Offline Build for JUnit 5 Project Fails - Missing `surefire-junit-platform:jar` dependency

[adambkaplan]

Affected version

3.5.4

Bug description

Description

I have a project that is set up to use JUnit 5 and the Maven Surefire plugin, per the official documentation.
When trying to simulate a pre-fetched "offline build" workflow, builds that run tests fail because the Surefire plugin attempts to dynamically download the surefire-junit-platform JAR as a dependency.

Expected Behavior

Surefire plugin declares all necessary dependencies for go-offline (and similar tools/plugins) to work, and/or the documentation provides necessary instructions for all dependencies to be declared up front.

Actual Behavior

Build fails:

$ mvn clean package -o -Dmaven.repo.local=tmp-local
....
[INFO] --- surefire:3.5.4:test (default-test) @ single-module ---
[INFO] Using auto detected provider org.apache.maven.surefire.junitplatform.JUnitPlatformProvider
[WARNING] The POM for org.apache.maven.surefire:surefire-junit-platform:jar:3.5.4 is missing, no dependency information available
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  0.748 s
[INFO] Finished at: 2026-01-28T15:20:37-05:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-surefire-plugin:3.5.4:test (default-test) on project single-module: The following artifacts could not be resolved: org.apache.maven.surefire:surefire-junit-platform:jar:3.5.4 (absent): Cannot access central (https://repo.maven.apache.org/maven2) in offline mode and the artifact org.apache.maven.surefire:surefire-junit-platform:jar:3.5.4 has not been downloaded from it before. -> [Help 1]

Reproducer

Using the "Hello World" example here, run the following:

$ mvn org.apache.maven.plugins:maven-dependency-plugin:3.9.0:go-offline -Dmaven.repo.local=tmp-local
...
$ mvn clean package -o -Dmaven.repo.local=tmp-local

Workaround

No clear workaround - adding the missing JAR as a plugin dependency leads to "classpath hell."

pom.xml:

    <dependencies>
        <dependency>
            <groupId>org.junit.jupiter</groupId>
            <artifactId>junit-jupiter-engine</artifactId>
            <version>5.11.0</version>
            <scope>test</scope>
        </dependency>
    </dependencies>

...
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>3.5.4</version>
                <dependencies>
                    <dependency>
                        <groupId>org.apache.maven.surefire</groupId>
                        <artifactId>surefire-junit-platform</artifactId>
                        <version>3.5.4</version>
                    </dependency>
                </dependencies>
            </plugin>

Result:

[ERROR] There was an error in the forked process
[ERROR] org.junit.platform.commons.JUnitException: The wrapped NoClassDefFoundError is likely caused by the versions of JUnit jars on the classpath/module path not being properly aligned. 
[ERROR] Please ensure consistent versions are used (see https://junit.org/junit5/docs/5.12.1/user-guide/#dependency-metadata).
[ERROR] The following conflicting versions were detected:
[ERROR] - org.junit.platform.commons: 1.11.0
[ERROR] - org.junit.platform.engine: 1.11.0
[ERROR] - org.junit.platform.launcher: 1.12.1

[cstamas]

I myself was consistently against go-offline and similar mojos, since as you nicely explains, the goal makes no sense (and is not really doable for every case). What hinders you from, for example, doing a "quick build", discard the build output and reuse the local repo (as you would do with go-offline?)

for ref: https://issues.apache.org/jira/browse/MDEP-904

[cstamas]

FTR and to avoid any misunderstanding, I do agree with your sentiment how "dynamic resolution" is not the best thing, but OTOH the go-offline and alike mojos are Maven2 remnants (as explained in linked issue). I see completely different ways to perform hermetic builds, for example by using Mimir and bundles.