Audit Maven - use maven-dep-tree plugin #1023

omerzi · 2023-11-09T13:32:19Z

All tests passed. If this feature is not already covered by the tests, I added new tests.
All static analysis checks passed.
This pull request is on the dev branch.
I used gofmt for formatting the code before submitting the pull request.

This pull request substitutes the maven-build-info extractor with the maven-dep-tree plugin (https://github.com/jfrog/maven-dep-tree) for Maven dependency graph calculation during the audit command. The plugin is lighter, doesn't require compilation, and is expected to notably enhance the runtime of dependency tree calculations.

# Conflicts: # go.mod # go.sum

# Conflicts: # artifactory/utils/projectconfig.go

# Conflicts: # xray/commands/audit/sca/java/mvn.go

xray/commands/audit/sca/java/mvn.go

yahavi

Incredible coding and super important change.
Please consider my inline comments.

xray/commands/audit/sca/java/deptreemanager_test.go

xray/commands/audit/sca/java/mvn.go

buildscripts/download-jars.sh

xray/commands/audit/sca/java/mvn.go

xray/commands/audit/sca/java/mvn_test.go

xray/commands/audit/sca/java/mvn.go

omerzi added 2 commits November 9, 2023 12:13

init commit

fdeb9ae

Merge remote-tracking branch 'upstream/dev' into mvn-dep-tree

f8ca081

# Conflicts: # go.mod # go.sum

omerzi added the improvement Automatically generated release notes label Nov 9, 2023

omerzi had a problem deploying to frogbot November 9, 2023 13:32 — with GitHub Actions Failure

omerzi changed the base branch from master to dev November 9, 2023 13:32

Merge branch 'dev' into mvn-dep-tree

faf177c

omerzi had a problem deploying to frogbot November 9, 2023 13:32 — with GitHub Actions Failure

omerzi added 2 commits November 9, 2023 15:35

fix static analysis

b2a782d

Merge remote-tracking branch 'origin/mvn-dep-tree' into mvn-dep-tree

9ba6866

omerzi had a problem deploying to frogbot November 9, 2023 13:35 — with GitHub Actions Failure

fix static analysis

80c03df

omerzi had a problem deploying to frogbot November 9, 2023 13:40 — with GitHub Actions Failure

fix gradle test

b6d73a0

omerzi had a problem deploying to frogbot November 9, 2023 13:55 — with GitHub Actions Failure

omerzi added 3 commits November 12, 2023 09:47

fix gradle test

485ebdc

Update jars

63d1f76

Merge remote-tracking branch 'origin/mvn-dep-tree' into mvn-dep-tree

1511903

omerzi had a problem deploying to frogbot November 13, 2023 07:07 — with GitHub Actions Failure

Merge remote-tracking branch 'upstream/dev' into mvn-dep-tree

7fbe7d0

# Conflicts: # artifactory/utils/projectconfig.go

omerzi had a problem deploying to frogbot November 13, 2023 07:08 — with GitHub Actions Failure

omerzi added 2 commits November 13, 2023 17:51

Merge remote-tracking branch 'upstream/dev' into mvn-dep-tree

b60d643

# Conflicts: # artifactory/utils/projectconfig.go

Merge remote-tracking branch 'origin/mvn-dep-tree' into mvn-dep-tree

fd84b8e

omerzi had a problem deploying to frogbot November 13, 2023 15:52 — with GitHub Actions Failure

Merge remote-tracking branch 'upstream/dev' into mvn-dep-tree

3e56246

# Conflicts: # artifactory/utils/projectconfig.go

omerzi had a problem deploying to frogbot November 14, 2023 08:26 — with GitHub Actions Failure

omerzi added 2 commits November 14, 2023 12:52

Merge remote-tracking branch 'upstream/dev' into mvn-dep-tree

be4c85f

# Conflicts: # artifactory/utils/projectconfig.go

Merge remote-tracking branch 'origin/mvn-dep-tree' into mvn-dep-tree

7267cb6

# Conflicts: # xray/commands/audit/sca/java/mvn.go

omerzi had a problem deploying to frogbot November 14, 2023 10:54 — with GitHub Actions Failure

Merge branch 'dev' into mvn-dep-tree

e246bac

omerzi had a problem deploying to frogbot November 14, 2023 10:54 — with GitHub Actions Failure

yahavi reviewed Nov 15, 2023

View reviewed changes

xray/commands/audit/sca/java/mvn.go Outdated Show resolved Hide resolved

CR + improvements

451f53d

omerzi had a problem deploying to frogbot November 15, 2023 09:49 — with GitHub Actions Failure

fix test

9c7f366

omerzi had a problem deploying to frogbot November 15, 2023 10:02 — with GitHub Actions Failure

fix test

48aaccd

omerzi had a problem deploying to frogbot November 15, 2023 11:14 — with GitHub Actions Failure

fix test

5edcb17

omerzi had a problem deploying to frogbot November 15, 2023 11:43 — with GitHub Actions Failure

omerzi mentioned this pull request Nov 15, 2023

Incorporate maven-dep-tree plugin jfrog/frogbot#576

Merged

3 tasks

Merge branch 'dev' into mvn-dep-tree

0c8020b

omerzi had a problem deploying to frogbot November 15, 2023 14:26 — with GitHub Actions Failure

Merge remote-tracking branch 'upstream/dev' into mvn-dep-tree

53390b0

omerzi had a problem deploying to frogbot November 16, 2023 11:24 — with GitHub Actions Failure

yahavi requested changes Nov 19, 2023

View reviewed changes

yahavi reviewed Nov 19, 2023

View reviewed changes

xray/commands/audit/sca/java/mvn.go Outdated Show resolved Hide resolved

CR

5fdbb8f

omerzi had a problem deploying to frogbot November 19, 2023 10:18 — with GitHub Actions Failure

CR

198ed60

omerzi had a problem deploying to frogbot November 19, 2023 10:28 — with GitHub Actions Failure

CR

2409fe7

omerzi had a problem deploying to frogbot November 19, 2023 10:33 — with GitHub Actions Failure

CR

44bca20

omerzi had a problem deploying to frogbot November 19, 2023 10:38 — with GitHub Actions Failure

CR

f701fad

omerzi had a problem deploying to frogbot November 19, 2023 10:38 — with GitHub Actions Failure

omerzi merged commit 52da35c into jfrog:dev Nov 19, 2023
7 of 8 checks passed

asafgabai mentioned this pull request Nov 28, 2023

Task get stuck because of transitive dependencies jfrog/gradle-dep-tree#21

Closed

yahavi mentioned this pull request Nov 28, 2023

Bump gradle-dep-tree dependency to 3.0.0 #853

Closed

pixdrift mentioned this pull request Feb 27, 2024

Inclusion of maven-dep-tree has indirectly increased minimum Maven version requirement for jfrog-cli #1141

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Audit Maven - use maven-dep-tree plugin #1023

Audit Maven - use maven-dep-tree plugin #1023

omerzi commented Nov 9, 2023 •

edited

Loading

yahavi left a comment

Audit Maven - use maven-dep-tree plugin #1023

Audit Maven - use maven-dep-tree plugin #1023

Conversation

omerzi commented Nov 9, 2023 • edited Loading

yahavi left a comment

Choose a reason for hiding this comment

omerzi commented Nov 9, 2023 •

edited

Loading