We need to be able to collect all the dependencies in a private repository and run the build without access to Maven Central for the product.

maven-surefire-plugin doesn't have an explicit dependency on surefire-testng, instead it resolves it dynamically when it finds TestNG in the classpath. This means surefire-testng and its transitive dependencies are not detected automatically and need to be imported manually.

When a dependency is not imported, it is pretty hard to debug: there is only a warning during the build:

[WARNING] Missing POM for org.apache.maven.surefire:surefire-testng-utils:jar:3.0.0-M3

And then the failure message only mentions a specific class:

There was an error in the forked process
org/apache/maven/surefire/testng/utils/Stoppable

We should add an explicit dependency on surefire-testng on core, like the modules using JUnit have an explicit dependency on surefire-junit47, in order to allow automatic detection of its transitive dependencies and to get better error messages.