You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Please Read: Mandatory Upgrade to 12.1.0 or later #7463
Hi We are facing build failures after updating to 12.1.0. Please check the screenshots. This is java application and we are using gradle ./gradlew dependencyCheckAnalyze ..we have use nvd api key as wel... In one other python repo we are getting this error
I can just speak for the maven plugin as I've not tried this with gradle.
For the trailing tab issue I see: mvn org.owasp:dependency-check-maven:12.1.0:update-only -> SUCCESS (logs an error and continue) mvn org.owasp:dependency-check-maven:8.2.1:update-only -> FAILURE
so using a cicd pipeline is a valid approach IF you use a version that doesn't fail. i.e. I use it to (nightly) cache the data into a container image, possibly for multiple plugin versions (the nvd db persistence varies). Then I run maven on CI using that image, hence reusing the cached data.
But this doesn't work for the versions that still fail.
OTOH if you get the data just to put it into a relational db, then you are ok.
Repeatedly downloading the nvd db on the fly leads to various issues (throttling, random network errors, etc)
That said I hope folks at Nist will fix it soon (possibly adding some check to avoid further disruptions).
Activity
marcelstoer commentedon Feb 24, 2025
For details see the CHANGELOG and the referenced issue.
fix: Failed to parse NVD data
Bump dependencycheck plugin to 12.1.0
update suppressions and owasp.dependencycheck version. see dependency…
kaushikdutta2025 commentedon Mar 7, 2025
Hi We are facing build failures after updating to 12.1.0. Please check the screenshots. This is java application and we are using gradle ./gradlew dependencyCheckAnalyze ..we have use nvd api key as wel... In one other python repo we are getting this error
jeremylong commentedon Mar 7, 2025
The parse error is becuase the CPE has a trailing tab; see #7509 (comment)
I'll email the NVD
kaushikdutta2025 commentedon Mar 7, 2025
kaushikdutta2025 commentedon Mar 7, 2025
GoodOwl commentedon Mar 7, 2025
To update the nvd data sounds like the best approach. Is it possible?
davidecavestro commentedon Mar 7, 2025
TLDR;
you should persist the nvd db
I can just speak for the maven plugin as I've not tried this with gradle.
For the trailing tab issue I see:
mvn org.owasp:dependency-check-maven:12.1.0:update-only-> SUCCESS (logs an error and continue)mvn org.owasp:dependency-check-maven:8.2.1:update-only-> FAILUREso using a cicd pipeline is a valid approach IF you use a version that doesn't fail. i.e. I use it to (nightly) cache the data into a container image, possibly for multiple plugin versions (the nvd db persistence varies). Then I run maven on CI using that image, hence reusing the cached data.
But this doesn't work for the versions that still fail.
OTOH if you get the data just to put it into a relational db, then you are ok.
Repeatedly downloading the nvd db on the fly leads to various issues (throttling, random network errors, etc)
That said I hope folks at Nist will fix it soon (possibly adding some check to avoid further disruptions).
ob-alexn-sportsbet commentedon Mar 27, 2025
Are there any plans to backport these latest fixes to version 10 which is the last Java 8 compatible version of dependency-check?
jeremylong commentedon Mar 27, 2025
No
Bump dependency-check to 12.1.0 (#4569)