Maven: test dependencies sometimes missing when executing with "-T1C"

[theit]

Precondition

• I checked the issues list for existing open or closed reports of the same problem.

Describe the bug
We have a large multi-module project; several modules in the build have dependencies to others in the reactor. The dependency check plugin is contained in an extra profile called dependency-check so that reports can be enabled on demand and don't slow down a regular build. The goal used in the profile is aggregate (see below).

When executing a normal build via mvn -Pdependency-check clean verify, everything works well. When executing with an additional -T1C, the build fails when Maven compiles test code in a module used by others:

[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/FilterTest.java:[10,29] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/FilterTest.java:[12,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/FilterTest.java:[12,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/FilterTest.java:[13,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/FilterTest.java:[13,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[3,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[3,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[4,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[4,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[5,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[5,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[6,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[6,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[7,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[7,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/ReaderTest.java:[15,29] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[7,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[7,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[8,36] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[8,1] Statischer Import nur aus Klassen und Schnittstellen
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[18,29] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[28,21] Package net.jqwik.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[29,21] Package net.jqwik.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[30,21] Package net.jqwik.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[31,21] Package net.jqwik.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[32,21] Package net.jqwik.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[33,33] Package net.jqwik.api.constraints ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[34,31] Package net.jqwik.api.lifecycle ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[35,29] Package org.junit.jupiter.api ist nicht vorhanden
[ERROR] .../app/app-commons/src/test/java/com/example/commons/test/config/moduleProperties/PropsTest.java:[288,9] Symbol nicht gefunden

Test dependencies suddenly aren't available, and I honestly don't know why.

When being used in combination with the maven-turbo-builder extension, the build fails later in another downstream module that consumes the above one (that now compiles!), but also when compiling test code. The messages are more or less similar, i.e. packages from test dependencies are missing such as org.junit.jupiter.api, org.mockito, org.eclipse.jetty.* etc.

Everything compiles fine when I either use the check goal instead of aggregate or when I omit -T1C when using aggregate.

Version of dependency-check used
The problem occurs using version 13.0.0 of the Maven plugin

Log file
Error messages see above.

To Reproduce
The code is internal so I unfortunately cannot create a reproducer. I've added the below profile to another multi-module project that then shows the same behavior in some downstream module when compiling test code.

Expected behavior
Reports are generated without build failures when Maven compiles test classes.

Additional context
Excerpt from the pom.xml:

<profiles>
	<profile>
		<id>dependency-check</id>
		<build>
			<plugins>
				<plugin>
					<groupId>org.owasp</groupId>
					<artifactId>dependency-check-maven</artifactId>
					<configuration>
						<assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
						<nodeAuditAnalyzerEnabled>false</nodeAuditAnalyzerEnabled>
						<nodeAnalyzerEnabled>false</nodeAnalyzerEnabled>
						<nvdApiKey>${env.NVD_API_KEY}</nvdApiKey>
						<ossIndexServerId>ossindex</ossIndexServerId>
					</configuration>
					<executions>
						<execution>
							<goals>
								<goal>aggregate</goal>
							</goals>
						</execution>
					</executions>
				</plugin>
			</plugins>
		</build>
	</profile>
</profiles>


<build>
	<pluginManagement>
		<plugins>
			<plugin>
				<groupId>org.owasp</groupId>
				<artifactId>dependency-check-maven</artifactId>
				<version>13.0.0</version>
			</plugin>
		</plugins>
	</pluginManagement>
</build>


<dependencyManagement>
	<dependencies>
		<dependency>
			<groupId>org.junit</groupId>
			<artifactId>junit-bom</artifactId>
			<version>6.1.3</version>
			<type>pom</type>
			<scope>import</scope>
		</dependency>
		<dependency>
			<groupId>org.mockito</groupId>
			<artifactId>mockito-bom</artifactId>
			<version>5.23.0</version>
			<type>pom</type>
			<scope>import</scope>
		</dependency>
		<dependency>
			<groupId>org.xmlunit</groupId>
			<artifactId>xmlunit-core</artifactId>
			<version>2.13.0</version>
		</dependency>
		<dependency>
			<groupId>org.xmlunit</groupId>
			<artifactId>xmlunit-assertj</artifactId>
			<version>2.13.0</version>
		</dependency>
		<dependency>
			<groupId>net.jqwik</groupId>
			<artifactId>jqwik</artifactId>
			<version>1.10.1</version>
		</dependency>
		<dependency>
			<groupId>org.eclipse.jetty</groupId>
			<artifactId>jetty-bom</artifactId>
			<version>12.1.12</version>
			<scope>import</scope>
			<type>pom</type>
		</dependency>
	</dependencies>
</dependencyManagement>

Tested with

• Maven 3.9.16, 3.10.0-rc1 and 4.0.0-rc6.
• Eclipse Temurin 25.0.4 and 26.0.1
• Windows 11 24H2

Fun fact:
I added the above profile to another multi-module project. Executions with Maven 3.x failed; 4.0.0-rc6 seems to work, even Maven mvnd 1.0.6 works (although the very first invocation failed, but no one after killing the daemon via mvnd --stop)...
It seems to me that there's some race condition hidden somewhere but I can't figure out where (and why).

