maven-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Sylwester Lachiewicz (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (MPOM-210) Adding CVE Checks via OWASP
Date Thu, 11 Oct 2018 23:57:00 GMT

    [ https://issues.apache.org/jira/browse/MPOM-210?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16647199#comment-16647199
] 

Sylwester Lachiewicz commented on MPOM-210:
-------------------------------------------

Snyk looks interesting - I already configured my forks to run Snyk scan and receiving notifications
every day.

Maybe we can setup Snyk for Maven's projects with Github and send notifications to the mailing
list?

> Adding CVE Checks via OWASP
> ---------------------------
>
>                 Key: MPOM-210
>                 URL: https://issues.apache.org/jira/browse/MPOM-210
>             Project: Maven POMs
>          Issue Type: Improvement
>          Components: maven
>    Affects Versions: MAVEN-33
>            Reporter: Karl Heinz Marbaise
>            Priority: Critical
>             Fix For: MAVEN-34
>
>
> We should add a configuration for CVS checks for example via OWASP maven plugin.
> I think the first step should be add at least an entry in pluginManagement:
> {code}
>     <plugin>
>               <groupId>org.owasp</groupId>
>               <artifactId>dependency-check-maven</artifactId>
>               <version>3.3.2</version>
>   </plugin>
> {code}
> The other parts would be to add an entry for:
> https://github.com/sonatype/ossindex-maven
> which is not a good idea at the moment, cause it does not support JDK 10...



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

Mime
View raw message