Skip to content

Move dependency-check-maven plugin from reporting to build#1145

Merged
timtebeek merged 1 commit intomainfrom
move-owasp-plugin-to-build
Apr 16, 2026
Merged

Move dependency-check-maven plugin from reporting to build#1145
timtebeek merged 1 commit intomainfrom
move-owasp-plugin-to-build

Conversation

@Jenson3210
Copy link
Copy Markdown
Contributor

@Jenson3210 Jenson3210 commented Apr 16, 2026

Summary

Test plan

  • mvn org.owasp:dependency-check-maven:check should now apply suppressions.xml
  • CVE-2025-67030 (plexus-utils) should no longer appear in scan output

The plugin was configured under <reporting>, which is only read during
`mvn site`. The vulnerability scan workflow invokes the plugin directly
via `mvn org.owasp:dependency-check-maven:check`, which only reads
<build><plugins> config — so suppressions.xml was never applied.

Refs moderneinc/dependency-vulnerability-reports#1044
@github-project-automation github-project-automation Bot moved this from In Progress to Ready to Review in OpenRewrite Apr 16, 2026
@timtebeek timtebeek merged commit 57942a3 into main Apr 16, 2026
1 check passed
@timtebeek timtebeek deleted the move-owasp-plugin-to-build branch April 16, 2026 11:14
@github-project-automation github-project-automation Bot moved this from Ready to Review to Done in OpenRewrite Apr 16, 2026
mergify Bot added a commit to robfrank/linklift that referenced this pull request May 3, 2026
… 6.34.0 to 6.38.0 [skip ci]

Bumps [org.openrewrite.maven:rewrite-maven-plugin](https://github.com/openrewrite/rewrite-maven-plugin) from 6.34.0 to 6.38.0.
Release notes

*Sourced from [org.openrewrite.maven:rewrite-maven-plugin's releases](https://github.com/openrewrite/rewrite-maven-plugin/releases).*

