Sonatype requires authentication

[svdo]

Description

Sonatype ossindex stopped working because they have introduced a requirement to use an API Token. See: https://ossindex.sonatype.org/doc/auth-required.

I'm preparing a PR for this.

Version

5.1.0

Java version

openjdk version "21.0.2" 2024-01-16
OpenJDK Runtime Environment (build 21.0.2+13-58)
OpenJDK 64-Bit Server VM (build 21.0.2+13-58, mixed mode, sharing)

Installation compliance

• I have read again and made sure that I'm following exactly the instructions for my tool of choice (Leiningen, Clojure CLI, Clojure CLI Tool).
• I understand that false positives can be skipped locally and should be reported to DependencyCheck.

[tobias]

I haven't had a chance to look at this yet, but note that a workaround for now is to add an explicit dependency on org.owasp/dependency-check-core {:mvn/version "12.1.6"}. That version will disable the OSSIndex checking if credentials are provided, which should allow nvd-clojure to run (with somewhat diminished capacity).

[tobias]

This was fixed in 5.2.0 (see #194).