diff --git a/.mvn/maven.config b/.mvn/maven.config
new file mode 100644
index 0000000000..b4c5d1d29e
--- /dev/null
+++ b/.mvn/maven.config
@@ -0,0 +1 @@
+-Dorg.slf4j.simpleLogger.log.com.networknt.schema=error
diff --git a/examples/autoscaling/pom.xml b/examples/autoscaling/pom.xml
index 76ac1c4652..7914ab28ed 100644
--- a/examples/autoscaling/pom.xml
+++ b/examples/autoscaling/pom.xml
@@ -106,7 +106,7 @@ under the License.
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-shade-plugin</artifactId>
-                <version>3.0.0</version>
+                <!-- Version inherited from the parent pom.xml. -->
                 <executions>
                     <!-- Run shade goal on package phase -->
                     <execution>
@@ -125,13 +125,41 @@ under the License.
                             </artifactSet>
                             <filters>
                                 <filter>
-                                    <!-- Do not copy the signatures in the META-INF folder.
-                                    Otherwise, this might cause SecurityExceptions when using the JAR. -->
                                     <artifact>*:*</artifact>
                                     <excludes>
+                                        <!-- JPMS module descriptors: the uber-JAR is not modular. -->
+                                        <exclude>module-info.class</exclude>
+                                        <exclude>META-INF/**/module-info.class</exclude>
+                                        <!-- Signature files of signed input jars. -->
                                         <exclude>META-INF/*.SF</exclude>
                                         <exclude>META-INF/*.DSA</exclude>
                                         <exclude>META-INF/*.RSA</exclude>
+                                        <!-- Per-dependency Maven build metadata. -->
+                                        <exclude>META-INF/maven/**</exclude>
+                                        <!-- Per-dependency LICENSE/NOTICE/DEPENDENCIES files. -->
+                                        <exclude>META-INF/DEPENDENCIES</exclude>
+                                        <exclude>META-INF/LICENSE</exclude>
+                                        <exclude>META-INF/LICENSE.txt</exclude>
+                                        <exclude>META-INF/license.txt</exclude>
+                                        <exclude>META-INF/NOTICE</exclude>
+                                        <exclude>META-INF/NOTICE.txt</exclude>
+                                        <exclude>META-INF/licenses/**</exclude>
+                                        <!-- Kotlin compilation metadata. -->
+                                        <exclude>META-INF/*.kotlin_module</exclude>
+                                        <!-- ProGuard rules and GraalVM native-image hints. -->
+                                        <exclude>META-INF/proguard/**</exclude>
+                                        <exclude>META-INF/native-image/**</exclude>
+                                        <!-- A fresh manifest is produced by the
+                                        ManifestResourceTransformer below. -->
+                                        <exclude>META-INF/MANIFEST.MF</exclude>
+                                    </excludes>
+                                </filter>
+                                <filter>
+                                    <!-- okio and okio-jvm ship the same Kotlin module descriptor;
+                                    keep okio-jvm's. -->
+                                    <artifact>com.squareup.okio:okio</artifact>
+                                    <excludes>
+                                        <exclude>META-INF/okio.kotlin_module</exclude>
                                     </excludes>
                                 </filter>
                             </filters>
diff --git a/examples/flink-beam-example/pom.xml b/examples/flink-beam-example/pom.xml
index a48c9fee4c..0cb0008ec9 100644
--- a/examples/flink-beam-example/pom.xml
+++ b/examples/flink-beam-example/pom.xml
@@ -66,6 +66,22 @@ under the License.
                     <groupId>org.springframework</groupId>
                     <artifactId>spring-jcl</artifactId>
                 </exclusion>
+                <!--
+                    Excluded because the example does not use any Beam ML
+                    transform and beam-sdks-java-extensions-ml:2.62.0 ships
+                    a malformed POM (missing <version> for
+                    com.google.http-client:google-http-client and
+                    com.google.api:gax), which causes Maven to log:
+                        [WARNING] The POM for
+                        org.apache.beam:beam-sdks-java-extensions-ml:jar:2.62.0
+                        is invalid, transitive dependencies (if any) will not be available
+                    Excluding it avoids resolving the broken POM altogether
+                    and also slims down the resulting uber-JAR.
+                -->
+                <exclusion>
+                    <groupId>org.apache.beam</groupId>
+                    <artifactId>beam-sdks-java-extensions-ml</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
 
@@ -120,7 +136,7 @@ under the License.
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-shade-plugin</artifactId>
-                <version>3.1.1</version>
+                <!-- Version inherited from the parent pom.xml. -->
                 <executions>
                     <!-- Run shade goal on package phase -->
                     <execution>
@@ -139,19 +155,125 @@ under the License.
                             </artifactSet>
                             <filters>
                                 <filter>
-                                    <!-- Do not copy the signatures in the META-INF folder.
