plugin's website for writing twenty lines against a Java API — usually the very same API the plugin was wrapping. Jib, Flyway, Liquibase, JaCoCo, and the Sonar scanner all ship a documented Java API or CLI; their Maven plugins are thin covers over it.

The scripts are small, and we measured that on the hardest case. spring-boot-maven-plugin is the biggest single plugin in this list, and the whole integration came out at six lines of fluent Java per script, three scripts, over a 200-line library wrapping Spring's published spring-boot-loader-tools. If the worst case is that size, a Checkstyle invocation is not going to ruin your week.

They're ordinary code, which is the point. A script is versioned with your repo, tested like anything else, debuggable in your IDE, and readable by whoever joins next year. There is no classloader isolation puzzle, no "which phase does this bind to", no plugin whose behaviour changes because a transitive dep moved. And when a script turns out to be worth sharing, it's a library on Maven Central like any other — that's what bleep-plugin-native-image and bleep-plugin-spring-boot are.

And the concession. It is still work. A team that today writes six lines of XML to enable JaCoCo will write a script instead, and the first one costs an afternoon. If your build is entirely off-the-shelf plugins, nobody on the team wants to own a main, and none of the plugins you use are causing you pain, that's a real reason to stay where you are. Bleep's bet is that the teams reading this page are not in that situation — they're in the one where the plugin is the pain, and owning twenty lines of Java beats debugging somebody's Mojo.

The case that used to be hard

When this page was first written, spring-boot-maven-plugin was the single entry that fit neither built-in, sourcegen, nor a one-script weekend.

It bundles five different jobs under one Maven goal namespace:

• spring-boot:repackage turns your .jar into an executable fat-JAR with Spring Boot's BOOT-INF/ classloader layout.
• spring-boot:run starts your application from a forked JVM with the right classpath.
• spring-boot:build-image builds an OCI image through buildpacks.
• spring-boot:process-aot runs Spring's ahead-of-time compilation pass, generating META-INF/native-image/ hints and reflection metadata.
• spring-boot:start and spring-boot:stop manage a background JVM for integration tests.

The honest assessment was that each piece was tractable as a script because Spring Boot ships clean Java APIs for the parts that matter (spring-boot-loader-tools, spring-boot-buildpack-platform, Spring AOT). It just needed someone to write the script. So we did.

bleep-plugin-spring-boot now ships with three classes wrapping the upstream API:

• SpringBootRun — fork a JVM with profile, JVM args, agents, env vars, system properties.
• SpringBootRepackage — produce the executable fat JAR with layout, layers, requires-unpack, and reproducible timestamps.
• SpringBootBuildInfo — write META-INF/build-info.properties as a sourcegen, so Spring Boot Actuator's /actuator/info endpoint returns build metadata.

The Spring Boot proves the model page walks through why this integration was the right test of the build-as-data thesis. The Spring Boot tutorial walks through the working example: a DuckDB-backed REST service with a repository, service, controller, profile-specific configuration, and three named scripts that bind ports and JVM args explicitly. If you're a Spring Boot shop evaluating bleep, start there.

Build-image (Buildpacks) and AOT (native-image) are not in bleep-plugin-spring-boot yet. The integration shape is the same: one more SpringBoot* class wrapping spring-boot-buildpack-platform and spring-aot. Open an issue or send a PR if either matters for your project.

What about BOM and dependencyManagement?

Not a plugin, but worth mentioning. Bleep supports BOM imports: a project lists boms: and Maven's dependencyManagement-import semantics pin every version in its resolutions, transitives included, travelling along dependsOn to consumers. Dependencies a BOM manages are written without a version. bleep import-maven carries this over — <dependencyManagement> imports become boms:, and BOM-managed dependencies come across version-less. See Dependencies for the model.

Plugins dropped from this list

These appeared in the raw mvnrepository.com rankings but were dropped here as anachronistic or superseded:

Plugin	Why dropped
maven-site-plugin	Docusaurus, MkDocs, and Antora are the modern stack
maven-jxr-plugin	IDEs do this
maven-project-info-reports-plugin	GitHub README and bleep build show cover the use case
cobertura-maven-plugin	Superseded by JaCoCo
findbugs-maven-plugin	Superseded by SpotBugs
maven-surefire-report-plugin	Bleep's test runner already emits HTML and TUI output

These show up in usage rankings because they ship in old enterprise projects nobody touches. Including them on a coverage page would be honest, but listing them as "things bleep needs to support" would be misleading. The right answer for each is a modern alternative.

The broader point

The category "Maven plugin" is misleading. It contains four unrelated kinds of thing:

• Things every build tool does natively (compile, test, JAR, publish, sign, clean): 17 of 50, 34%.
• Schema-driven codegen (Avro, OpenAPI, ANTLR, JAXB2, MyBatis, jsonschema2pojo): 6 of 50, 12%. All sourcegen.
• Distribution and quality concerns (containers, archives, coverage, linters, migrations, CI glue): 19 of 50, 38%. All programs.
• The rest: 5 hybrids and 3 plugins that exist only to serve Maven's plugin system, 16%.

When you decompose it that way, what about all my Maven plugins? stops being one question. A third of them need a primitive, an eighth need a generator, and the largest single group needs a program — which is what they always were, wearing a <plugin> element as a costume. Bleep ships the primitive, the generator, and a first-class way to run your program. It just declines to pretend the third one is anything other than code you own.

See also

• Comparison with Maven
• Spring Boot proves the model — the design argument for the four-primitives claim, with Spring Boot as the worked example
• Spring Boot tutorial — the practical walkthrough of the worked example
• Sourcegen concept
• Scripts concept
• Project status