dependency-check / dependency-check/DependencyCheck

The excludes parameter does not work with dependency-check-maven from CLI

Open
#4,172 0 comments 0 reactions 0 assignees View on GitHub
enhancement maven
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

**Describe the bug**
With ["Add exclusion filter to cuteoff some dependencies and their transitive"](https://github.com/jeremylong/DependencyCheck/pull/1699) feature we can easily exclude dependencies with selected patterns. Unfortunately, it is not possible to use with the CLI. The reason is that with a definition of the [excludes](https://github.com/jeremylong/DependencyCheck/blob/af5d6dc376d5ca9ac6192764736bb65680c4d9b3/maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java#L914) maven parameter the `Parameter` annotation does not have defined a [property](https://maven.apache.org/plugin-tools/apidocs/org/apache/maven/plugins/annotations/Parameter.html#property--) attribute which limits us to use this feature from the CLI.

**Version of dependency-check used**
The problem occurs using version 7.0.0 of the maven plugin but older versions are also affected.

**To Reproduce**
Steps to reproduce the behavior:
1. Run DependencyCheck by using `mvn` command with `-Dexcludes=GroupId:ArtifactId:Version` for an existing dependency inside project pom.xml
2. Check the output of run DependencyCheck to make sure `GroupId:ArtifactId:Version` dependency and all its transitions are not available.

**Expected behavior**
Upon checking selected project pom.xml `GroupId:ArtifactId:Version` dependency and all its transitions are not available.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.