JIPP: current "apache-maven-latest" can break builds ("UTF-8 BOM plus xml decl of ISO-8859-1 is incompatible")

Summary

Today, the CI builds in the Epsilon started to fail. We believe it's a regression in Maven 3.9.1. We fixed this issue by explicitly telling our Jenkinsfile to use Maven 3.8.6, but we thought it'd be good to document this issue in case others ran into it.

Steps to reproduce

Use a Jenkinsfile with the current apache-maven-latest tool (which points to Maven 3.9.1).
Try to run a build which uses the org.codehaus.mojo:build-helper-maven-plugin:3.1.0 Maven plugin (3.3.0 has this issue, too).

What is the current bug behavior?

The build fails with an error message like this (see this CI build from Epsilon):

[ERROR] Plugin org.codehaus.mojo:build-helper-maven-plugin:3.1.0 or one of its dependencies could not be resolved: Failed to read artifact descriptor for org.codehaus.mojo:build-helper-maven-plugin:jar:3.1.0: 1 problem was encountered while building the effective model
[ERROR] [FATAL] Non-parseable POM /home/jenkins/.m2/repository/org/codehaus/mojo/build-helper-maven-plugin/3.1.0/build-helper-maven-plugin-3.1.0.pom: UTF-8 BOM plus xml decl of ISO-8859-1 is incompatible (position: START_DOCUMENT seen <?xml version="1.0" encoding="ISO-8859-1"... @1:42)  @ line 1, column 42

The strange part is that I tried downloading the POM from Central, and I could not see a BOM there:

$ curl -s https://repo1.maven.org/maven2/org/codehaus/mojo/build-helper-maven-plugin/3.1.0/build-helper-maven-plugin-3.1.0.pom | hexdump -n 3 -C 
00000000  3c 3f 78                                          |<?x|
00000003
$ curl -s https://repo1.maven.org/maven2/org/codehaus/mojo/build-helper-maven-plugin/3.1.0/build-helper-maven-plugin-3.1.0.pom | file -
/dev/stdin: XML 1.0 document, ASCII text

Other open source projects are running into similar issues with Maven 3.9.1:

https://issues.apache.org/jira/browse/SPARK-42380

What is the expected correct behavior?

The build should succeed, like it does now that we explicitly told our Jenkinsfile to use Maven 3.8.6:

https://ci.eclipse.org/epsilon/job/interim-kubernetes/job/main/42/

Priority

Urgent
High
Medium
Low

Severity

Blocker
Major
Normal
Low

Impact

No impact to Epsilon, but we think it could be useful to perhaps add a warning about this in the Jenkins article of the Eclipse wiki, in case others run into it:

https://wiki.eclipse.org/Jenkins#Apache_Maven