search

dependency-check / dependency-check-sonar-plugin

Integrates Dependency-Check reports into SonarQube
585 stars 133 forks source link

Use new severity levels #894

Closed NIGCH closed 8 months ago

NIGCH commented 8 months ago

A tentative fix to replace the deprecated severity levels. Also included is a change to DependencyCheckUtils.severityToScore() to always use the CVSS scores in the specification to map a severity string to a CVSS score, rather than the configurable thresholds which determine how CVSS scores map to SonarQube severities.

Reamer commented 8 months ago

Hi @NIGCH, thanks for your Pull-Request. Can you please split the changes into two separate Pull-Request.

Btw. SonarQube 10.x is currently no LTS Release and with the API change, the plugin should increase the major version.

NIGCH commented 8 months ago

Thanks @Reamer, I've raised a new PR to change just the severity levels and will follow up later on the CVSS scores.