Repository navigation
Gate CI on known vulnerabilities in the shipped dependency graph - #740
Merged
Merged
Conversation
OWASP Dependency-Check runs over compile and runtime scope in its own CI job, failing at CVSS 7; test and provided scope are the application's dependencies and stay out. The job skips where no NVD API key is available. Stale test-scope driver and Jackson pins move to current patches, and the website's build chain gets overrides for its critical transitive advisories. Fixes #242
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
7 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #242
The gate
org.owasp:dependency-check-maven:13.0.0in the root plugin management, invoked explicitly and never bound to a phase: fails at CVSS 7 (the floor of High), skips test and provided scope (Spring Boot, Jackson and the drivers are the application's dependencies), reads the key from theNVD_API_KEYenvironment variable, writes HTML and JSON, .NET analyzer off since the runner has no dotnet.A
dependency-checkjob inci.ymlinstalls the reactor without tests, runsorg.owasp:dependency-check-maven:aggregate, uploadstarget/dependency-check-report.*, and skips with a notice when the secret is absent (Dependabot runs and forks receive no secrets). The Maven cache keeps the NVD data under~/.m2, so later runs pull deltas only.Needs a secret
Request a free NVD API key at https://nvd.nist.gov/developers/request-an-api-key and add it as the
NVD_API_KEYrepository secret. Until then the job reports itself skipped. The first run with the key pulls the full feed, roughly ten minutes.Pins (test and provided scope only)
PostgreSQL driver 42.7.4 to 42.7.11, MySQL connector 8.0.33 to 9.7.0, Jackson 2 core and jsr310 2.17.0 to 2.17.3, Jackson 3 3.0.0 to 3.0.4. Jackson 2.17 and 3.0 stay the floors the modules compile against.
Website
The npm alerts are Docusaurus build tooling;
npm audit's suggested fix was a downgrade to 3.7.0.overridesfortinypool,proxy-addr,shell-quoteandwebsocket-driverplus the non-breakingnpm audit fixtake the audit from 19 critical and 66 total to 0 critical and 47 total, with the site building after each step. The remaining highs are a long tail that only upstream Docusaurus moves. The CLI has no dependencies.Left out
Pinning first-party actions to commit SHAs, marked lower priority in the issue.