This is an automated email from the ASF dual-hosted git repository. dsmiley pushed a commit to branch branch_10x in repository https://gitbox.apache.org/repos/asf/solr.git
commit 6032b2316c980d2c67047abf562382722c811ddd Author: Eric Pugh <[email protected]> AuthorDate: Wed Aug 12 15:32:01 2026 -0400 Wire up NVD API key for the owasp Gradle task (#4725) Co-authored-by: Claude Sonnet 5 <[email protected]> (cherry picked from commit 2ad41731f5a1c451f511f5b6685561d493304c1c) --- changelog/unreleased/owasp-nvd-apikey.yml | 11 +++++++++++ dev-docs/FAQ.adoc | 7 ++++++- dev-docs/gradle-help/workflow.txt | 1 + gradle/libs.versions.toml | 2 +- gradle/validation/owasp-dependency-check.gradle | 5 +++++ 5 files changed, 24 insertions(+), 2 deletions(-) diff --git a/changelog/unreleased/owasp-nvd-apikey.yml b/changelog/unreleased/owasp-nvd-apikey.yml new file mode 100644 index 00000000000..2892a3d3708 --- /dev/null +++ b/changelog/unreleased/owasp-nvd-apikey.yml @@ -0,0 +1,11 @@ +title: > + The `./gradlew owasp` dependency vulnerability check now supports an NVD API key + (via `-PnvdApiKey` or `NVD_API_KEY`), and requires `--no-parallel` due to an upstream + Gradle plugin issue. See dev-docs/FAQ.adoc for details. +type: other +authors: + - name: Eric Pugh +links: + - name: PR#4725 + url: https://github.com/apache/solr/pull/4725 + diff --git a/dev-docs/FAQ.adoc b/dev-docs/FAQ.adoc index 4f0d6a312b8..6baa9d491d1 100644 --- a/dev-docs/FAQ.adoc +++ b/dev-docs/FAQ.adoc @@ -69,7 +69,12 @@ Learn more about using Forbidden APIs via `./gradlew :helpForbiddenApis`. To run a check for dependencies of Solr that have security vulnerabilities using the https://plugins.gradle.org/plugin/org.owasp.dependencycheck[OWASP] Gradle plugin. Run via: -`./gradlew owasp` +`./gradlew owasp --no-parallel` + +This task downloads the NVD CVE database, which is heavily rate-limited for unauthenticated requests and will fail with an error from `NvdApiDataSource` without an API key. +Request a free key at https://nvd.nist.gov/developers/request-an-api-key and pass it via `-PnvdApiKey=<your-key>` or the `NVD_API_KEY` environment variable. + +The `--no-parallel` flag is required because of an unresolved upstream bug where `dependencyCheckAggregate` resolves other projects' configurations unsafely under Gradle's parallel project execution: https://github.com/dependency-check/dependency-check-gradle/issues/462 There are a number of other tasks that get run to validate the source code, and you can find them in the ./gradle/validation source tree. diff --git a/dev-docs/gradle-help/workflow.txt b/dev-docs/gradle-help/workflow.txt index 47cde864f53..0c5c2d1142b 100644 --- a/dev-docs/gradle-help/workflow.txt +++ b/dev-docs/gradle-help/workflow.txt @@ -53,6 +53,7 @@ Other validation and checks Generate a report of dependencies with known OWASP vulnerabilities: gradlew :dependencyCheckAnalyze open ./build/reports/dependency-check-report.html +(requires an NVD API key, see dev-docs/FAQ.adoc) Additional General Options ========================== diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 10f706e3201..a499c9c44ef 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -182,7 +182,7 @@ opentelemetry-runtime-telemetry = "2.27.0-alpha" oshai-logging = "8.0.4" # @keep for version alignment ow2-asm = "9.10.1" -owasp-dependencycheck = "12.2.2" +owasp-dependencycheck = "13.0.0" # @keep for version alignment perfmark = "0.27.0" prometheus-metrics = "1.8.0" diff --git a/gradle/validation/owasp-dependency-check.gradle b/gradle/validation/owasp-dependency-check.gradle index b319dd48a35..cbeec495830 100644 --- a/gradle/validation/owasp-dependency-check.gradle +++ b/gradle/validation/owasp-dependency-check.gradle @@ -31,6 +31,11 @@ configure(rootProject) { analyzers { assemblyEnabled = false } + nvd { + // NVD heavily rate-limits the CVE data feed for unauthenticated requests. + // Get a free key from https://nvd.nist.gov/developers/request-an-api-key + apiKey = project.findProperty("nvdApiKey") ?: System.getenv("NVD_API_KEY") + } } task owasp() {
