Modular project that requires transitive org.junit.jupiter.api fails with IllegalAccessError #3532

Affected version

3.5.3 works, 3.5.4 and 3.6.0 fail

Bug description

Surefire versions: 3.5.3 works, 3.5.4 and 3.6.0 fail
JUnit: 6.0.3 (BOM) · JDK: Temurin 25.0.1 · Maven: 3.9.11 · OS: macOS

A JPMS module whose main code uses the JUnit API (requires transitive org.junit.jupiter.api;, e.g. a module with test
utilities) runs its tests with Surefire 3.5.3. With 3.5.4 and with the current 3.6.0 the forked JVM fails before any
test runs:

java.lang.IllegalAccessError: class org.junit.platform.launcher.core.LauncherFactory (in unnamed module @0x…)
cannot access class org.junit.platform.commons.util.Preconditions (in module org.junit.platform.commons) because
module org.junit.platform.commons does not export org.junit.platform.commons.util to unnamed module @0x…

The launcher ends up on the class path (unnamed module), while org.junit.platform.commons is on the module path,
because the module under test requires the JUnit API. Declaring junit-platform-launcher as test dependency does not
change the result.

Reproducer

src/main/java/module-info.java

module demo {
    requires transitive org.junit.jupiter.api;
    exports demo;
}

src/main/java/demo/Checks.java

package demo;

import org.junit.jupiter.api.Assertions;

public final class Checks {
    private Checks() {
    }

    public static void positive(final int value) {
        Assertions.assertTrue(value > 0);
    }
}

src/test/java/demo/ChecksTest.java

package demo;

import org.junit.jupiter.api.Test;

class ChecksTest {
    @Test
    void one() {
        Checks.positive(1);
    }
}

pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0">
  <modelVersion>4.0.0</modelVersion>
  <groupId>demo</groupId><artifactId>surefire-repro</artifactId><version>1</version>
  <properties>
    <maven.compiler.release>25</maven.compiler.release>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <surefire.version>3.5.3</surefire.version>
  </properties>
  <dependencyManagement><dependencies><dependency>
    <groupId>org.junit</groupId><artifactId>junit-bom</artifactId><version>6.0.3</version>
    <type>pom</type><scope>import</scope>
  </dependency></dependencies></dependencyManagement>
  <dependencies>
    <dependency><groupId>org.junit.jupiter</groupId><artifactId>junit-jupiter-api</artifactId></dependency>
    <dependency><groupId>org.junit.jupiter</groupId><artifactId>junit-jupiter</artifactId><scope>test</scope></dependency>
  </dependencies>
  <build><plugins>
    <plugin><groupId>org.apache.maven.plugins</groupId><artifactId>maven-compiler-plugin</artifactId><version>3.14.0</version></plugin>
    <plugin><groupId>org.apache.maven.plugins</groupId><artifactId>maven-surefire-plugin</artifactId><version>${surefire.version}</version></plugin>
  </plugins></build>
</project>

Results

(mvn test -Dsurefire.version=<version>)

With maven.compiler.release 21 instead of 25, already 3.5.3 fails with the same kind of error
(org.junit.platform.engine.discovery.DiscoverySelectors … cannot access … org.junit.platform.commons.util), which
looks like SUREFIRE-2191 (#2757). With release 25 the setup worked until 3.5.3, so the change between 3.5.3 and 3.5.4
seems to have widened the problem.

Related: #2757 (SUREFIRE-2191, "surefire crashes on a JPMS modularized project that uses junit5").