Skip to content
This repository was archived by the owner on Sep 27, 2025. It is now read-only.

Commit 5a47091

Browse files
aikebahjeremylong
aikebah
and
jeremylong
authored
build(deps): Sanitize dependencies based on dependency:analyze-report results (#7294)
Co-authored-by: Jeremy Long <[email protected]>
1 parent 57db1ca commit 5a47091

File tree

7 files changed

+232
-32
lines changed

7 files changed

+232
-32
lines changed

‎ant/pom.xml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -214,8 +214,13 @@ Copyright (c) 2013 - Jeremy Long. All Rights Reserved.
214214
<version>${project.parent.version}</version>
215215
</dependency>
216216
<dependency>
217-
<groupId>org.apache.commons</groupId>
218-
<artifactId>commons-jcs3-core</artifactId>
217+
<!-- not visible in imports due to method chaining, but Check code uses classes from this library -->
218+
<groupId>io.github.jeremylong</groupId>
219+
<artifactId>open-vulnerability-clients</artifactId>
220+
</dependency>
221+
<dependency>
222+
<groupId>org.slf4j</groupId>
223+
<artifactId>slf4j-api</artifactId>
219224
</dependency>
220225
<dependency>
221226
<groupId>io.github.jeremylong</groupId>

‎cli/pom.xml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,15 @@ Copyright (c) 2012 - Jeremy Long. All Rights Reserved.
152152
<groupId>org.slf4j</groupId>
153153
<artifactId>slf4j-api</artifactId>
154154
</dependency>
155+
<dependency>
156+
<groupId>io.github.jeremylong</groupId>
157+
<artifactId>jcs3-slf4j</artifactId>
158+
</dependency>
159+
<dependency>
160+
<!-- not visible in imports due to method chaining, but App code uses classes from this library -->
161+
<groupId>io.github.jeremylong</groupId>
162+
<artifactId>open-vulnerability-clients</artifactId>
163+
</dependency>
155164
<dependency>
156165
<groupId>org.apache.ant</groupId>
157166
<artifactId>ant</artifactId>

