maven-surefire manages transitive dependency of junit-platform-engine to version 1.9.3 which conflicts with junit-jupiter-engine 5.10.2

[kwin]

Steps to reproduce

The JUnit 5 BOM for version 5.10.2 manages version 1.10.2 of junit-platform-engine.
However the JUnit BOM used in maven-surefire-plugin (even of the most recent 3.2.5) is 5.9.3 (https://github.com/apache/maven-surefire/blob/2fed802397f8c7de4cfc72f49ab4565e72f7aab7/pom.xml#L315), using version 1.9.3 of junit-platform-engine.

When now explicitly upgrading the junit-jupiter-engine version used by maven-surefire-plugin via

<plugin>
  <artifactId>maven-surefire-plugin</artifactId>
  <dependencies>
    <dependency>
      <groupId>org.junit.jupiter</groupId>
      <artifactId>junit-jupiter-engine</artifactId>
      <version>5.10.2</version>
    </dependency>
  </dependencies>
</plugin>

with just having junit-jupiter-api:5.10.2 in the test classpath the following error is emitted

[ERROR] JUnit Jupiter.JUnit Jupiter -- Time elapsed: 0 s <<< ERROR!
java.lang.NoClassDefFoundError: org/junit/platform/engine/support/store/NamespacedHierarchicalStore$CloseAction
	at org.junit.jupiter.engine.descriptor.AbstractExtensionContext.<clinit>(AbstractExtensionContext.java:43)
	at org.junit.jupiter.engine.descriptor.JupiterEngineDescriptor.prepare(JupiterEngineDescriptor.java:57)
	at org.junit.jupiter.engine.descriptor.JupiterEngineDescriptor.prepare(JupiterEngineDescriptor.java:31)
	at org.junit.platform.engine.support.hierarchical.NodeTestTask.lambda$prepare$2(NodeTestTask.java:123)
	at org.junit.platform.engine.support.hierarchical.ThrowableCollector.execute(ThrowableCollector.java:73)
	at org.junit.platform.engine.support.hierarchical.NodeTestTask.prepare(NodeTestTask.java:123)
	at org.junit.platform.engine.support.hierarchical.NodeTestTask.execute(NodeTestTask.java:90)
	at org.junit.platform.engine.support.hierarchical.SameThreadHierarchicalTestExecutorService.submit(SameThreadHierarchicalTestExecutorService.java:35)
	at org.junit.platform.engine.support.hierarchical.HierarchicalTestExecutor.execute(HierarchicalTestExecutor.java:57)
	at org.junit.platform.engine.support.hierarchical.HierarchicalTestEngine.execute(HierarchicalTestEngine.java:54)
	at org.junit.platform.launcher.core.EngineExecutionOrchestrator.execute(EngineExecutionOrchestrator.java:147)
	at org.junit.platform.launcher.core.EngineExecutionOrchestrator.execute(EngineExecutionOrchestrator.java:127)
	at org.junit.platform.launcher.core.EngineExecutionOrchestrator.execute(EngineExecutionOrchestrator.java:90)
	at org.junit.platform.launcher.core.EngineExecutionOrchestrator.lambda$execute$0(EngineExecutionOrchestrator.java:55)
	at org.junit.platform.launcher.core.EngineExecutionOrchestrator.withInterceptedStreams(EngineExecutionOrchestrator.java:102)
	at org.junit.platform.launcher.core.EngineExecutionOrchestrator.execute(EngineExecutionOrchestrator.java:54)
	at org.junit.platform.launcher.core.DefaultLauncher.execute(DefaultLauncher.java:114)
	at org.junit.platform.launcher.core.DefaultLauncher.execute(DefaultLauncher.java:86)
	at org.junit.platform.launcher.core.DefaultLauncherSession$DelegatingLauncher.execute(DefaultLauncherSession.java:86)
	at org.apache.maven.surefire.junitplatform.LazyLauncher.execute(LazyLauncher.java:56)
	at org.apache.maven.surefire.junitplatform.JUnitPlatformProvider.execute(JUnitPlatformProvider.java:184)
	at org.apache.maven.surefire.junitplatform.JUnitPlatformProvider.invokeAllTests(JUnitPlatformProvider.java:148)
	at org.apache.maven.surefire.junitplatform.JUnitPlatformProvider.invoke(JUnitPlatformProvider.java:122)
	at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:385)
	at org.apache.maven.surefire.booter.ForkedBooter.execute(ForkedBooter.java:162)
	at org.apache.maven.surefire.booter.ForkedBooter.run(ForkedBooter.java:507)
	at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:495)
Caused by: java.lang.ClassNotFoundException: org.junit.platform.engine.support.store.NamespacedHierarchicalStore$CloseAction
	at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:581)
	at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:178)
	at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:527)
	... 27 more

This is due to the following classpath being used by maven-surefire-plugin:

[INFO] --- surefire:3.2.2:test (default-test) @ doxia-converter ---
[DEBUG] Dependency collection stats {ConflictMarker.analyzeTime=62708, ConflictMarker.markTime=28792, ConflictMarker.nodeCount=94, ConflictIdSorter.graphTime=19292, ConflictIdSorter.topsortTime=17458, ConflictIdSorter.conflictIdCount=48, ConflictIdSorter.conflictIdCycleCount=0, ConflictResolver.totalTime=382250, ConflictResolver.conflictItemCount=92, DfDependencyCollector.collectTime=35588250, DfDependencyCollector.transformTime=530209}
[DEBUG] org.apache.maven.plugins:maven-surefire-plugin:jar:3.2.2
[DEBUG]    org.junit.jupiter:junit-jupiter-engine:jar:5.10.2:runtime
[DEBUG]       org.junit.platform:junit-platform-engine:jar:1.9.3:runtime (version managed from default)
...

Importing the JUnit 5 BOM in dependencyManagement does not help, because dependencyManagement does not apply to plugin dependencies (https://issues.apache.org/jira/browse/MNG-2496).

Workaround:

Use

<dependency>
  <groupId>org.junit.jupiter</groupId>
  <artifactId>junit-jupiter</artifactId>
  <scope>test</scope>
</dependency>

as that forces maven-surefire-plugin to reuse the version 1.10.2 of junit-platform-engine from the test classpath instead of using 1.9.3.

This is probably a regression of https://issues.apache.org/jira/browse/SUREFIRE-2177 and requires a fix in Maven, but having this as reference here might help other users.

Context

• Used versions (Jupiter/Vintage/Platform): 5.10.2
• Build Tool/IDE: Maven 3.9.6 on CLI

[kwin]

I created https://issues.apache.org/jira/browse/SUREFIRE-2240 to track the issue upstream.

[marcphilipp]

Does adding the JUnit 5.10.2 BOM to the build dependencies help?

[kwin]

@marcphilipp As said before

Importing the JUnit5 BOM in dependencyManagement does not help, because depMgmt does not apply to plugin dependencies (https://issues.apache.org/jira/browse/MNG-2496).

[marcphilipp]

Instead of using plugin dependencies, could the engine be declared in test scope?

[kwin]

I don’t want to have classes in the test compile classpath which I don’t call in my tests…

[marcphilipp]

Makes sense to me. While that doesn't help you, Gradle has a testRuntimeOnly "scope" for this.

Closing this issue as Maven's dependency management is the root cause of this problem and, as far as I'm aware, there's nothing we can do in JUnit to avoid this situation.