-                                    Otherwise, this might cause SecurityExceptions when using the JAR. -->
                                     <artifact>*:*</artifact>
                                     <excludes>
-                                        <exclude>META-INF/versions/9/module-info.class</exclude>
+                                        <!-- JPMS module descriptors: the uber-JAR is not modular. -->
+                                        <exclude>module-info.class</exclude>
+                                        <exclude>META-INF/**/module-info.class</exclude>
+                                        <!-- Signature files of signed input jars. -->
                                         <exclude>META-INF/*.SF</exclude>
                                         <exclude>META-INF/*.DSA</exclude>
                                         <exclude>META-INF/*.RSA</exclude>
+                                        <!-- Per-dependency Maven build metadata. -->
+                                        <exclude>META-INF/maven/**</exclude>
+                                        <!-- Per-dependency LICENSE/NOTICE/DEPENDENCIES files
+                                        (multiple casings & paths used across the Beam dep tree). -->
+                                        <exclude>META-INF/DEPENDENCIES</exclude>
+                                        <exclude>META-INF/LICENSE</exclude>
+                                        <exclude>META-INF/LICENSE.txt</exclude>
+                                        <exclude>META-INF/license.txt</exclude>
+                                        <exclude>META-INF/NOTICE</exclude>
+                                        <exclude>META-INF/NOTICE.txt</exclude>
+                                        <exclude>META-INF/license/**</exclude>
+                                        <exclude>META-INF/licenses/**</exclude>
+                                        <exclude>LICENSE</exclude>
+                                        <exclude>LICENSE.txt</exclude>
+                                        <exclude>LICENSE-*.txt</exclude>
+                                        <exclude>about.html</exclude>
+                                        <!-- Kotlin compilation metadata + Kotlin Multiplatform
+                                        common-source metadata (shipped by some wire artifacts);
+                                        none is consumed at runtime by the JVM. -->
+                                        <exclude>META-INF/*.kotlin_module</exclude>
+                                        <exclude>META-INF/kotlin-project-structure-metadata.json</exclude>
+                                        <exclude>commonMain/**</exclude>
+                                        <!-- ProGuard rules and GraalVM native-image hints. -->
+                                        <exclude>META-INF/proguard/**</exclude>
+                                        <exclude>META-INF/native-image/**</exclude>
+                                        <!-- Build-time git/version metadata. -->
+                                        <exclude>arrow-git.properties</exclude>
+                                        <!-- Netty release metadata; one wins anyway. -->
+                                        <exclude>META-INF/io.netty.versions.properties</exclude>
+                                        <!-- Mozilla public-suffix list shipped by httpclient and
+                                        beam-vendor-grpc; harmless duplicate. -->
+                                        <exclude>mozilla/public-suffix-list.txt</exclude>
+                                        <!-- A fresh manifest is produced by the
+                                        ManifestResourceTransformer below. -->
+                                        <exclude>META-INF/MANIFEST.MF</exclude>
+                                    </excludes>
+                                </filter>
+                                <filter>
+                                    <!--
+                                        kotlinpoet (the legacy artifact) is fully superseded by
+                                        kotlinpoet-jvm in Kotlin 1.7+'s multiplatform layout, but
+                                        Beam still pulls both in transitively. Drop kotlinpoet's
+                                        classes so kotlinpoet-jvm wins deterministically.
+                                    -->
+                                    <artifact>com.squareup:kotlinpoet</artifact>
+                                    <excludes>
+                                        <exclude>**</exclude>
+                                    </excludes>
+                                </filter>
+                                <filter>
+                                    <!--
+                                        Same situation for wire-runtime / wire-schema: the *-jvm
+                                        artifacts are the canonical JVM ones, the no-suffix ones
+                                        are stale multiplatform metadata bundles.
+                                    -->
+                                    <artifact>com.squareup.wire:wire-runtime</artifact>
+                                    <excludes>
+                                        <exclude>**</exclude>
+                                    </excludes>
+                                </filter>
+                                <filter>
+                                    <artifact>com.squareup.wire:wire-schema</artifact>
+                                    <excludes>
+                                        <exclude>**</exclude>
+                                    </excludes>
+                                </filter>
+                                <filter>
+                                    <!--
+                                        wire-compiler ships a shaded copy of a few wire-schema
+                                        classes (DirectedAcyclicGraph, PartitionedSchema, etc.)
+                                        that overlap with wire-schema-jvm. wire-schema-jvm is the
+                                        canonical runtime artifact, so drop those duplicates from
+                                        wire-compiler.
+                                    -->
+                                    <artifact>com.squareup.wire:wire-compiler</artifact>
+                                    <excludes>
+                                        <exclude>com/squareup/wire/schema/DirectedAcyclicGraph*.class</exclude>
+                                        <exclude>com/squareup/wire/schema/PartitionedSchema*.class</exclude>
+                                        <exclude>com/squareup/wire/schema/Target*.class</exclude>
+                                        <exclude>com/squareup/wire/schema/WireRun*.class</exclude>
+                                    </excludes>
+                                </filter>
+                                <filter>
+                                    <!--
+                                        wire-schema-jvm ships its own copies of google.protobuf.*
+                                        .proto descriptors that overlap with protobuf-java.
+                                        protobuf-java is the canonical source, so drop them.
+                                    -->
+                                    <artifact>com.squareup.wire:wire-schema-jvm</artifact>
+                                    <excludes>
+                                        <exclude>google/protobuf/*.proto</exclude>
+                                    </excludes>
+                                </filter>
+                                <filter>
+                                    <!--
+                                        beam-sdks-java-harness re-bundles all the classes from
+                                        beam-runners-core-java (~280 classes). Drop them from the
+                                        harness so beam-runners-core-java's are used.
+                                    -->
+                                    <artifact>org.apache.beam:beam-sdks-java-harness</artifact>
+                                    <excludes>
+                                        <exclude>org/apache/beam/runners/core/**</exclude>
                                     </excludes>
                                 </filter>
                             </filters>
                             <transformers>
                                 <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
+                                <!-- Produce a fresh MANIFEST.MF for the uber-JAR; the inputs'
+                                manifests are dropped via the filter above. -->
+                                <transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer"/>
                             </transformers>
                         </configuration>
                     </execution>
diff --git a/examples/flink-sql-runner-example/pom.xml b/examples/flink-sql-runner-example/pom.xml
index 6ea19990d6..7171184e2f 100644
--- a/examples/flink-sql-runner-example/pom.xml
+++ b/examples/flink-sql-runner-example/pom.xml
@@ -94,7 +94,7 @@ under the License.
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-shade-plugin</artifactId>
-                <version>3.1.1</version>
+                <!-- Version inherited from the parent pom.xml. -->
                 <executions>
                     <!-- Run shade goal on package phase -->
                     <execution>
@@ -113,13 +113,42 @@ under the License.
                             </artifactSet>
                             <filters>
                                 <filter>
-                                    <!-- Do not copy the signatures in the META-INF folder.
