dependency-check / dependency-check/DependencyCheck
Maven: test dependencies sometimes missing when executing with "-T1C"
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
**Precondition**
- [x] I checked the issues list for existing open or closed reports of the same problem.
**Describe the bug**
We have a large multi-module project; several modules in the build have dependencies to others in the reactor. The dependency check plugin is contained in an extra profile called `dependency-check` so that reports can be enabled on demand and don't slow down a regular build. The goal used in the profile is `aggregate` (see below).
When executing a normal build via `mvn -Pdependency-check clean verify`, everything works well. When executing with an additional `-T1C`, the build fails when Maven compiles test code in a module used by others:
```
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/FilterTest.java:[10,29] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/FilterTest.java:[12,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/FilterTest.java:[12,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/FilterTest.java:[13,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/FilterTest.java:[13,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[3,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[3,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[4,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[4,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[5,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[5,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[6,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[6,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[7,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[7,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[15,29] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[7,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[7,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[8,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[8,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[18,29] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[28,21] Package net.jqwik.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[29,21] Package net.jqwik.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[30,21] Package net.jqwik.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[31,21] Package net.jqwik.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[32,21] Package net.jqwik.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[33,33] Package net.jqwik.api.constraints ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[34,31] Package net.jqwik.api.lifecycle ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[35,29] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[288,9] Symbol nicht gefunden
```
Test dependencies suddenly aren't available, and I honestly don't know why.
When being used in combination with the maven-turbo-builder extension, the build fails later in another downstream module that consumes the above one (that now compiles!), but also when compiling test code. The messages are more or less similar, i.e. packages from test dependencies are missing such as `org.junit.jupiter.api`, `org.mockito`, `org.eclipse.jetty.*` etc.
Everything compiles fine when I either use the `check` goal instead of `aggregate` or when I omit `-T1C` when using ` aggregate`.
**Version of dependency-check used**
The problem occurs using version 13.0.0 of the Maven plugin
**Log file**
Error messages see above.
**To Reproduce**
The code is internal so I unfortunately cannot create a reproducer. I've added the below profile to another multi-module project that then shows the same behavior in some downstream module when compiling test code.
**Expected behavior**
Reports are generated without build failures when Maven compiles test classes.
**Additional context**
Excerpt from the `pom.xml`:
```xml
dependency-check
org.owasp
dependency-check-maven
false
false
false
${env.NVD_API_KEY}
ossindex
aggregate
org.owasp
dependency-check-maven
13.0.0
org.junit
junit-bom
6.1.3
pom
import
org.mockito
mockito-bom
5.23.0
pom
import
org.xmlunit
xmlunit-core
2.13.0
org.xmlunit
xmlunit-assertj
2.13.0
net.jqwik
jqwik
1.10.1
org.eclipse.jetty
jetty-bom
12.1.12
import
pom
```
Tested with
- Maven 3.9.16, 3.10.0-rc1 and 4.0.0-rc6.
- Eclipse Temurin 25.0.4 and 26.0.1
- Windows 11 24H2
Fun fact:
I added the above profile to another multi-module project. Executions with Maven 3.x failed; 4.0.0-rc6 seems to work, even Maven mvnd 1.0.6 works (although the very first invocation failed, but no one after killing the daemon via `mvnd --stop`)...
It seems to me that there's some race condition hidden somewhere but I can't figure out where (and why).
Contributor guide
Research direction
Start with the dependency-check profile in pom.xml and compare the aggregate and check goals under Maven 3.x with and without -T1C. Investigate the Maven plugin's aggregate execution and its interaction with the maven-turbo-builder extension, using the reported missing test dependencies as the failure signal. Done means multi-module test compilation succeeds and reports are generated without failures.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system, devtools
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100