strange behaviour with mockito-core v3.6.0 using maven

I am using mockito-core dependency version 3.6.0 using maven as our dependency manager. I observed that same versioned mockito-core used to come with 'compile' dependency scope for 'objenesis' jar

+- org.mockito:mockito-core:jar:3.6.0:test
[INFO] |  +- net.bytebuddy:byte-buddy:jar:1.10.11:test
[INFO] |  +- net.bytebuddy:byte-buddy-agent:jar:1.10.11:test
[INFO] |  \- org.objenesis:objenesis:jar:3.1:compile

but all of sudden it has changed the scope to 'test' for 'objenesis'

+- org.mockito:mockito-core:jar:3.6.0:test
[INFO] |  +- net.bytebuddy:byte-buddy:jar:1.10.11:test
[INFO] |  +- net.bytebuddy:byte-buddy-agent:jar:1.10.11:test
[INFO] |  \- org.objenesis:objenesis:jar:3.1:test

This has obviously caused significant issues to dependency injections in our application because we used cglib to create proxy for beans.

What could have caused the change of scope for the same versioned dependency of mockito-core?

Mockito-core declares objenesis in compile scope because it needs it to compile. However, when you add mockito-core in test scope to another project, all these compile scope dependencies become test scope.

However, if you have objenesis somewhere else in compile scope and in a lower version than mockito-core, objenesis will turn back to compile scope and the one from mockito-core being a higher version, that's the selected one.

One solution to find out who is providing this other objenesis, is to exclude objenesis from mockito-core and check where it appears in the dependency:tree.

Objenesis is frequently used in compile scope. By Spring for instance. You can add an explicit objenesis dependency in runtime scope to get the correct scope from the point of view of your project. Like many other dependencies that are not directly used by your project. But keeping that clean is a lot of work.

You can see this effect by looking at this sample project.