search

livingsocial / lein-dependency-check

A leiningen plugin for detecting vulnerable project dependencies
MIT License
33 stars 14 forks source link

Update to use org.owasp/dependency-check:6.0.2 #33

Closed jimberlage closed 4 years ago

jimberlage commented 4 years ago

This PR contains some updates to pull in the latest NIST vulnerability info, and removes some usages of deprecated functions in the upstream dependency-check library. Currently, when running lein dependency-check at version 1.1.4, you get a message like:

2020-10-21 12:55:23,484 [main] ERROR org.owasp.dependencycheck.Engine  - Unable to download meta file: https://nvd.nist.gov/feeds/json/cve/1.0/nvdcve-1.0-modified.meta; received 404 -- resource not found

A full reproduction is here: https://github.com/jimberlage/lein-dependency-check-test/runs/1286835341?check_suite_focus=true

Updating the version of org.owasp/dependency-check to 6.0.2 pulls in the most up-to-date NIST files, at 1.1. A validation of that fix is here: https://github.com/jimberlage/lein-dependency-check-test/runs/1286933269?check_suite_focus=true

Hopefully this helps, and thank you for your work on this very helpful project!

dgknght commented 4 years ago

Thanks @jimberlage! This has been deployed to clojars.