RequireSameVersion failed even with defined versions of failsafe,surefire,surefire-report-plugin

[khmarbaise]

Affected version

3.6.1,3.6.0

Bug description

I have defined the maven-enforcer-rule RequireSameVersions to keep the versions of

• maven-surefire-plugin
• maven-failsafe-plugin
• maven-surefire-report-plugin
  in sync. in my parent-pom.xml in the example project.

You can reproduce the failure with this example project by running mvn verify:

[INFO] --- enforcer:3.6.1:enforce (enforce-maven) @ enforcer-test ---
[INFO] Rule 1: org.apache.maven.enforcer.rules.version.RequireMavenVersion passed
[INFO] Rule 2: org.apache.maven.enforcer.rules.RequirePluginVersions passed
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  0.255 s
[INFO] Finished at: 2025-07-31T20:52:53+02:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-enforcer-plugin:3.6.1:enforce (enforce-maven) on project enforcer-test: 
[ERROR] Rule 0: org.apache.maven.enforcer.rules.RequireSameVersions failed with message:
[ERROR] Found entries with different versions
[ERROR] Entries with version 3.5.3
[ERROR] - org.apache.maven.plugins:maven-surefire-plugin:maven-plugin (buildPlugin)
[ERROR] Entries with version RELEASE
[ERROR] - org.apache.maven.plugins:maven-surefire-report-plugin:maven-plugin (reportPlugin)
[ERROR] 
[ERROR] -> [Help 1]
[ERROR] 
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] 
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException

If you change the plugin version for maven-enforcer-plugin in parent-pom.xml to 3.6.0 the failure will look the same.

If you change maven-enforcer-plugin version to 3.5.0 there is no failure anymore. The first occurence is obviously in 3.6.0.

If you omit the reporting area from parent-pom.xml you will no issue at all.

The same behaviour can be observed with Maven versions like this:

• 4.0.0-rc4
• 3.9.11
• 3.9.10
• 3.9.9
• 3.8.8

It is not related to maven core it is clearly related to the maven-enforcer-plugin.

[pzygielo]

• RequireSameVersions rule: consider entries in <plugins> when analyzing build- and report-plugins #892

[khmarbaise]

After diving a bit into that... If the used pom.xml does not define

  <reporting>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-surefire-report-plugin</artifactId>
      </plugin>
    </plugins>
  </reporting>

The method project.getReportArtifacts() will return nothing (used in RequireSameVersions).
but if you have defined the reporting block in your pom.xml the method project.getReportArtifacts() will return

-- getReportArtifacts --
   -> org.apache.maven.plugins:maven-surefire-report-plugin:RELEASE(RELEASE)

The version RELEASE makes a kind of sense, but maven-surefire-report-plugin has been defined in pluginManagement and will be correctly used... the question comes up: Why is the version not reported based getReportArtifacts() based version defined in pluginManagement.