dependency-check / dependency-check/DependencyCheck

Support maven_install.json v2

Open
#6,527 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

**Is your feature request related to a problem? Please describe.**
As of version [5.1](https://github.com/bazelbuild/rules_jvm_external/releases/tag/5.1) of `rules_jvm_external`, the `maven_install.json` schema was updated for `v2`. The current implementation in dependency check is compatible with `v0.1.0` but `v2`.

**Describe the solution you'd like**
The `PinnedMavenInstallAnalyzer` should support both `maven_install.json` versions.

**Describe alternatives you've considered**
- Roll back the version of `rules_jvm_external` to pre 5.1. That version is over a year old and a major version behind.
- Do container scanning later in the CI process, which would be slower and potentially less reliable

**Additional context**
Bazel continues to grow in popularity, it seems important to support updates.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.