dependency-check / dependency-check/DependencyCheck
The excludes parameter does not work with dependency-check-maven from CLI
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
**Describe the bug**
With ["Add exclusion filter to cuteoff some dependencies and their transitive"](https://github.com/jeremylong/DependencyCheck/pull/1699) feature we can easily exclude dependencies with selected patterns. Unfortunately, it is not possible to use with the CLI. The reason is that with a definition of the [excludes](https://github.com/jeremylong/DependencyCheck/blob/af5d6dc376d5ca9ac6192764736bb65680c4d9b3/maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java#L914) maven parameter the `Parameter` annotation does not have defined a [property](https://maven.apache.org/plugin-tools/apidocs/org/apache/maven/plugins/annotations/Parameter.html#property--) attribute which limits us to use this feature from the CLI.
**Version of dependency-check used**
The problem occurs using version 7.0.0 of the maven plugin but older versions are also affected.
**To Reproduce**
Steps to reproduce the behavior:
1. Run DependencyCheck by using `mvn` command with `-Dexcludes=GroupId:ArtifactId:Version` for an existing dependency inside project pom.xml
2. Check the output of run DependencyCheck to make sure `GroupId:ArtifactId:Version` dependency and all its transitions are not available.
**Expected behavior**
Upon checking selected project pom.xml `GroupId:ArtifactId:Version` dependency and all its transitions are not available.
Contributor guide
Assessment
This issue has not been assessed yet.