Add --add-opens JVM args to surefire/failsafe for Java 25

[timtebeek]

Summary

• Add new AddSurefireArgLine recipe that merges --add-opens arguments into the argLine configuration of maven-surefire-plugin and maven-failsafe-plugin
• Wire it into UpgradePluginsForJava25 with the full set of --add-opens flags needed for reflection-heavy test frameworks
• Handles existing configuration merging without duplicating arguments

Why this is needed

Since JEP 403: Strongly Encapsulate JDK Internals (delivered in Java 17), the --illegal-access escape hatch was permanently removed. JDK internal packages are strongly encapsulated, and the only way to allow deep reflection (setAccessible(true)) into them is through explicit --add-opens JVM arguments.

Test frameworks that rely heavily on reflection and runtime bytecode generation — Mockito, Spring Test, Hibernate, and their shared dependency ByteBuddy — need access to internal packages like java.lang, java.lang.reflect, java.util, sun.nio.ch, and jdk.internal.misc. Without --add-opens, tests fail at runtime with InaccessibleObjectException when these frameworks attempt deep reflection.

When upgrading to Java 25 specifically, there is an additional complication: ByteBuddy validates the JVM's class file version number, and Java 25 uses class file version 69. ByteBuddy versions that predate full Java 25 support throw IllegalStateException when encountering an unknown version. The flag -Dnet.bytebuddy.experimental=true disables this version guard, allowing ByteBuddy to function on Java 25 even before a fully compatible release is available.

The existing UpgradePluginsForJava25 recipe upgrades plugin and dependency versions but does not add these required JVM arguments to the Maven Surefire/Failsafe fork configuration, leaving tests broken after migration.

Specific --add-opens flags and why they're needed

Flag	Used by
java.base/java.lang	Mockito, Spring (proxy creation, reflection on core types)
java.base/java.util	Hibernate, Spring (reflection on collections internals)
java.base/java.lang.reflect	Mockito, ByteBuddy (runtime proxy/mock generation)
java.base/java.text	Hibernate, Spring (date/number formatting internals)
java.base/sun.nio.ch	Netty, reactor-based test infrastructure
java.base/java.io	Serialization frameworks, Spring resource loading
java.base/java.nio	Netty, NIO-based test infrastructure
java.base/jdk.internal.misc	ByteBuddy (low-level memory access for bytecode generation)
java.base/sun.security.action	Spring Security, JDK internal privilege escalation
java.base/jdk.internal.reflect	Mockito, ByteBuddy (reflection factory access)
-Dnet.bytebuddy.experimental=true	ByteBuddy (accept Java 25 class file version 69)

Related issues

• ByteBuddy #1786 — JDK 25 incompatibility (class file version 69 not recognized)
• Mockito #3754 — Java 25 Compatibility
• Mockito #3647 — Add support for Java 25
• Spring Framework #35530 — Upgrade the build to Java 25

References

• JEP 403: Strongly Encapsulate JDK Internals — the JDK 17 change that permanently removed --illegal-access
• JEP 396: Strongly Encapsulate JDK Internals by Default — the JDK 16 predecessor that deprecated --illegal-access

Solution

New AddSurefireArgLine recipe that:

• Finds maven-surefire-plugin and maven-failsafe-plugin declarations (including in pluginManagement)
• Adds <configuration><argLine>...</argLine></configuration> when no configuration exists
• Adds <argLine> to existing configuration that lacks it
• Merges new flags into existing argLine values, skipping duplicates
• Handles implicit groupId and property references like ${argLine}

Test plan

• 10 new test cases covering all configuration scenarios

• Integration test updated in UpgradeToJava25Test

• Full build passes

• Fixes moderneinc/customer-requests#1821

[steve-aom-elliott]

Not that it's necessary for it to function, but might be nice to put these onto separate lines for legibility at some point.