-                                    Otherwise, this might cause SecurityExceptions when using the JAR. -->
                                     <artifact>*:*</artifact>
                                     <excludes>
+                                        <!-- JPMS module descriptors: the uber-JAR is not modular. -->
+                                        <exclude>module-info.class</exclude>
+                                        <exclude>META-INF/**/module-info.class</exclude>
+                                        <!-- Signature files of signed input jars: trigger
+                                        SecurityException at runtime if kept in the uber-JAR. -->
                                         <exclude>META-INF/*.SF</exclude>
                                         <exclude>META-INF/*.DSA</exclude>
                                         <exclude>META-INF/*.RSA</exclude>
+                                        <!-- Per-dependency Maven build metadata. -->
+                                        <exclude>META-INF/maven/**</exclude>
+                                        <!-- Per-dependency LICENSE/NOTICE/DEPENDENCIES files. -->
+                                        <exclude>META-INF/DEPENDENCIES</exclude>
+                                        <exclude>META-INF/LICENSE</exclude>
+                                        <exclude>META-INF/LICENSE.txt</exclude>
+                                        <exclude>META-INF/license.txt</exclude>
+                                        <exclude>META-INF/NOTICE</exclude>
+                                        <exclude>META-INF/NOTICE.txt</exclude>
+                                        <exclude>META-INF/licenses/**</exclude>
+                                        <!-- Kotlin compilation metadata. -->
+                                        <exclude>META-INF/*.kotlin_module</exclude>
+                                        <!-- ProGuard rules and GraalVM native-image hints. -->
+                                        <exclude>META-INF/proguard/**</exclude>
+                                        <exclude>META-INF/native-image/**</exclude>
+                                        <!-- A fresh manifest is produced by the
+                                        ManifestResourceTransformer below. -->
+                                        <exclude>META-INF/MANIFEST.MF</exclude>
+                                    </excludes>
+                                </filter>
+                                <filter>
+                                    <!-- okio and okio-jvm ship the same Kotlin module descriptor;
+                                    keep okio-jvm's. -->
+                                    <artifact>com.squareup.okio:okio</artifact>
+                                    <excludes>
+                                        <exclude>META-INF/okio.kotlin_module</exclude>
                                     </excludes>
                                 </filter>
                             </filters>
diff --git a/flink-autoscaler-standalone/pom.xml b/flink-autoscaler-standalone/pom.xml
index 31bebf61b1..c198e85f10 100644
--- a/flink-autoscaler-standalone/pom.xml
+++ b/flink-autoscaler-standalone/pom.xml
@@ -183,6 +183,22 @@ under the License.
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-shade-plugin</artifactId>
+                <dependencies>
+                    <!--
+                        Adds Log4j2PluginCacheFileTransformer so that the per-jar
+                        META-INF/org/apache/logging/log4j/core/config/plugins/Log4j2Plugins.dat
+                        cache files (shipped by both log4j-core and log4j-1.2-api) are
+                        properly MERGED into the uber-JAR. Without this transformer
+                        only one of the input cache files would survive (last-write-wins),
+                        breaking log4j2 plugin lookup for whichever side is dropped, and
+                        maven-shade-plugin would log it as an "overlapping resource" warning.
+                    -->
+                    <dependency>
+                        <groupId>org.apache.logging.log4j</groupId>
+                        <artifactId>log4j-transform-maven-shade-plugin-extensions</artifactId>
+                        <version>0.2.0</version>
+                    </dependency>
+                </dependencies>
                 <executions>
                     <!-- Run shade goal on package phase -->
                     <execution>
@@ -199,14 +215,91 @@ under the License.
                             </artifactSet>
                             <filters>
                                 <filter>
-                                    <!-- Do not copy the signatures in the META-INF folder.
-                                    Otherwise, this might cause SecurityExceptions when using the JAR. -->
                                     <artifact>*:*</artifact>
                                     <excludes>
+                                        <!-- Do not copy the signatures in the META-INF folder.
+                                        Otherwise, this might cause SecurityExceptions when using the JAR. -->
                                         <exclude>META-INF/*.SF</exclude>
                                         <exclude>META-INF/*.DSA</exclude>
                                         <exclude>META-INF/*.RSA</exclude>
+                                        <!-- JPMS module descriptors: the uber-JAR is not modular,
+                                        so these are meaningless and only cause shade's
+                                        "Discovered module-info.class …" warnings. -->
+                                        <exclude>module-info.class</exclude>
                                         <exclude>META-INF/**/module-info.class</exclude>
+                                        <!-- Per-dependency Maven build metadata: pom.xml /
+                                        pom.properties shipped under META-INF/maven/ are only
+                                        used to identify the original dep, not at runtime. -->
+                                        <exclude>META-INF/maven/**</exclude>
+                                        <!-- Per-dependency LICENSE/NOTICE/DEPENDENCIES files.
+                                        NOTICE is already aggregated by the parent pom's
+                                        ApacheNoticeResourceTransformer; the project's
+                                        top-level LICENSE / NOTICE / licenses/ directory is the
+                                        canonical attribution and is shipped at the repo root. -->
+                                        <exclude>META-INF/DEPENDENCIES</exclude>
+                                        <exclude>META-INF/LICENSE</exclude>
+                                        <exclude>META-INF/LICENSE.txt</exclude>
+                                        <exclude>META-INF/license.txt</exclude>
+                                        <exclude>META-INF/NOTICE</exclude>
+                                        <exclude>META-INF/NOTICE.txt</exclude>
+                                        <exclude>META-INF/licenses/**</exclude>
+                                        <!-- Kotlin compilation metadata: only used by kotlinc
+                                        for cross-module compilation; irrelevant at runtime. -->
+                                        <exclude>META-INF/*.kotlin_module</exclude>
+                                        <!-- ProGuard rules shipped by some libs (e.g. Guava):
+                                        only consumed by ProGuard, irrelevant in this uber-JAR. -->
+                                        <exclude>META-INF/proguard/**</exclude>
+                                        <!-- GraalVM native-image hints: only consumed by the
+                                        native-image build; this uber-JAR runs on the JVM. -->
+                                        <exclude>META-INF/native-image/**</exclude>
+                                        <!-- A fresh manifest is produced by the
+                                        ManifestResourceTransformer below, so dropping the inputs
+                                        avoids shade's "META-INF/MANIFEST.MF" overlap warning. -->
+                                        <exclude>META-INF/MANIFEST.MF</exclude>
+                                    </excludes>
+                                </filter>
+                                <filter>
+                                    <!--
+                                        flink-autoscaler-standalone ships its own forks of
+                                        AggregatedMetric and IOMetricsInfo (see
+                                        flink-autoscaler-standalone/src/main/java/org/apache/flink/runtime/rest/messages/).
+                                        flink-autoscaler additionally forks a handful of other
+                                        org.apache.flink.runtime.rest.messages.* classes. Drop the
+                                        upstream copies from flink-runtime so the local forks
+                                        deterministically win, silencing shade's "overlapping
+                                        classes" warnings.
+                                    -->
+                                    <artifact>org.apache.flink:flink-runtime</artifact>
+                                    <excludes>
+                                        <exclude>org/apache/flink/runtime/rest/messages/job/metrics/AggregatedMetric.class</exclude>
+                                        <exclude>org/apache/flink/runtime/rest/messages/job/metrics/IOMetricsInfo.class</exclude>
+                                        <exclude>org/apache/flink/runtime/rest/messages/job/JobDetailsInfo.class</exclude>
+                                        <exclude>org/apache/flink/runtime/rest/messages/job/JobDetailsInfo$*.class</exclude>
+                                        <exclude>org/apache/flink/runtime/rest/messages/json/SlotSharingGroupIDDeserializer.class</exclude>
+                                        <exclude>org/apache/flink/runtime/rest/messages/json/SlotSharingGroupIDSerializer.class</exclude>
+                                    </excludes>
+                                </filter>
+                                <filter>
+                                    <!--
+                                        flink-autoscaler also forks AggregatedMetric. Since
+                                        flink-autoscaler-standalone carries its own (newer) fork
+                                        and depends on flink-autoscaler, drop the flink-autoscaler
+                                        copy so the standalone's version deterministically wins.
+                                    -->
+                                    <artifact>org.apache.flink:flink-autoscaler</artifact>
+                                    <excludes>
+                                        <exclude>org/apache/flink/runtime/rest/messages/job/metrics/AggregatedMetric.class</exclude>
+                                    </excludes>
+                                </filter>
+                                <filter>
+                                    <!--
+                                        okio and okio-jvm ship the same Kotlin module descriptor;
+                                        keep the one from okio-jvm (the actual JVM artifact) and
+                                        drop okio's.
+                                    -->
+                                    <artifact>com.squareup.okio:okio</artifact>
+                                    <excludes>
+                                        <exclude>META-INF/okio.kotlin_module</exclude>
                                     </excludes>
                                 </filter>
                             </filters>
@@ -215,6 +308,14 @@ under the License.
                                 <transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
                                     <mainClass>org.apache.flink.autoscaler.standalone.StandaloneAutoscalerEntrypoint</mainClass>
                                 </transformer>
+                                <!--
+                                    Properly merge the Log4j2 plugin cache files shipped under
+                                    META-INF/org/apache/logging/log4j/core/config/plugins/
+                                    Log4j2Plugins.dat by both log4j-core and log4j-1.2-api into a
+                                    single combined cache, instead of last-write-wins.
+                                -->
+                                <transformer
+                                        implementation="org.apache.logging.log4j.maven.plugins.shade.transformer.Log4j2PluginCacheFileTransformer"/>
                             </transformers>
                         </configuration>
                     </execution>
diff --git a/flink-kubernetes-operator/pom.xml b/flink-kubernetes-operator/pom.xml
index f488127568..27ea4cdd1d 100644
--- a/flink-kubernetes-operator/pom.xml
+++ b/flink-kubernetes-operator/pom.xml
@@ -259,6 +259,22 @@ under the License.
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-shade-plugin</artifactId>
+                <dependencies>
+                    <!--
+                        Adds Log4j2PluginCacheFileTransformer so that the per-jar
+                        META-INF/org/apache/logging/log4j/core/config/plugins/Log4j2Plugins.dat
+                        cache files (shipped by both log4j-core and log4j-1.2-api) are
+                        properly MERGED into the uber-JAR. Without this transformer
+                        only one of the input cache files would survive (last-write-wins),
+                        breaking log4j2 plugin lookup for whichever side is dropped, and
+                        maven-shade-plugin would log it as an "overlapping resource" warning.
+                    -->
+                    <dependency>
+                        <groupId>org.apache.logging.log4j</groupId>
+                        <artifactId>log4j-transform-maven-shade-plugin-extensions</artifactId>
+                        <version>0.2.0</version>
+                    </dependency>
+                </dependencies>
                 <executions>
                     <execution>
                         <id>shade-flink-operator</id>
@@ -268,17 +284,154 @@ under the License.
                         </goals>
                         <configuration>
                             <shadedArtifactAttached>true</shadedArtifactAttached>
+                            <!--
+                                The non-shaded JAR is the main artifact (consumers like
+                                flink-kubernetes-webhook compile against it as a regular
+                                Maven dep). Shade still tries to publish a
+                                dependency-reduced-pom.xml that pretends every dep was
+                                absorbed into the shaded fat-JAR, which strips compile-scope
+                                deps (flink-core, slf4j, fabric8, jackson, …) from the
+                                installed pom and breaks downstream compilation. Disable
+                                pom reduction so the original pom — with the full dep tree —
+                                is the one published / installed for this artifact.
+                            -->
+                            <createDependencyReducedPom>false</createDependencyReducedPom>
                             <filters combine.children="append">
                                 <filter>
                                     <artifact>*:*</artifact>
                                     <excludes>
+                                        <!-- JPMS module descriptors: the uber-JAR is not modular,
+                                        so these are meaningless and only cause shade's
+                                        "Discovered module-info.class …" warnings. -->
+                                        <exclude>module-info.class</exclude>
                                         <exclude>META-INF/**/module-info.class</exclude>
+                                        <!-- Signature files of signed input jars: keeping them
+                                        in an uber-JAR triggers SecurityException at runtime. -->
+                                        <exclude>META-INF/*.SF</exclude>
+                                        <exclude>META-INF/*.DSA</exclude>
+                                        <exclude>META-INF/*.RSA</exclude>
+                                        <!-- Per-dependency Maven build metadata: pom.xml /
+                                        pom.properties shipped under META-INF/maven/ are only
+                                        used to identify the original dep, not at runtime. -->
+                                        <exclude>META-INF/maven/**</exclude>
+                                        <!-- Per-dependency LICENSE/NOTICE/DEPENDENCIES files.
+                                        NOTICE is already aggregated by the parent pom's
+                                        ApacheNoticeResourceTransformer; the project's
+                                        top-level LICENSE / NOTICE / licenses/ directory is the
+                                        canonical attribution and is shipped at the repo root. -->
+                                        <exclude>META-INF/DEPENDENCIES</exclude>
+                                        <exclude>META-INF/LICENSE</exclude>
+                                        <exclude>META-INF/LICENSE.txt</exclude>
+                                        <exclude>META-INF/license.txt</exclude>
+                                        <exclude>META-INF/NOTICE</exclude>
+                                        <exclude>META-INF/NOTICE.txt</exclude>
+                                        <exclude>META-INF/licenses/**</exclude>
+                                        <!-- Kotlin compilation metadata: only used by kotlinc
+                                        for cross-module compilation; irrelevant at runtime. -->
+                                        <exclude>META-INF/*.kotlin_module</exclude>
+                                        <!-- ProGuard rules shipped by some libs (e.g. Guava):
+                                        only consumed by ProGuard, irrelevant in this uber-JAR. -->
+                                        <exclude>META-INF/proguard/**</exclude>
+                                        <!-- GraalVM native-image hints: only consumed by the
+                                        native-image build; this uber-JAR runs on the JVM. -->
+                                        <exclude>META-INF/native-image/**</exclude>
+                                        <!-- Quarkus jandex pre-computed annotation indexes
+                                        shipped by the fabric8 kubernetes-* jars; not needed. -->
+                                        <exclude>META-INF/jandex.idx</exclude>
+                                        <!-- Netty release metadata; flink-shaded-netty wins on
+                                        overlap with flink-shaded-zookeeper-3's bundled netty. -->
+                                        <exclude>META-INF/io.netty.versions.properties</exclude>
+                                        <!-- A fresh manifest is produced by the
+                                        ManifestResourceTransformer below, so dropping the inputs
+                                        avoids shade's "META-INF/MANIFEST.MF" overlap warning. -->
+                                        <exclude>META-INF/MANIFEST.MF</exclude>
                                     </excludes>
                                 </filter>
                                 <filter>
                                     <artifact>org.apache.flink:flink-kubernetes</artifact>
                                     <excludes>
                                         <exclude>META-INF/versions/**/com/fasterxml/jackson/core/io/doubleparser/**</exclude>
+                                        <!--
+                                            FlinkConfMountDecorator is intentionally forked under
+                                            flink-kubernetes-operator's source tree
+                                            (org.apache.flink.kubernetes.kubeclient.decorators)
+                                            to override the version shipped by flink-kubernetes.
+                                            Drop the upstream copy so the fork deterministically
+                                            wins, silencing shade's "overlapping classes" warning.
+                                        -->
+                                        <exclude>org/apache/flink/kubernetes/kubeclient/decorators/FlinkConfMountDecorator.class</exclude>
+                                    </excludes>
+                                </filter>
+                                <filter>
+                                    <!--
+                                        flink-autoscaler / flink-kubernetes-operator(-api) /
+                                        flink-autoscaler-standalone all ship intentional forks of
+                                        a handful of org.apache.flink.runtime.rest.messages.*
+                                        classes (see e.g.
+                                        flink-kubernetes-operator/src/main/java/org/apache/flink/runtime/rest/messages/
+                                        and flink-autoscaler/src/main/java/org/apache/flink/runtime/rest/messages/).
+                                        Drop the upstream copies from flink-runtime so the local
+                                        forks deterministically win, silencing shade's
+                                        "overlapping classes" warnings.
+                                    -->
+                                    <artifact>org.apache.flink:flink-runtime</artifact>
+                                    <excludes>
+                                        <exclude>org/apache/flink/runtime/rest/messages/job/metrics/AggregatedMetric.class</exclude>
+                                        <exclude>org/apache/flink/runtime/rest/messages/job/metrics/IOMetricsInfo.class</exclude>
+                                        <exclude>org/apache/flink/runtime/rest/messages/JobExceptionsInfoWithHistory.class</exclude>
+                                        <exclude>org/apache/flink/runtime/rest/messages/JobExceptionsInfoWithHistory$*.class</exclude>
+                                        <exclude>org/apache/flink/runtime/rest/messages/job/JobDetailsInfo.class</exclude>
+                                        <exclude>org/apache/flink/runtime/rest/messages/job/JobDetailsInfo$*.class</exclude>
+                                        <exclude>org/apache/flink/runtime/rest/messages/json/SlotSharingGroupIDDeserializer.class</exclude>
+                                        <exclude>org/apache/flink/runtime/rest/messages/json/SlotSharingGroupIDSerializer.class</exclude>
+                                    </excludes>
+                                </filter>
+                                <filter>
+                                    <!--
+                                        flink-autoscaler also ships its own fork of
+                                        AggregatedMetric (see
+                                        flink-autoscaler/src/main/java/org/apache/flink/runtime/rest/messages/job/metrics/AggregatedMetric.java).
+                                        flink-kubernetes-operator carries the canonical fork
+                                        consumed by the rest of the operator code, so let it win.
+                                    -->
+                                    <artifact>org.apache.flink:flink-autoscaler</artifact>
+                                    <excludes>
+                                        <exclude>org/apache/flink/runtime/rest/messages/job/metrics/AggregatedMetric.class</exclude>
+                                    </excludes>
+                                </filter>
+                                <filter>
+                                    <!--
+                                        flink-shaded-zookeeper-3 re-bundles its own private copy
+                                        of netty under META-INF/native-image / META-INF/io.netty.*
+                                        Drop them so the canonical flink-shaded-netty values win
+                                        deterministically.
+                                    -->
+                                    <artifact>org.apache.flink:flink-shaded-zookeeper-3</artifact>
+                                    <excludes>
+                                        <exclude>META-INF/io.netty.versions.properties</exclude>
+                                        <exclude>META-INF/native-image/io.netty/**</exclude>
+                                    </excludes>
+                                </filter>
+                                <filter>
+                                    <!--
+                                        Both flink-kubernetes-operator and -api ship a default
+                                        log4j2.properties; the operator module's copy is the
+                                        runtime configuration, so drop the api module's.
+                                    -->
+                                    <artifact>org.apache.flink:flink-kubernetes-operator-api</artifact>
+                                    <excludes>
+                                        <exclude>log4j2.properties</exclude>
+                                    </excludes>
+                                </filter>
+                                <filter>
+                                    <!--
+                                        okio and okio-jvm ship the same Kotlin module descriptor;
+                                        keep the one from okio-jvm (the actual JVM artifact) and
+                                        drop okio's.
+                                    -->
+                                    <artifact>com.squareup.okio:okio</artifact>
+                                    <excludes>
+                                        <exclude>META-INF/okio.kotlin_module</exclude>
                                     </excludes>
                                 </filter>
                             </filters>
@@ -292,6 +445,14 @@ under the License.
                                         implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
                                     <mainClass>org.apache.flink.kubernetes.operator.FlinkOperator</mainClass>
                                 </transformer>
+                                <!--
+                                    Properly merge the Log4j2 plugin cache files shipped under
+                                    META-INF/org/apache/logging/log4j/core/config/plugins/
+                                    Log4j2Plugins.dat by both log4j-core and log4j-1.2-api into a
+                                    single combined cache, instead of last-write-wins.
+                                -->
+                                <transformer
+                                        implementation="org.apache.logging.log4j.maven.plugins.shade.transformer.Log4j2PluginCacheFileTransformer"/>
                             </transformers>
                         </configuration>
                     </execution>
@@ -377,6 +538,20 @@ under the License.
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-assembly-plugin</artifactId>
+                <!--
+                    Pinned because the version inherited from the Apache Parent POM (3.2.0)
+                    flags <finalName> as read-only at execution scope only since 3.4+ AND
+                    older versions log "*nix-specific root-relative reference" for any
+                    <outputDirectory> entry in the assembly descriptor.
+                -->
+                <version>3.8.0</version>
+                <configuration>
+                    <!-- finalName must live at plugin scope (or be inherited from
+                    ${project.build.finalName}); placing it inside <execution><configuration>
+                    triggers maven-assembly-plugin's "Parameter 'finalName' is read-only"
+                    warning since 3.4. -->
+                    <finalName>test-plugins</finalName>
+                </configuration>
                 <executions>
                     <execution>
                         <id>create-test-plugin-jar</id>
@@ -385,7 +560,6 @@ under the License.
                             <goal>single</goal>
                         </goals>
                         <configuration>
-                            <finalName>test-plugins</finalName>
                             <attach>false</attach>
                             <descriptors>
                                 <descriptor>src/test/assembly/test-plugins-assembly.xml</descriptor>
diff --git a/flink-kubernetes-operator/src/test/assembly/test-plugins-assembly.xml b/flink-kubernetes-operator/src/test/assembly/test-plugins-assembly.xml
index 3cb8b5d176..785c8c1f68 100644
--- a/flink-kubernetes-operator/src/test/assembly/test-plugins-assembly.xml
+++ b/flink-kubernetes-operator/src/test/assembly/test-plugins-assembly.xml
@@ -25,7 +25,6 @@ under the License.
     <fileSets>
         <fileSet>
             <directory>${project.build.testOutputDirectory}</directory>
-            <outputDirectory>/</outputDirectory>
             <!-- the service impl -->
             <includes>
                 <include>org/apache/flink/kubernetes/operator/validation/TestValidator.class</include>
@@ -37,7 +36,7 @@ under the License.
         <fileSet>
             <!-- declaring the service impl -->
             <directory>${project.basedir}/src/test/resources/META-INF/services</directory>
-            <outputDirectory>/META-INF/services</outputDirectory>
+            <outputDirectory>META-INF/services</outputDirectory>
         </fileSet>
     </fileSets>
 </assembly>
diff --git a/flink-kubernetes-webhook/pom.xml b/flink-kubernetes-webhook/pom.xml
index e5cc0e4d4e..12e4590a8e 100644
--- a/flink-kubernetes-webhook/pom.xml
+++ b/flink-kubernetes-webhook/pom.xml
@@ -101,6 +101,20 @@ under the License.
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-assembly-plugin</artifactId>
+                <!--
+                    Pinned because the version inherited from the Apache Parent POM (3.2.0)
+                    flags <finalName> as read-only at execution scope only since 3.4+ AND
+                    older versions log "*nix-specific root-relative reference" for any
+                    <outputDirectory> entry in the assembly descriptor.
+                -->
+                <version>3.8.0</version>
+                <configuration>
+                    <!-- finalName must live at plugin scope (or be inherited from
+                    ${project.build.finalName}); placing it inside <execution><configuration>
+                    triggers maven-assembly-plugin's "Parameter 'finalName' is read-only"
+                    warning since 3.4. -->
+                    <finalName>test-plugins</finalName>
+                </configuration>
                 <executions>
                     <execution>
                         <id>create-test-plugin-jar</id>
@@ -109,7 +123,6 @@ under the License.
                             <goal>single</goal>
                         </goals>
                         <configuration>
-                            <finalName>test-plugins</finalName>
                             <attach>false</attach>
                             <descriptors>
                                 <descriptor>src/test/assembly/test-plugins-assembly.xml</descriptor>
@@ -130,6 +143,17 @@ under the License.
                         </goals>
                         <configuration>
                             <shadedArtifactAttached>true</shadedArtifactAttached>
+                            <filters combine.children="append">
+                                <filter>
+                                    <!-- A fresh manifest is produced by the
+                                    ManifestResourceTransformer below, so dropping the inputs
+                                    avoids shade's "META-INF/MANIFEST.MF" overlap warning. -->
+                                    <artifact>*:*</artifact>
+                                    <excludes>
+                                        <exclude>META-INF/MANIFEST.MF</exclude>
+                                    </excludes>
+                                </filter>
+                            </filters>
                             <artifactSet>
                                 <includes combine.children="append">
                                     <include>io.javaoperatorsdk:kubernetes-webhooks-framework-core</include>
diff --git a/flink-kubernetes-webhook/src/test/assembly/test-plugins-assembly.xml b/flink-kubernetes-webhook/src/test/assembly/test-plugins-assembly.xml
index 8f974d939d..30991770d2 100644
--- a/flink-kubernetes-webhook/src/test/assembly/test-plugins-assembly.xml
+++ b/flink-kubernetes-webhook/src/test/assembly/test-plugins-assembly.xml
@@ -25,7 +25,6 @@ under the License.