> 6.38.0
> ------
>
> **Full Changelog**: <openrewrite/rewrite-maven-plugin@v6.37.0...v6.38.0>
>
> 6.37.0
> ------
>
> What's Changed
> --------------
>
> * Fix GHSA-6fmv-xxpf-w3cw: pin plexus-utils 3.6.1 and suppress false positive by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1138](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1138)
> * Validate DEVELOCITY\_ACCESS\_KEY format before build by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1141](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1141)
> * Add Slack notification for scheduled CI failures by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1140](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1140)
> * Resolve Maven user properties (-D) in YAML configuration by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1139](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1139)
> * Skip parsing generated sources; use compiled classes instead by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1142](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1142)
> * chore(ci): bump org.owasp:dependency-check-maven from 12.2.0 to 12.2.1 by [`@​dependabot`](https://github.com/dependabot)[bot] in [openrewrite/rewrite-maven-plugin#1143](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1143)
> * Fix plexus-utils CVE-2025-67030 suppression by [`@​Jenson3210`](https://github.com/Jenson3210) in [openrewrite/rewrite-maven-plugin#1144](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1144)
> * Move dependency-check-maven plugin from reporting to build by [`@​Jenson3210`](https://github.com/Jenson3210) in [openrewrite/rewrite-maven-plugin#1145](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1145)
> * chore(ci): bump actions/upload-pages-artifact from 4 to 5 by [`@​dependabot`](https://github.com/dependabot)[bot] in [openrewrite/rewrite-maven-plugin#1146](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1146)
> * chore(ci): bump io.micrometer:micrometer-core from 1.16.4 to 1.16.5 by [`@​dependabot`](https://github.com/dependabot)[bot] in [openrewrite/rewrite-maven-plugin#1148](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1148)
> * chore(ci): bump maven-dependencies.version from 3.9.14 to 3.9.15 by [`@​dependabot`](https://github.com/dependabot)[bot] in [openrewrite/rewrite-maven-plugin#1147](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1147)
>
> **Full Changelog**: <openrewrite/rewrite-maven-plugin@v6.36.0...v6.37.0>
>
> 6.36.0
> ------
>
> **Full Changelog**: <openrewrite/rewrite-maven-plugin@v6.35.1...v6.36.0>
>
> 6.35.1
> ------
>
> What's Changed
> --------------
>
> * Fix datatable\_export test for updated CSV column headers by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1132](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1132)
> * chore(ci): bump actions/configure-pages from 5 to 6 by [`@​dependabot`](https://github.com/dependabot)[bot] in [openrewrite/rewrite-maven-plugin#1129](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1129)
> * chore(ci): bump actions/deploy-pages from 4 to 5 by [`@​dependabot`](https://github.com/dependabot)[bot] in [openrewrite/rewrite-maven-plugin#1130](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1130)
> * Fix files falsely marked as changed by migration recipes by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1134](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1134)
> * Pass null properties when resolvePropertiesInYaml=false by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1133](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1133)
> * Fix isExcluded gitignore handling using shared GitIgnore utility by [`@​pdelagrave`](https://github.com/pdelagrave) in [openrewrite/rewrite-maven-plugin#1135](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1135)
> * bump vulnerabilities by [`@​Jenson3210`](https://github.com/Jenson3210) in [openrewrite/rewrite-maven-plugin#1136](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1136)
>
> New Contributors
> ----------------
>
> * [`@​pdelagrave`](https://github.com/pdelagrave) made their first contribution in [openrewrite/rewrite-maven-plugin#1135](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1135)
>
> **Full Changelog**: <openrewrite/rewrite-maven-plugin@v6.35.0...v6.35.1>
>
> 6.35.0
> ------
>
> What's Changed
> --------------
>
> * Add optional version input to publish workflow by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1124](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1124)
> * Use CsvDataTableStore for data table export by [`@​jkschneider`](https://github.com/jkschneider) in [openrewrite/rewrite-maven-plugin#1125](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1125)
> * chore(ci): bump com.fasterxml.jackson:jackson-bom from 2.17.3 to 2.21.2 by [`@​dependabot`](https://github.com/dependabot)[bot] in [openrewrite/rewrite-maven-plugin#1126](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1126)
> * Load proxy settings from Maven settings.xml by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-maven-plugin#1127](https://redirect.github.com/openrewrite/rewrite-maven-plugin/pull/1127)
>
> **Full Changelog**: <openrewrite/rewrite-maven-plugin@v6.34.0...v6.35.0>


Commits

* [`4fe065c`](openrewrite/rewrite-maven-plugin@4fe065c) [maven-release-plugin] prepare release v6.38.0
* [`446bc8a`](openrewrite/rewrite-maven-plugin@446bc8a) Bump rewrite.version property
* [`f3d983c`](openrewrite/rewrite-maven-plugin@f3d983c) Bump rewrite.version property
* [`b5565ff`](openrewrite/rewrite-maven-plugin@b5565ff) Bump rewrite.version property
* [`b7d7640`](openrewrite/rewrite-maven-plugin@b7d7640) [maven-release-plugin] prepare for next development iteration
* [`caecb2f`](openrewrite/rewrite-maven-plugin@caecb2f) [maven-release-plugin] prepare release v6.37.0
* [`68bab02`](openrewrite/rewrite-maven-plugin@68bab02) Bump rewrite.version property
* [`841ed61`](openrewrite/rewrite-maven-plugin@841ed61) chore(ci): bump maven-dependencies.version from 3.9.14 to 3.9.15 ([#1147](https://redirect.github.com/openrewrite/rewrite-maven-plugin/issues/1147))
* [`4b191ed`](openrewrite/rewrite-maven-plugin@4b191ed) chore(ci): bump io.micrometer:micrometer-core from 1.16.4 to 1.16.5 ([#1148](https://redirect.github.com/openrewrite/rewrite-maven-plugin/issues/1148))
* [`e8cb166`](openrewrite/rewrite-maven-plugin@e8cb166) chore(ci): bump actions/upload-pages-artifact from 4 to 5 ([#1146](https://redirect.github.com/openrewrite/rewrite-maven-plugin/issues/1146))
* Additional commits viewable in [compare view](openrewrite/rewrite-maven-plugin@v6.34.0...v6.38.0)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Archived in project

Development

Successfully merging this pull request may close these issues.

2 participants