Skip to content

regression: dependency-check-maven does not take dependencies' repositories into account anymore #3626

@victornoel

Description

@victornoel

I upgraded the maven plugin from 6.2.2 to 6.3.1 and now I'm getting this error during the execution of the check goal:

Caused by: org.owasp.dependencycheck.exception.ExceptionCollection: One or more exceptions occurred during analysis:
	ArtifactResolverException: Could not find artifact com.github.graphstream:gs-ui-swing:jar:2.0 in central (https://repo.maven.apache.org/maven2)
		caused by ArtifactResolutionException: Could not find artifact com.github.graphstream:gs-ui-swing:jar:2.0 in central (https://repo.maven.apache.org/maven2)
		caused by ArtifactNotFoundException: Could not find artifact com.github.graphstream:gs-ui-swing:jar:2.0 in central (https://repo.maven.apache.org/maven2)
	ArtifactResolverException: Could not find artifact com.github.graphstream:gs-core:jar:2.0 in central (https://repo.maven.apache.org/maven2)
		caused by ArtifactResolutionException: Could not find artifact com.github.graphstream:gs-core:jar:2.0 in central (https://repo.maven.apache.org/maven2)
		caused by ArtifactNotFoundException: Could not find artifact com.github.graphstream:gs-core:jar:2.0 in central (https://repo.maven.apache.org/maven2)
    at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.collectMavenDependencies (BaseDependencyCheckMojo.java:1320)
    at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.collectDependencies (BaseDependencyCheckMojo.java:1437)
    at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.scanArtifacts (BaseDependencyCheckMojo.java:1098)
    at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.scanArtifacts (BaseDependencyCheckMojo.java:1064)
    at org.owasp.dependencycheck.maven.CheckMojo.scanDependencies (CheckMojo.java:104)
    at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:1689)
    at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:950)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:137)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:210)
...

What is particular with this dependency is that it is downloaded from a repository that is declared in the pom of one of my project's dependency:

  • my project -> another project -> gs-core
  • with "another project" declaring a repository in its pom where gs-core can be found

Also note that executing the check goal directly on "another project" works as expected.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions