Closed jwwallin closed 2 years ago
Seems like response changed and does not contain coordinates
for ComponentReport
deserialization:
[
{
"description":"",
"reference":"https://ossindex.sonatype.org/component/pkg:maven/commons-lang/commons-lang@2.1?utm_source=dependency-check&utm_medium=integration&utm_content=7.1.0",
"vulnerabilities":[
],
"sonatypeOssiScore":0.0
}
]
Seems like response changed and does not contain
coordinates
forComponentReport
deserialization:[ { "description":"", "reference":"https://ossindex.sonatype.org/component/pkg:maven/commons-lang/commons-lang@2.1?utm_source=dependency-check&utm_medium=integration&utm_content=7.1.0", "vulnerabilities":[ ], "sonatypeOssiScore":0.0 } ]
I tested that specific component and I did get a response with coordinates
:
[
{
"coordinates": "pkg:maven/commons-lang/commons-lang@2.1",
"description": "",
"reference": "https://ossindex.sonatype.org/component/pkg:maven/commons-lang/commons-lang@2.1?utm_source=insomnia&utm_medium=integration&utm_content=2022.3.0",
"vulnerabilities": [],
"sonatypeOssiScore": 0.0
}
]
Looks like now it depends if you provide credentials or not: https://github.com/jeremylong/DependencyCheck/issues/4535#issuecomment-1137136998
I didn't provide any credentials.
Here's a cURL
export of my request:
curl --request POST \
--url https://ossindex.sonatype.org/api/v3/component-report \
--header 'Accept: application/vnd.ossindex.component-report.v1+json' \
--header 'Content-Type: application/vnd.ossindex.component-report-request.v1+json' \
--data '{
"coordinates":[
"pkg:maven/commons-lang/commons-lang@2.1"
]
}
'
This problem no longer manifests.
Thanks for letting us know. We have been chasing down a variety of edge cases causing problems, so I am glad one of them resolved your issue. Sorry for the inconvenience.
There are many reports of suddenly failing builds using org.owasp:dependency-check-maven -plugin. That plugin uses this library to make requests to OSS Index.
Most reports seem to go along the lines of:
https://github.com/jeremylong/DependencyCheck/issues/4538