ExtensionSecurityTest flickers on master, 18.4.x, 18.8.x and 17.10.x: checkForExtensionSecurityScanResult

The functional test org.xwiki.test.security.ExtensionSecurityTest#checkForExtensionSecurityScanResult (module xwiki-platform-distribution-flavor-test-security) fails intermittently on ci.xwiki.org.

Affected test

• org.xwiki.test.security.ExtensionSecurityTest#checkForExtensionSecurityScanResult

Affected branches

• master: failed in 4 of the last 8 builds (build #9008)
• stable-18.4.x: failed in 5 of the last 8 builds
• stable-18.8.x: failed in 3 of the last 8 builds
• stable-17.10.x: failed on 2026-10-09 and 2026-10-10 (Develocity)

Develocity history (28 days, 2026-09-13 → 2026-10-11)

• 28 failures in 199 executions (14.1%), first failure on 2026-09-17.
• "The failure rate rose around 2026-10-09: 7.9% before vs 66.7% after (p=1e-07, adjusted)."
• Since 2026-10-09 the failure is almost always the same timeout: the wait at ExtensionSecurityTest.java:61 gives up after 1000 seconds:

  org.openqa.selenium.TimeoutException: Expected condition failed: waiting for org.xwiki.test.ui.XWikiWebDriver$$Lambda@<hash>
  (tried for 1000 seconds with 500 milliseconds interval)
  

• The older failures (2026-09-17/18 and 2026-10-06) are the assertion listing newly published CVEs that are still to be analyzed (CVE-2026-86071, CVE-2026-75140). Those failures are the test doing its job.
• Build scans: 2026-10-11, 2026-10-11, 2026-10-09

Possibly related

Starting on the same day (2026-10-09), org.xwiki.extension.security.test.ui.AllIT$NestedExtensionSecurityIT#extensionVulnerabilitiesAdmin also times out, in every build of master, stable-18.4.x and stable-17.10.x. Develocity reports 39 failures in 574 executions, with "0.0% before vs 67.2% after (p=9e-45)". Both tests wait for the extension security scan, and they started failing together on three branches. That points to a common cause outside the code of any one branch, for example the vulnerability data source becoming slow or unreachable from CI. This is not verified.

Filed automatically by the daily CI check, because this failure happened in at least 2 builds on at least 2 different days.