This is an automated email from the ASF dual-hosted git repository.
stoty pushed a commit to branch branch-2
in repository https://gitbox.apache.org/repos/asf/hbase.git
The following commit(s) were added to refs/heads/branch-2 by this push:
new 7e4b7a03573 HBASE-29201 Add OWASP Dependency Check to check 3rd party
dependencies for known vulnerabilities (#6829)
7e4b7a03573 is described below
commit 7e4b7a035732fd315676ba0212d8459f02bd3743
Author: Istvan Toth <[email protected]>
AuthorDate: Thu Mar 20 18:26:03 2025 +0100
HBASE-29201 Add OWASP Dependency Check to check 3rd party dependencies for
known vulnerabilities (#6829)
Signed-off-by: Nihal Jain <[email protected]>
Signed-off-by: Duo Zhang <[email protected]>
---
pom.xml | 31 +++++++++++++++++++++++++++++++
1 file changed, 31 insertions(+)
diff --git a/pom.xml b/pom.xml
index 3e5ce09a209..f33ec0c5869 100644
--- a/pom.xml
+++ b/pom.xml
@@ -648,6 +648,7 @@
<maven.javadoc.version>3.4.0</maven.javadoc.version>
<maven.warbucks.version>1.1.0</maven.warbucks.version>
<maven.project.info.report.version>3.1.2</maven.project.info.report.version>
+ <maven-owasp-plugin.version>12.1.0</maven-owasp-plugin.version>
<os.maven.version>1.5.0.Final</os.maven.version>
<findbugs-annotations.version>1.3.9-1</findbugs-annotations.version>
<spotbugs.version>4.7.3</spotbugs.version>
@@ -4983,6 +4984,36 @@
</plugins>
</build>
</profile>
+ <profile>
+ <id>owasp-dependency-check</id>
+ <activation>
+ <jdk>[11,)</jdk>
+ <property>
+ <name>owasp-check</name>
+ </property>
+ </activation>
+ <reporting>
+ <plugins>
+ <plugin>
+ <groupId>org.owasp</groupId>
+ <artifactId>dependency-check-maven</artifactId>
+ <version>${maven-owasp-plugin.version}</version>
+ <configuration>
+ <skipProvidedScope>true</skipProvidedScope>
+ <skipRuntimeScope>true</skipRuntimeScope>
+ <skipSystemScope>true</skipSystemScope>
+ </configuration>
+ <reportSets>
+ <reportSet>
+ <reports>
+ <report>aggregate</report>
+ </reports>
+ </reportSet>
+ </reportSets>
+ </plugin>
+ </plugins>
+ </reporting>
+ </profile>
<profile>
<!-- Used by the website generation script on jenkins to
do a local install of the jars we need to run a normal
