dependency-check / dependency-check/DependencyCheck

dependency-check-maven should support Maven's -o option

Open
#5,688 5 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

**Describe the bug**
I am using dependency-check-maven in a large multi-module build, actually in this case its a software library build so has lots of sub-builds but I don't think that is relevant.

The problem is that in Maven when your in development and making code and dependency changes, its that local code that I want dependency-check-maven to scan. We use a Maven corporate repository (Artifactory) that the builds are published to as is standard in the Maven build world.

The problem with the plugin is that if run in online mode, e.g. mvn -Powasp-scan clean verify

where owasp-scan is our profile that enables dependency-check-maven it will often download a SNAPSHOT from Artifactory which is the old one w/o the CVE fixes. We need dependency-check-maven to only scan that which is local on the build system. The standard way to do this in Maven is to run the build offline, e.g. mvn -o -Powasp-scan clean verify

But now I get this message from dependency-check-maven:

[WARNING] Goal aggregate requires online mode for execution but Maven is currently offline, skipping

So now I have a chicken & egg problem. I can't generate reports of the new code only.

Why does dependency-check-maven require online? Yes it will have/require Internet access so that the dependency-check-maven can update its CVE data sources but it should not require that Maven must connect to Artifactory and download old SNAPSHOTS.

**Version of dependency-check used**
The problem occurs using version 8.2.1 of the Maven (cli, gradle plugin, maven plugin, etc.)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.