Strip META-INF/maven/** from uber and thin JARs

[sreekanth-db]

Summary

• Strip META-INF/maven/** (pom.properties, pom.xml) from the shade plugin filter in both assembly-uber and assembly-thin.
• Dependency information remains available in the published POM on Maven Central.

Test plan

• Built uber JAR and verified META-INF/maven/ has 0 entries
• Verified all other META-INF files intact (MANIFEST.MF, services/, io.netty.versions.properties)
• TestUberPackaging shaded dependency tests pass
• CI checks

This pull request was AI-assisted by Isaac.

[vikrantpuppala]

[F1] Thin JAR: useDependencyReducedPomInJar interaction with new exclude (Severity: Medium)

The thin JAR sets useDependencyReducedPomInJar=true at assembly-thin/pom.xml:116-118, which embeds a reduced POM inside the JAR at META-INF/maven/<groupId>/<artifactId>/pom.xml. The new META-INF/maven/** exclude will strip that embedded reduced POM as well.

If any consumer of the thin JAR reads the embedded reduced POM at runtime (rather than fetching the sibling .pom from Maven Central), this silently removes it.

Suggested fix: Either

1. Confirm the embedded reduced POM is intentionally stripped (likely fine — most consumers use the Maven Central POM), and call this out in the PR description / changelog, or
2. Narrow the exclude to META-INF/maven/**/pom.properties so the reduced pom.xml remains embedded.

Posted by Code Review Squad.

[sreekanth-db]

Yes, this change is intentional and mentioned in the change log

[tejassp-db]

Are there any uses cases for incuding the pom.xml in the JAR? If not then this looks good. Have we validated the final JAR that is produced does not contain these artifacts anymore?

[sreekanth-db]

No use cases — these files are Maven build metadata that no code reads at runtime. Dependency info is available in the published POM on Maven Central.

Validated locally — uber JAR has 0 META-INF/maven entries, thin JAR has 0 dependency metadata entries (only its own reduced POM remains, which the shade plugin injects post-filter via useDependencyReducedPomInJar).

[sreekanth-db]

Re: [F1] - The reduced POM is not affected — the shade plugin injects it post-filter, so the META-INF/maven/** exclude can't strip it. Verified locally that it remains in the thin JAR.

@tejassp-db — useDependencyReducedPomInJar=true was added in #1243 (line 122 in assembly-thin/pom.xml). Are there any consumers that read this embedded reduced POM from inside the JAR?