dependency-check / dependency-check/DependencyCheck

"Found 0 vulnerabilities in project" message does not tell how many artifacts have been scanned

Open
#5,669 3 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

**Describe the bug**
After update from Gradle plugin version 6.4.1.1 to 8.2.1 for some reason all previously reported vulnerabilities disappeared. In the build log the message
```
[16:51:59] : [Step 5/6] > Task :modules:test-external-dependencies:dependencyCheckAnalyze
[16:51:59] : [Step 5/6] Generating report for project test-external-dependencies
[16:52:00] : [Step 5/6] Found 0 vulnerabilities in project test-external-dependencies
```
appeared.

Unfortunately, from this message one cannot know if there are no vulnerabilities (which I doubt) or if no vulnerabilities have been found because nothing has been scanned (e.g. due to a misconfiguration of the plugin).

**Version of dependency-check used**
The problem occurs using version 8.2.1 of the gradle plugin.

**Expected behavior**
The plugin should not only report how many vulnerabilities have been found, but also how many artifacts have been scanned.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.