‎core/pom.xml‎

Lines changed: 90 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,7 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.
204204
<dependency>
205205
<groupId>io.github.jeremylong</groupId>
206206
<artifactId>jcs3-slf4j</artifactId>
207+
<scope>runtime</scope>
207208
</dependency>
208209
<dependency>
209210
<groupId>com.github.package-url</groupId>
@@ -340,14 +341,57 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.
340341
<groupId>commons-validator</groupId>
341342
<artifactId>commons-validator</artifactId>
342343
</dependency>
343-
<dependency><!--upgrade transitive dependency of commons-validator due to reported vulns-->
344-
<groupId>commons-beanutils</groupId>
345-
<artifactId>commons-beanutils</artifactId>
346-
</dependency>
347344
<dependency>
348345
<groupId>org.eclipse.packager</groupId>
349346
<artifactId>packager-rpm</artifactId>
350347
</dependency>
348+
<dependency>
349+
<groupId>org.apache.httpcomponents.core5</groupId>
350+
<artifactId>httpcore5</artifactId>
351+
</dependency>
352+
<dependency>
353+
<groupId>org.apache.httpcomponents.client5</groupId>
354+
<artifactId>httpclient5</artifactId>
355+
</dependency>
356+
<dependency>
357+
<groupId>com.fasterxml.jackson.core</groupId>
358+
<artifactId>jackson-core</artifactId>
359+
</dependency>
360+
<dependency>
361+
<groupId>com.fasterxml.jackson.core</groupId>
362+
<artifactId>jackson-annotations</artifactId>
363+
</dependency>
364+
<dependency>
365+
<groupId>org.sonatype.goodies</groupId>
366+
<artifactId>package-url-java</artifactId>
367+
<version>1.1.1</version>
368+
</dependency>
369+
<dependency>
370+
<groupId>joda-time</groupId>
371+
<artifactId>joda-time</artifactId>
372+
<version>2.10.4</version>
373+
</dependency>
374+
<dependency>
375+
<groupId>org.sonatype.ossindex</groupId>
376+
<artifactId>ossindex-service-api</artifactId>
377+
<version>1.8.2</version>
378+
</dependency>
379+
<dependency>
380+
<groupId>com.esotericsoftware</groupId>
381+
<artifactId>minlog</artifactId>
382+
<version>1.3.1</version>
383+
</dependency>
384+
<dependency>
385+
<groupId>com.vaadin.external.google</groupId>
386+
<artifactId>android-json</artifactId>
387+
<version>0.0.20131108.vaadin1</version>
388+
</dependency>
389+
<dependency>
390+
<groupId>xml-apis</groupId>
391+
<artifactId>xml-apis</artifactId>
392+
<version>1.3.03</version>
393+
<scope>test</scope>
394+
</dependency>
351395
</dependencies>
352396
<profiles>
353397
<profile>
@@ -457,6 +501,48 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.
457501
<activation>
458502
<activeByDefault>true</activeByDefault>
459503
</activation>
504+
<build>
505+
<pluginManagement>
506+
<plugins>
507+
<plugin>
508+
<groupId>org.apache.maven.plugins</groupId>
509+
<artifactId>maven-dependency-plugin</artifactId>
510+
<version>${maven-dependency-plugin.version}</version>
511+
<configuration>
512+
<usedDependencies combine.children="append">
513+
<!-- logback is our logging implementation during test and is test-scoped due to a lack of a
514+
test-runtime scope - it should be considered 'used' in the context of dependency:analyze-report -->
515+
<usedDependency>ch.qos.logback:logback-classic</usedDependency>
516+
<!-- dependencies to be copied for use in unit/integration testcases are, due to
517+
lack of a test-runtime scope, configured as test-scoped / optional and should be
518+
considered used for dependency:analyze-report -->
519+
<usedDependency>org.springframework:spring-webmvc</usedDependency>
520+
<usedDependency>org.mortbay.jetty:jetty</usedDependency>
521+
<usedDependency>net.sf.ehcache:ehcache-core</usedDependency>
522+
<usedDependency>com.google.inject:guice</usedDependency>
523+
<usedDependency>org.apache.struts:struts2-core</usedDependency>
524+
<usedDependency>xalan:xalan</usedDependency>
525+
<usedDependency>com.hazelcast:hazelcast</usedDependency>
526+
<usedDependency>commons-fileupload:commons-fileupload</usedDependency>
527+
<usedDependency>org.jslipc:jslipc</usedDependency>
528+
<usedDependency>com.thoughtworks.xstream:xstream</usedDependency>
529+
<usedDependency>org.dojotoolkit:dojo-war</usedDependency>
530+
<usedDependency>org.apache.openjpa:openjpa</usedDependency>
531+
<usedDependency>uk.ltd.getahead:dwr</usedDependency>
532+
<usedDependency>org.glassfish.main.admingui:war</usedDependency>
533+
<usedDependency>org.springframework.retry:spring-retry</usedDependency>
534+
<usedDependency>io.github.faob-dev:aar</usedDependency>
535+
<usedDependency>org.apache.maven.scm:maven-scm-provider-cvsexe</usedDependency>
536+
<usedDependency>org.apache.axis2:axis2-spring</usedDependency>
537+
<usedDependency>org.apache.geronimo.daytrader:daytrader-ear</usedDependency>
538+
<usedDependency>org.springframework.security:spring-security-web</usedDependency>
539+
<usedDependency>org.apache.axis2:axis2-adb</usedDependency>
540+
</usedDependencies>
541+
</configuration>
542+
</plugin>
543+
</plugins>
544+
</pluginManagement>
545+
</build>
460546
<dependencies>
461547
<!-- The following dependencies are only used during testing
462548
and must not be converted to a properties based version number -->

