Support dependency check 8.0.0 #748
Labels
Comments
|
Please provide debug output from this section. |
|
Let me know anything else I can provide. |
|
Same issue with 8.0.1 of dependency check with parsing the json file. From the stack trace, it's saying that the xml file doesn't exist (but it does), because I don't have the xml file specified and I believe it's trying to use a jenkins specific variable WORKSPACE but I'm using atlassian bamboo for CI. I'll see about creating a test project with the dependencies to reproduce this issue to make it easier to reproduce if that's an issue. |
|
The analysis of the XML report is deprecated. Further development is done only with the JSON report. I haven't had time to look at the new report structure yet, but the key sounds very interesting for more features in this project. |
|
Will a temporary fix be released that will ignore the property until it's used? We were looking forward to upgrading to dependency-check 8.0.0 but because of this issue, our JSON report isn't being analyzed so the data aren't uploaded to Sonarqube. |
sellersj
added a commit
to sellersj/dependency-check-sonar-plugin
that referenced
this issue
Jan 24, 2023
sellersj
added a commit
to sellersj/dependency-check-sonar-plugin
that referenced
this issue
Jan 24, 2023
|
I am using Owasp Dependency-Check 8.4.0, Sonarqube version 8.9.1 and Sonar Scanner Gradle Plugin version 4.3.1.3277. I have the same problem. The plugin creates html report as normal but Sonarqube can not parse json report. Since we have many services and an audit waiting for us, we need to find a way to get vulnerabilities on Sonarqube. Is there any solution? |
|
@muratkucuktepe Should be fixed in 0ddad06 |
8.4.0 I have the same situation like here: #834 (comment) |
|
Hi @muratkucuktepe |
|
Hi @Reamer I was confused with the dependency-check-sonar plugin on Sonarqube and sonar-scanner-gradle plugin on Gradle, Intellij. Sincerely, |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
When moving from 7.4.4 to 8.0.0, the plugin does not seem to be able to report the json or xml file
To Reproduce
After running the
checktask, then runningsonar:sonar -Dsonar.dependencyCheck.jsonReportPath=./target/dependency-check-report.json -Dsonar.dependencyCheck.htmlReportPath=./target/dependency-check-report.htmlCurrent behavior
It prints errors and does not import the issues into sonarqube. It does import the html file okay.
Expected behavior
Expect it same behaviour as 7.4.4 with importing the issues
Screenshots
If applicable, add screenshots to help explain your problem.
Versions (please complete the following information):
Additional context
none
The text was updated successfully, but these errors were encountered: