dependency-check / dependency-check/DependencyCheck

Maven: test dependencies sometimes missing when executing with "-T1C"

Open
#8,755 5 comments 0 reactions 0 assignees View on GitHub
bug maven pending more information
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

**Precondition**
- [x] I checked the issues list for existing open or closed reports of the same problem.

**Describe the bug**
We have a large multi-module project; several modules in the build have dependencies to others in the reactor. The dependency check plugin is contained in an extra profile called `dependency-check` so that reports can be enabled on demand and don't slow down a regular build. The goal used in the profile is `aggregate` (see below).

When executing a normal build via `mvn -Pdependency-check clean verify`, everything works well. When executing with an additional `-T1C`, the build fails when Maven compiles test code in a module used by others:

```
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/FilterTest.java:[10,29] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/FilterTest.java:[12,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/FilterTest.java:[12,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/FilterTest.java:[13,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/FilterTest.java:[13,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[3,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[3,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[4,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[4,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[5,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[5,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[6,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[6,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[7,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[7,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[15,29] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[7,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[7,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[8,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[8,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[18,29] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[28,21] Package net.jqwik.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[29,21] Package net.jqwik.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[30,21] Package net.jqwik.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[31,21] Package net.jqwik.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[32,21] Package net.jqwik.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[33,33] Package net.jqwik.api.constraints ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[34,31] Package net.jqwik.api.lifecycle ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[35,29] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[288,9] Symbol nicht gefunden
```
Test dependencies suddenly aren't available, and I honestly don't know why.

When being used in combination with the maven-turbo-builder extension, the build fails later in another downstream module that consumes the above one (that now compiles!), but also when compiling test code. The messages are more or less similar, i.e. packages from test dependencies are missing such as `org.junit.jupiter.api`, `org.mockito`, `org.eclipse.jetty.*` etc.

Everything compiles fine when I either use the `check` goal instead of `aggregate` or when I omit `-T1C` when using ` aggregate`.

**Version of dependency-check used**
The problem occurs using version 13.0.0 of the Maven plugin

**Log file**
Error messages see above.

**To Reproduce**
The code is internal so I unfortunately cannot create a reproducer. I've added the below profile to another multi-module project that then shows the same behavior in some downstream module when compiling test code.

**Expected behavior**
Reports are generated without build failures when Maven compiles test classes.

**Additional context**
Excerpt from the `pom.xml`:

```xml


dependency-check



org.owasp
dependency-check-maven

false
false
false
${env.NVD_API_KEY}
ossindex




aggregate









org.owasp
dependency-check-maven
13.0.0




org.junit
junit-bom
6.1.3
pom
import


org.mockito
mockito-bom
5.23.0
pom
import


org.xmlunit
xmlunit-core
2.13.0


org.xmlunit
xmlunit-assertj
2.13.0


net.jqwik
jqwik
1.10.1


org.eclipse.jetty
jetty-bom
12.1.12
import
pom

```

Tested with
- Maven 3.9.16, 3.10.0-rc1 and 4.0.0-rc6.
- Eclipse Temurin 25.0.4 and 26.0.1
- Windows 11 24H2

Fun fact:
I added the above profile to another multi-module project. Executions with Maven 3.x failed; 4.0.0-rc6 seems to work, even Maven mvnd 1.0.6 works (although the very first invocation failed, but no one after killing the daemon via `mvnd --stop`)...
It seems to me that there's some race condition hidden somewhere but I can't figure out where (and why).

Contributor guide

Open the contributing guide

Research direction

Start with the dependency-check profile in pom.xml and compare the aggregate and check goals under Maven 3.x with and without -T1C. Investigate the Maven plugin's aggregate execution and its interaction with the maven-turbo-builder extension, using the reported missing test dependencies as the failure signal. Done means multi-module test compilation succeeds and reports are generated without failures.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system, devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.