'Dependency not found' with release 17 while analyzing

Question

One of the project that I was looking into has these relevant configurations:

<maven.compiler.source>1.8</maven.compiler.source>
<maven.compiler.target>1.8</maven.compiler.target>

<plugin>
    <artifactId>maven-dependency-plugin</artifactId>
    <version>3.2.0</version>
    <configuration>
        <failOnWarning>true</failOnWarning>
    </configuration>
    <executions>
        <execution>
            <goals>
                <goal>analyze-only</goal>
            </goals>
        </execution>
    </executions>
</plugin>


<dependency>
    <groupId>org.hamcrest</groupId>
    <artifactId>hamcrest</artifactId>
    <version>2.2</version>
    <!-- not scoped to test -->
</dependency>

On executing mvn clean verify (apache-maven-3.6.3, java : 17-ea), the build succeeds as expected. I have now, made a change in the properties to replace the source and target with release as:

<maven.compiler.release>17</maven.compiler.release>

and the logs on the terminal read

[INFO] --- maven-dependency-plugin:3.2.0:analyze-only (default) @ java-8-matchers ---
[WARNING] Non-test scoped test only dependencies found:
[WARNING]    org.hamcrest:hamcrest:jar:2.2:compile

leading to a failure(because of warning)! Why/How is the dependency treated differently with the upgrade in the Java version? Any way to fix this?

---

If it might be of help, the debug logs for this goal reads:

[DEBUG] Configuring mojo org.apache.maven.plugins:maven-dependency-plugin:3.2.0:analyze-only from plugin realm ClassRealm[plugin>org.apache.maven.plugins:maven-dependency-plugin:3.2.0, parent: jdk.internal.loader.ClassLoaders$AppClassLoader@579bb367]
[DEBUG] Configuring mojo 'org.apache.maven.plugins:maven-dependency-plugin:3.2.0:analyze-only' with basic configurator -->
[DEBUG]   (f) analyzer = default
[DEBUG]   (f) baseDir = .../java-8-matchers
[DEBUG]   (f) failOnWarning = true
[DEBUG]   (f) ignoreNonCompile = false
[DEBUG]   (f) ignoreUnusedRuntime = false
[DEBUG]   (f) outputDirectory = .../java-8-matchers/target
[DEBUG]   (f) outputXML = false
[DEBUG]   (f) project = MavenProject: uk.co.probablyfine:java-8-matchers:2.0.0-SNAPSHOT @ .../java-8-matchers/pom.xml
[DEBUG]   (f) scriptableFlag = $$%%%
[DEBUG]   (f) scriptableOutput = false
[DEBUG]   (f) skip = false
[DEBUG]   (f) verbose = false
[DEBUG] -- end configuration --
[WARNING] Non-test scoped test only dependencies found:
[WARNING]    org.hamcrest:hamcrest:jar:2.2:compile

[ERROR] Failed to execute goal org.apache.maven.plugins:maven-dependency-plugin:3.2.0:analyze-only (default) on project java-8-matchers: Dependency problems found -> [Help 1]
org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal org.apache.maven.plugins:maven-dependency-plugin:3.2.0:analyze-only (default) on project java-8-matchers: Dependency problems found
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:215)

Reproduce using:

1. Git checkout this branch.
2. Configure maven to use Java-17.
3. Edit the failOnWarning property to true.
4. Execute mvn clean verify.

Answer 1

After investigation I figured out that issue is in upgrading maven-dependency-plugin from version 3.1.2 to 3.2.0, because in new version of plugin was added new property for analyzing: testArtifactsWithNonTestScope you can compare screenshots of code below: Version 3.1.2:

Version 3.2.0:

I debugged the full analyzer dependencies process in the plugin and found that dependency:

<dependency>
   <groupId>org.hamcrest</groupId>
   <artifactId>hamcrest</artifactId>
   <version>2.2</version>
</dependency>

is passed to testArtifactsWithNonTestScope set of artifacts because class org.hamcrest.MatcherAssert is used only in test classes. Of course that behavior is incorrect, because other classes from hamcrest dependecy are present in non test classes - definitely there is defect in maven-dependency-plugin.

P.S.

Like proof of my idea you can change one of non test classes in following way:

...
import static org.hamcrest.MatcherAssert.assertThat;
import static org.hamcrest.Matchers.is;
...

public final class Java8Matchers {

    public static void customAssert(String reason, boolean assertion) {
        assertThat(reason, assertion);
    }
    
    ...
}

As you can see I added new method with usage of org.hamcrest.MatcherAssert in Java8Matchers and after that build process will be finished successfully.

---

After all the above aspects, you have the following ways to solve the issue:

• use the latest version of java which is supported by plugin 3.1.2 and do not update the plugin until the bug is fixed
• turn off the analyzer for the build and wait for the fix for the analyzer

Answer 2

This problem is not related to the Java version, it also fails with Java 16, to me it seems that it appeared when the maven-dependency-plugin was upgraded from 3.1.2 to 3.2.0 by dependabot, downgrading solves the problem.

Answer 3

I solved this problem by cloning the maven-dependency-plugin from the following repo https://github.com/apache/maven-dependency-plugin/tree/maven-dependency-plugin-3.2.0 and I built it myself. Then I used the 3.3.0-SNAPSHOT version in my project!