[chadlwilson]

Did this ever work on an earlier version? I somehow doubt multi-threaded Maven is supported or tested.

Is the profile relevant or is it just the multithreading?

It also shouldnt have much impact to my knowledge, if working on top of an existing maven csche with resolved dependencies. ODC has its own threading.

And can't see why compiling code would be necessary unless that is part of your other activated profiles/default goals independent of ODC.

The code is internal so I unfortunately cannot create a reproducer.

Sorry, why does this mean you cannot create a sample project reproducer? If we can't see what you're seeing we don't have anything to work with.

[theit]

Did this ever work on an earlier version? I somehow doubt multi-threaded Maven is supported or tested.

We're using multi-threaded invocation in a couple of multi-module projects to speed up the whole build process; everything works quite well. We haven't seen any problems so far.
Ok, you only have to ensure that plugins you're using are marked as thread-safe.

Is the profile relevant or is it just the multithreading?

The dependency-check plugin is only put into a profile so that it doesn't extend the normal build time (which is - without multi-threading - already a couple of minutes). The problem arises with multithreading.

The code is internal so I unfortunately cannot create a reproducer.

Sorry, why does this mean you cannot create a sample project reproducer? If we can't see what you're seeing we don't have anything to work with.

It took some time, but I figured out a reproducer:

• checkout the source code of Apache Log4J 2 (https://github.com/apache/logging-log4j2.git)
• checkout the tag rel/2.25.4
• add the following to logging-parent/pom.xml:

diff --git a/log4j-parent/pom.xml b/log4j-parent/pom.xml
index fea7d2293a..6b8d1fbdf2 100644
--- a/log4j-parent/pom.xml
+++ b/log4j-parent/pom.xml
@@ -1326,7 +1326,32 @@
       </build>
 
     </profile>
-
+    <profile>
+      <id>dependency-check</id>
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.owasp</groupId>
+            <artifactId>dependency-check-maven</artifactId>
+            <version>13.0.0</version>
+            <configuration>
+              <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
+              <nodeAuditAnalyzerEnabled>false</nodeAuditAnalyzerEnabled>
+              <nodeAnalyzerEnabled>false</nodeAnalyzerEnabled>
+              <nvdApiKey>${env.NVD_API_KEY}</nvdApiKey>
+              <ossIndexServerId>ossindex</ossIndexServerId>
+            </configuration>
+            <executions>
+              <execution>
+                <goals>
+                  <goal>aggregate</goal>
+                </goals>
+              </execution>
+            </executions>
+          </plugin>
+        </plugins>
+      </build>
+    </profile>

This works:

• mvn clean verify
• mvn -T1C clean verify
• mvn -Pdependency-check clean verify

mvn -T1C -Pdependency-check clean verify fails:

(...)
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Apache Log4j BOM 2.25.4:
[INFO] 
[INFO] Apache Log4j BOM ................................... SUCCESS [  8.796 s]
[INFO] Apache Log4j Parent ................................ SUCCESS [  6.748 s]
[INFO] Apache Log4j API Java 9 support .................... SUCCESS [ 12.242 s]
[INFO] Apache Log4j API ................................... SUCCESS [ 14.854 s]
[INFO] Apache Log4j Implementation Java 9 support ......... SUCCESS [ 26.190 s]
[INFO] Apache Log4j Core .................................. SUCCESS [ 50.126 s]
[INFO] Apache Log4j API Tests ............................. SUCCESS [ 42.934 s]
[INFO] Apache Log4j Core Tests ............................ FAILURE [  5.257 s]
[INFO] Apache Log4j 1.x Compatibility API ................. SKIPPED
(...)
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.14.0:testCompile (default-testCompile) on project log4j-core-test: Compilation failure: Compilation failure: 
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/MarkerMixInJsonTest.java:[19,38] package com.fasterxml.jackson.databind does not exist
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/MarkerMixInTest.java:[23,34] package com.fasterxml.jackson.core does not exist
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/MarkerMixInTest.java:[24,38] package com.fasterxml.jackson.databind does not exist
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/MarkerMixInTest.java:[25,38] package com.fasterxml.jackson.databind does not exist
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/MarkerMixInTest.java:[26,38] package com.fasterxml.jackson.databind does not exist
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/MarkerMixInJsonTest.java:[27,15] cannot find symbol
[ERROR]   symbol:   class ObjectMapper
[ERROR]   location: class org.apache.logging.log4j.MarkerMixInJsonTest
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/MarkerMixInTest.java:[39,13] cannot find symbol
[ERROR]   symbol:   class ObjectReader
[ERROR]   location: class org.apache.logging.log4j.MarkerMixInTest
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/MarkerMixInTest.java:[40,13] cannot find symbol
[ERROR]   symbol:   class ObjectWriter
[ERROR]   location: class org.apache.logging.log4j.MarkerMixInTest
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/MarkerMixInTest.java:[50,24] cannot find symbol
[ERROR]   symbol:   class ObjectMapper
[ERROR]   location: class org.apache.logging.log4j.MarkerMixInTest
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/MarkerMixInTest.java:[77,69] cannot find symbol
[ERROR]   symbol:   class JsonProcessingException
[ERROR]   location: class org.apache.logging.log4j.MarkerMixInTest
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/MarkerMixInXmlTest.java:[27,15] cannot find symbol
[ERROR]   symbol:   class ObjectMapper
[ERROR]   location: class org.apache.logging.log4j.MarkerMixInXmlTest
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/MarkerMixInYamlTest.java:[27,15] cannot find symbol
[ERROR]   symbol:   class ObjectMapper
[ERROR]   location: class org.apache.logging.log4j.MarkerMixInYamlTest
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/core/EventParameterMemoryLeakTest.java:[36,32] package org.junitpioneer.jupiter does not exist
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/core/LoggerContextTest.java:[20,26] package org.mockito does not exist
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/core/LoggerContextTest.java:[20,1] static import only from classes and interfaces
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/core/LoggerContextTest.java:[21,26] package org.mockito does not exist
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/core/LoggerContextTest.java:[21,1] static import only from classes and interfaces
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/core/LoggerContextTest.java:[22,26] package org.mockito does not exist
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/core/LoggerContextTest.java:[22,1] static import only from classes and interfaces
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/core/LoggerContextTest.java:[39,32] package org.junitpioneer.jupiter does not exist
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/core/LoggerMessageFactoryCustomizationTest.java:[29,32] package org.junitpioneer.jupiter does not exist
[ERROR] /Users/thorsten/git/logging-log4j2/log4j-core-test/src/test/java/org/apache/logging/log4j/core/LoggerMessageFactoryCustomizationTest.java:[31,2] cannot find symbol
[ERROR]   symbol: class SetSystemProperty
(...)

Environment:

thorsten:logging-log4j2 % mvn --version
Picked up JAVA_TOOL_OPTIONS: -Duser.language=en
Apache Maven 3.9.16 (2bdd9fddda4b155ebf8000e807eb73fd829a51d5)
Maven home: /Users/thorsten/.sdkman/candidates/maven/current
Java version: 17.0.20, vendor: Eclipse Adoptium, runtime: /Users/thorsten/.sdkman/candidates/java/17.0.20-tem
Default locale: en_DE, platform encoding: UTF-8
OS name: "mac os x", version: "26.6.2", arch: "aarch64", family: "mac"

[chadlwilson]

Thx I'll take a look in a bit.

I ask about profiles to simplify the problem and reduce debugging complexity. Mavens execution model is complicated. If the issue is not reproducible without profiles then we know it's something to do with your profiles/config.

Did you look at https://dependency-check.github.io/DependencyCheck/dependency-check-maven/index.html ? According to that aggregate should only be defined in reporting section, not normal build plugins.

[theit]

Did you look at https://dependency-check.github.io/DependencyCheck/dependency-check-maven/index.html ? According to that aggregate should only be defined in reporting section, not normal build plugins.

Yes, but I haven't read that aggregate should only be used in the reporting section.
I'm normally not generating a site for the project; this is something we don't use (nobody has a look at that 😎 ). Apart from that this slows down the build extremely (actually 3:51min vs 1.37min with the dependency-check profile active).
I guess I'll stick with check instead of aggregate in the meantime.

[chadlwilson]

There is an issue here somewhere where Jeremy states this I believe, but can't find it right now.

According to https://dependency-check.github.io/DependencyCheck/dependency-check-maven/aggregate-mojo.html

• This goal should be used as a Maven report
• The goal is thread-safe and supports parallel builds.

So it does seem it was validated with parallel builds at some point. Perhaps only as a reporting goal though. And entirely possible it has regressed (i'll check whether there are automated tests for this specific combination later)

Which intuitively seems to makes sense - it needs results across all projects to then have a place to merge them together? Maven lifecycle makes this difficult so I believe a reporting plugin is the way to do it not able to rely on sequenced module builds. It probably should fail fast (or warn) if trying to use an incorrect combination at least.

Switching to a reporting plugin should be trivial to test. Should just need to wrap with <reporting>.

The point of aggregate is to produce one big report across all modules from the check results of the individual modules, so it seems that type of plugin is appropriate. Normal aggregator goals/are not well documented in upstream Maven and a mess, IIRC

Apart from that this slows down the build extremely (actually 3:51min vs 1.37min with the dependency-check profile active).

Assuming you have an existing cached database possibly because it's re-running over and over and doing duplicate work in parallel, if it's not supposed to be used that way. or it's applying to the child modules rather than solely to the parent.