Do not want to compile on java 11

[DeuxCatPotes]

Precondition

• [ x ] I checked the issues list for existing open or closed reports of the same problem.

Describe the bug
Do not want to compile

Version of dependency-check used
Last source version.

cat /etc/os-release 
PRETTY_NAME="Ubuntu 22.04.5 LTS"
 apt show maven
Package: maven
Version: 3.6.3-5

To Reproduce
Steps to reproduce the behavior:

try to start (on gitlab-ci) the compilation with command line from the readme

[INFO] Recompiling the module because of changed dependency.
[INFO] Compiling 24 source files with javac [debug deprecation release 11] to target/classes
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Dependency-Check 12.1.4-SNAPSHOT:
[INFO]
[INFO] Dependency-Check ................................... SUCCESS [ 40.598 s]
[INFO] Dependency-Check Utils ............................. FAILURE [ 51.801 s]
[INFO] Dependency-Check Core .............................. SKIPPED
[INFO] Dependency-Check Command Line ...................... SKIPPED
[INFO] Dependency-Check Ant Task .......................... SKIPPED
[INFO] Dependency-Check Maven Plugin ...................... SKIPPED
[INFO] Dependency-Check Plugin Archetype .................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  01:43 min
[INFO] Finished at: 2025-07-04T15:18:49+02:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.14.0:compile (default-compile) on project dependency-check-utils:    Fatal error compiling: error: release version 11 not supported -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR]   mvn <args> -rf :dependency-check-utils

Expected behavior
a working compilation.

[jeremylong]

Pretty sure you need a newer version of Maven.

$ mvn --version
Apache Maven 3.9.9 (8e8579a9e76f7d015ee5ec7bfcdc97d260186937)
Maven home: /opt/homebrew/Cellar/maven/3.9.9/libexec
Java version: 11.0.2, vendor: Oracle Corporation, runtime: /Library/Java/JavaVirtualMachines/openjdk-11.0.2.jdk/Contents/Home
Default locale: en_US, platform encoding: UTF-8
OS name: "mac os x", version: "10.16", arch: "x86_64", family: "mac"

$ mvn clean install
...

[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Dependency-Check 12.1.4-SNAPSHOT:
[INFO] 
[INFO] Dependency-Check ................................... SUCCESS [ 24.904 s]
[INFO] Dependency-Check Utils ............................. SUCCESS [ 31.695 s]
[INFO] Dependency-Check Core .............................. SUCCESS [03:06 min]
[INFO] Dependency-Check Command Line ...................... SUCCESS [ 17.333 s]
[INFO] Dependency-Check Ant Task .......................... SUCCESS [ 32.173 s]
[INFO] Dependency-Check Maven Plugin ...................... SUCCESS [ 24.849 s]
[INFO] Dependency-Check Plugin Archetype .................. SUCCESS [  1.233 s]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  05:20 min
[INFO] Finished at: 2025-07-05T16:59:25-04:00
[INFO] ------------------------------------------------------------------------

[DeuxCatPotes]

Look likes a dependency maze for me.

It's already hard for me to keep it update as the compilation server as a limited internet connection or only for specific case (i should use a local desktop mirror to use the vpn to keep some repo sync ).

The fact is the infrastructure use official repository (a mirror) in order to keep things uptodate (thx debian/ubuntu maintainer) if I should use another external dependency to maintain ... I will not be able to do it (not enough time). (only use the cli)

is there is a way to adapt the build recipe to make it compatible with maven provide by at least LTS version of main GNU\Linux distro ? ready to help as it will benefit to everybody.

As the CRA will force all organisation to improve all QA/security steps of software pipeline.

Thx

[jeremylong]

Pretty sure the minimum version of Maven would be 3.6.3. Possible report the CVE in the earlier version of Maven to the linux distro you are using and asking them to upgrade? https://maven.apache.org/security.html

[aikebah]

As an additional remark: check the output in your CI for mvn --version because the error message appears to suggest that the JDK used by your maven does not support Java 11 as a target, which should mean that maven is running on JDK 9 or 10 (as the --release flag was added in Java 9 and all Java versions release up to now support compiling for Java 11)

[DeuxCatPotes]

@aikebah good point I feel bad about wrong info I provide.

That is version information on the node where I try to build but i do not understand where compilation find it's information :

Os

cat /etc/os-release 
PRETTY_NAME="Ubuntu 22.04.5 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.5 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy

Java

java --version 
openjdk 21.0.7 2025-04-15
OpenJDK Runtime Environment (build 21.0.7+6-Ubuntu-0ubuntu122.04)
OpenJDK 64-Bit Server VM (build 21.0.7+6-Ubuntu-0ubuntu122.04, mixed mode, sharing)

Mvn

mvn --version
Apache Maven 3.6.3
Maven home: /usr/share/maven
Java version: 21.0.7, vendor: Ubuntu, runtime: /usr/lib/jvm/java-21-openjdk-amd64
Default locale: en, platform encoding: UTF-8
OS name: "linux", version: "5.15.0-139-generic", arch: "amd64", family: "unix"

Build Command (gitlab ci) :

stages:
  - build
  - build-doc

build:
  stage: build
  script:
    - echo "Start the build."
    - /usr/bin/mvn -Dhttps.proxyHost=anipremove -Dhttps.proxyPort=aportremove -s settings.xml install

build-doc:
  stage: build-doc
  script:
    - echo "Start the documentation build."
    - /usr/bin/mvn -Dhttps.proxyHost=anipremove -Dhttps.proxyPort=aportremove -s settings.xml site site:stage

Everything is build on the same host.

[aikebah]

@DeuxCatPotes From the host outputs all seems well in terms of versions. Would you be able to modify the build-script to add the mvn CLI switch [1] that shows version-information and then continues the build: -V (uppercase!) or --show-version in order to confirm that the same java version that you see used when executing the mvn --version command on the host is also executed when maven executes as part of the CI pipeline?

[1] https://maven.apache.org/ref/3.1.0/maven-embedder/cli.html