‎core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
2323
import io.github.jeremylong.openvulnerability.client.nvd.Config;
2424
import io.github.jeremylong.openvulnerability.client.nvd.CpeMatch;
25-
import org.apache.commons.collections.map.ReferenceMap;
25+
import org.apache.commons.collections4.map.ReferenceMap;
2626
import org.owasp.dependencycheck.dependency.Vulnerability;
2727
import org.owasp.dependencycheck.dependency.VulnerableSoftware;
2828
import org.owasp.dependencycheck.utils.*;
@@ -44,8 +44,8 @@
4444
import java.util.stream.Collectors;
4545
import org.anarres.jdiagnostics.DefaultQuery;
4646

47-
import static org.apache.commons.collections.map.AbstractReferenceMap.HARD;
48-
import static org.apache.commons.collections.map.AbstractReferenceMap.SOFT;
47+
import static org.apache.commons.collections4.map.AbstractReferenceMap.ReferenceStrength.HARD;
48+
import static org.apache.commons.collections4.map.AbstractReferenceMap.ReferenceStrength.SOFT;
4949
import org.owasp.dependencycheck.analyzer.exception.LambdaExceptionWrapper;
5050
import org.owasp.dependencycheck.analyzer.exception.UnexpectedAnalysisException;
5151
import io.github.jeremylong.openvulnerability.client.nvd.DefCveItem;

‎maven/pom.xml‎

Lines changed: 36 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,17 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved.
9292
</plugin>
9393
</plugins>
9494
</reporting>
95+
<dependencyManagement>
96+
<dependencies>
97+
<dependency>
98+
<groupId>org.apache.maven</groupId>
99+
<artifactId>maven-resolver-provider</artifactId>
100+
<version>${maven.api.version}</version>
101+
<type>pom</type>
102+
<scope>import</scope>
103+
</dependency>
104+
</dependencies>
105+
</dependencyManagement>
95106
<dependencies>
96107
<dependency>
97108
<groupId>org.owasp</groupId>
@@ -103,10 +114,6 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved.
103114
<artifactId>dependency-check-utils</artifactId>
104115
<version>${project.parent.version}</version>
105116
</dependency>
106-
<dependency>
107-
<groupId>org.apache.commons</groupId>
108-
<artifactId>commons-jcs3-core</artifactId>
109-
</dependency>
110117
<dependency>
111118
<groupId>org.mockito</groupId>
112119
<artifactId>mockito-core</artifactId>
@@ -131,6 +138,10 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved.
131138
<artifactId>maven-core</artifactId>
132139
<scope>provided</scope>
133140
</dependency>
141+
<dependency>
142+
<groupId>org.apache.maven.doxia</groupId>
143+
<artifactId>doxia-sink-api</artifactId>
144+
</dependency>
134145
<dependency>
135146
<groupId>org.apache.maven.shared</groupId>
136147
<artifactId>file-management</artifactId>
@@ -179,6 +190,27 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved.
179190
<artifactId>maven-artifact</artifactId>
180191
<scope>provided</scope>
181192
</dependency>
193+
<dependency>
194+
<groupId>org.apache.maven.resolver</groupId>
195+
<artifactId>maven-resolver-api</artifactId>
196+
<scope>provided</scope>
197+
</dependency>
198+
<dependency>
199+
<groupId>org.apache.maven.shared</groupId>
200+
<artifactId>maven-common-artifact-filters</artifactId>
201+
</dependency>
202+
<dependency>
203+
<groupId>org.apache.commons</groupId>
204+
<artifactId>commons-lang3</artifactId>
205+
</dependency>
206+
<dependency>
207+
<groupId>io.github.jeremylong</groupId>
208+
<artifactId>open-vulnerability-clients</artifactId>
209+
</dependency>
210+
<dependency>
211+
<groupId>com.github.package-url</groupId>
212+
<artifactId>packageurl-java</artifactId>
213+
</dependency>
182214
</dependencies>
183215
<profiles>
184216
<profile>

0 commit comments

Comments
 (0)