dependency-check / dependency-check/DependencyCheck
Support maven_install.json v2
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
**Is your feature request related to a problem? Please describe.**
As of version [5.1](https://github.com/bazelbuild/rules_jvm_external/releases/tag/5.1) of `rules_jvm_external`, the `maven_install.json` schema was updated for `v2`. The current implementation in dependency check is compatible with `v0.1.0` but `v2`.
**Describe the solution you'd like**
The `PinnedMavenInstallAnalyzer` should support both `maven_install.json` versions.
**Describe alternatives you've considered**
- Roll back the version of `rules_jvm_external` to pre 5.1. That version is over a year old and a major version behind.
- Do container scanning later in the CI process, which would be slower and potentially less reliable
**Additional context**
Bazel continues to grow in popularity, it seems important to support updates.
Contributor guide
Assessment
This issue has not been assessed yet.