A dependency on ANTLR 2.7.7 (BTW, the build.properties mentions version 2.7.5 in contrast) has been introduced in r685386. The commit message ("add findbugs support to maven build") as well as the actual compilation indicates that this dependency is not an actual compile-time dependency of the engine. It's not clear to me why it was added in the first place, running "mvn site" succeeds without this dependency and the resulting FindBugs reports looks OK (ignoring the various issues it lists). For the sake of a proper class path in client applications of Velocity, this dependency should either be completely removed or at least marked optional (c.f. http://velocity.apache.org/engine/devel/jar-dependencies.html).