     <fileSets>
         <fileSet>
             <directory>${project.build.testOutputDirectory}</directory>
-            <outputDirectory>/</outputDirectory>
             <!-- the service impl -->
             <includes>
                 <include>org/apache/flink/kubernetes/operator/mutator/TestMutator.class</include>
@@ -35,7 +34,7 @@ under the License.
         <fileSet>
             <!-- declaring the service impl -->
             <directory>${project.basedir}/src/test/resources/META-INF/services</directory>
-            <outputDirectory>/META-INF/services</outputDirectory>
+            <outputDirectory>META-INF/services</outputDirectory>
         </fileSet>
     </fileSets>
 </assembly>
diff --git a/pom.xml b/pom.xml
index f3a0a8bc30..1dd7b2c4d1 100644
--- a/pom.xml
+++ b/pom.xml
@@ -339,7 +339,7 @@ under the License.
             <plugin>
                 <groupId>org.apache.rat</groupId>
                 <artifactId>apache-rat-plugin</artifactId>
-                <version>0.16.1</version><!--$NO-MVN-MAN-VER$-->
+                <version>0.18</version><!--$NO-MVN-MAN-VER$-->
                 <inherited>false</inherited>
                 <executions>
                     <execution>
@@ -351,75 +351,79 @@ under the License.
                 </executions>
                 <configuration>
                     <excludeSubProjects>false</excludeSubProjects>
-                    <numUnapprovedLicenses>0</numUnapprovedLicenses>
-                    <licenses>
-                        <!-- Enforce this license:
-                            Licensed to the Apache Software Foundation (ASF) under one
-                            or more contributor license agreements.  See the NOTICE file
-                            distributed with this work for additional information
-                            regarding copyright ownership.  The ASF licenses this file
-                            to you under the Apache License, Version 2.0 (the
-                            "License"); you may not use this file except in compliance
-                            with the License.  You may obtain a copy of the License at
-                              http://www.apache.org/licenses/LICENSE-2.0
-                            Unless required by applicable law or agreed to in writing,
-                            software distributed under the License is distributed on an
-                            "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-                            KIND, either express or implied.  See the License for the
-                            specific language governing permissions and limitations
-                            under the License.
-                        -->
-                        <license implementation="org.apache.rat.analysis.license.SimplePatternBasedLicense">
-                            <licenseFamilyCategory>AL2 </licenseFamilyCategory>
-                            <licenseFamilyName>Apache License 2.0</licenseFamilyName>
-                            <notes />
-                            <patterns>
-                                <pattern>Licensed to the Apache Software Foundation (ASF) under one</pattern>
-                            </patterns>
-                        </license>
-                    </licenses>
-                    <licenseFamilies>
-                        <licenseFamily implementation="org.apache.rat.license.SimpleLicenseFamily">
-                            <familyName>Apache License 2.0</familyName>
-                        </licenseFamily>
-                    </licenseFamilies>
-                    <excludes>
+                    <!--
+                        Strict Apache License 2.0 enforcement.
+
+                        apache-rat-plugin 0.17 deprecated the inline <families>,
+                        <licenses> and <approvedLicenses> parameters ("Use specific
+                        configuration under <configuration>. See configuration file
+                        documentation."). The custom ruleset now lives in
+                        tools/rat/rat-config.xml and is loaded via <configs> below;
+                        <configurationNoDefaults>true</configurationNoDefaults>
+                        disables apache-rat-core/org/apache/rat/default.xml so the
+                        external file is the ONLY ruleset RAT applies. The result:
+                        - Recognised family: AL only.
+                        - Recognised license: AL2.0 only (matched on the canonical
+                          ASF source-header opener).
+                        - Approved family: AL.
+                        Any other header is reported as Unknown license (Unapproved).
+
+                        Replacements vs the deprecated 0.16 schema (still relevant):
+                          - <numUnapprovedLicenses>0</numUnapprovedLicenses>
+                              -> <counterMaxs><counterMax>Unapproved:0</counterMax></counterMaxs>
+                          - <excludes><exclude>...</exclude></excludes>
+                              -> <inputExcludes><inputExclude>...</inputExclude></inputExcludes>
+
+                        See: https://creadur.apache.org/rat/apache-rat-plugin/check-mojo.html
+                    -->
+                    <configurationNoDefaults>true</configurationNoDefaults>
+                    <configs>
+                        <config>${maven.multiModuleProjectDirectory}/tools/rat/rat-config.xml</config>
+                    </configs>
+                    <counterMaxs>
+                        <counterMax>Unapproved:0</counterMax>
+                    </counterMaxs>
+                    <inputExcludes>
                         <!-- Additional files like .gitignore etc.-->
-                        <exclude>**/.*/**</exclude>
-                        <exclude>**/*.prefs</exclude>
-                        <exclude>**/*.log</exclude>
-                        <exclude>**/dependency-reduced-pom.xml</exclude>
+                        <inputExclude>**/.*/**</inputExclude>
+                        <inputExclude>**/*.prefs</inputExclude>
+                        <inputExclude>**/*.log</inputExclude>
+                        <inputExclude>**/dependency-reduced-pom.xml</inputExclude>
                         <!-- Administrative files in the main trunk. -->
-                        <exclude>**/README.md</exclude>
-                        <exclude>.git/**</exclude>
-                        <exclude>.github/**</exclude>
+                        <inputExclude>**/README.md</inputExclude>
+                        <inputExclude>.git/**</inputExclude>
+                        <inputExclude>.github/**</inputExclude>
                         <!-- Build files -->
-                        <exclude>**/*.iml</exclude>
+                        <inputExclude>**/*.iml</inputExclude>
                         <!-- Generated content -->
-                        <exclude>**/target/**</exclude>
