dependency-check / dependency-check/DependencyCheck
dependency-check-maven should support Maven's -o option
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
**Describe the bug**
I am using dependency-check-maven in a large multi-module build, actually in this case its a software library build so has lots of sub-builds but I don't think that is relevant.
The problem is that in Maven when your in development and making code and dependency changes, its that local code that I want dependency-check-maven to scan. We use a Maven corporate repository (Artifactory) that the builds are published to as is standard in the Maven build world.
The problem with the plugin is that if run in online mode, e.g. mvn -Powasp-scan clean verify
where owasp-scan is our profile that enables dependency-check-maven it will often download a SNAPSHOT from Artifactory which is the old one w/o the CVE fixes. We need dependency-check-maven to only scan that which is local on the build system. The standard way to do this in Maven is to run the build offline, e.g. mvn -o -Powasp-scan clean verify
But now I get this message from dependency-check-maven:
[WARNING] Goal aggregate requires online mode for execution but Maven is currently offline, skipping
So now I have a chicken & egg problem. I can't generate reports of the new code only.
Why does dependency-check-maven require online? Yes it will have/require Internet access so that the dependency-check-maven can update its CVE data sources but it should not require that Maven must connect to Artifactory and download old SNAPSHOTS.
**Version of dependency-check used**
The problem occurs using version 8.2.1 of the Maven (cli, gradle plugin, maven plugin, etc.)
Contributor guide
Assessment
This issue has not been assessed yet.