-                        <exclude>apache-maven-3.2.5/**</exclude>
+                        <inputExclude>**/target/**</inputExclude>
+                        <inputExclude>apache-maven-3.2.5/**</inputExclude>
                         <!-- Documentation -->
-                        <exclude>docs/static/font-awesome/**</exclude>
-                        <exclude>docs/resources/**</exclude>
-                        <exclude>docs/public/**</exclude>
-                        <exclude>docs/themes/book/**</exclude>
-                        <exclude>docs/assets/github.css</exclude>
-                        <exclude>docs/static/js/anchor.min.js</exclude>
-                        <exclude>docs/layouts/shortcodes/generated/**</exclude>
+                        <inputExclude>docs/static/font-awesome/**</inputExclude>
+                        <inputExclude>docs/resources/**</inputExclude>
+                        <inputExclude>docs/public/**</inputExclude>
+                        <inputExclude>docs/themes/book/**</inputExclude>
+                        <inputExclude>docs/assets/github.css</inputExclude>
+                        <inputExclude>docs/static/js/anchor.min.js</inputExclude>
+                        <inputExclude>docs/layouts/shortcodes/generated/**</inputExclude>
                         <!-- PyCharm -->
-                        <exclude>**/.idea/**</exclude>
+                        <inputExclude>**/.idea/**</inputExclude>
                         <!-- Generated CRD -->
-                        <exclude>helm/flink-kubernetes-operator/crds/flinkbluegreendeployments.flink.apache.org-v1.yml</exclude>
-                        <exclude>helm/flink-kubernetes-operator/crds/flinkdeployments.flink.apache.org-v1.yml</exclude>
-                        <exclude>helm/flink-kubernetes-operator/crds/flinksessionjobs.flink.apache.org-v1.yml</exclude>
-                        <exclude>helm/flink-kubernetes-operator/crds/flinkstatesnapshots.flink.apache.org-v1.yml</exclude>
-                        <exclude>rio.yml</exclude>
+                        <inputExclude>helm/flink-kubernetes-operator/crds/flinkbluegreendeployments.flink.apache.org-v1.yml</inputExclude>
+                        <inputExclude>helm/flink-kubernetes-operator/crds/flinkdeployments.flink.apache.org-v1.yml</inputExclude>
+                        <inputExclude>helm/flink-kubernetes-operator/crds/flinksessionjobs.flink.apache.org-v1.yml</inputExclude>
+                        <inputExclude>helm/flink-kubernetes-operator/crds/flinkstatesnapshots.flink.apache.org-v1.yml</inputExclude>
+                        <inputExclude>rio.yml</inputExclude>
                         <!-- the licenses that are re-bundled -->
-                        <exclude>**/packaged_licenses/LICENSE.*.txt</exclude>
-                        <exclude>**/licenses/LICENSE*</exclude>
-                        <exclude>**/licenses-binary/LICENSE*</exclude>
-                        <exclude>tools/license/NOTICE-binary_PREAMBLE.txt</exclude>
-                    </excludes>
+                        <inputExclude>**/packaged_licenses/LICENSE.*.txt</inputExclude>
+                        <inputExclude>**/licenses/LICENSE*</inputExclude>
+                        <inputExclude>**/licenses-binary/LICENSE*</inputExclude>
+                        <inputExclude>LICENSE.rsync-deployments</inputExclude>
+                        <inputExclude>tools/license/NOTICE-binary_PREAMBLE.txt</inputExclude>
+                        <!-- Third-party manifests vendored for e2e tests (carry their
+                             upstream license headers, not the ASF AL2.0 header). -->
+                        <inputExclude>e2e-tests/cert-manager.yaml</inputExclude>
+                    </inputExcludes>
                 </configuration>
             </plugin>
 
@@ -449,6 +453,15 @@ under the License.
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-shade-plugin</artifactId>
+                <!--
+                    Pinned centrally so every module shares the same version.
+                    Overrides the older 3.1.1 inherited from the Apache Parent POM.
+                    3.5+ is also required to suppress the spurious
+                    "Discovered module-info.class. Shading will break its strong
+                    encapsulation." warning when JPMS descriptors are filtered out
+                    via <filters> (see MSHADE-460 / MSHADE-441).
+                -->
+                <version>3.6.2</version>
                 <configuration>
                     <transformers combine.children="append">
                         <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer" />
@@ -491,7 +504,7 @@ under the License.
             <plugin>
                 <groupId>org.cyclonedx</groupId>
                 <artifactId>cyclonedx-maven-plugin</artifactId>
-                <version>2.9.0</version>
+                <version>2.9.1</version>
                 <executions>
                     <execution>
                         <phase>package</phase>
diff --git a/tools/rat/rat-config.xml b/tools/rat/rat-config.xml
new file mode 100644
index 0000000000..790e79189b
--- /dev/null
+++ b/tools/rat/rat-config.xml
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+  http://www.apache.org/licenses/LICENSE-2.0
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+<!--
+  apache-rat configuration for the flink-kubernetes-operator project.
+
+  This file replaces the inline <families> / <licenses> / <approvedLicenses>
+  parameters in the root pom.xml, which were deprecated in apache-rat-plugin
+  0.17 ("Use specific configuration under <configuration>. See configuration
+  file documentation."). The pom now references this file via the plugin's
+  <configs> parameter and disables the bundled default configuration via
+  <configurationNoDefaults>true</configurationNoDefaults>, so this is the
+  ONLY ruleset RAT loads.
+
+  Strict Apache License 2.0 enforcement
+  - Single recognised family: AL (Apache License).
+  - Single recognised license:    AL2.0 (Apache License 2.0), matched on the
+    canonical ASF source-header opener
+    "Licensed to the Apache Software Foundation (ASF) under one".
+  - Single approved family: AL.
+  Any source file that does not contain that header text is reported as
+  "Unknown license (Unapproved)" and trips the Unapproved:0 counter declared
+  in the pom, failing the build.
+
+  Schema reference: apache-rat-core/org/apache/rat/default.xml
+                    https://creadur.apache.org/rat/apache-rat-plugin/check-mojo.html
+-->
+<rat-config>
+    <families>
+        <family id="AL" name="Apache License" />
+    </families>
+    <licenses>
+        <license family="AL" id="AL2.0" name="Apache License 2.0">
+            <text>Licensed to the Apache Software Foundation (ASF) under one</text>
+        </license>
+    </licenses>
+    <approved>
+        <family license_ref="AL" />
+    </approved>
+</rat-config>
+