lein nvd check Task breaking #73
Comments
|
Those are the dependencies I'm using in the project that i've encountered the errors |
|
When running |
|
I'm seeing a very similar error
It looks to me like the DB that is being downloaded has changed, and that has caused something to break. |
|
@FnTm : the stacktrace you provided doesn't reflect |
|
@machadogab : the error one can see is: it's a pretty vanilla error and not necessarily related to lein-nvd. It relates more to dependency tree management. lein-nvd depends (transitively) on Jackson. That one is known to be a sensitive dependency: if some other dep changes its version number, then things can easily break. Checking out https://mvnrepository.com/artifact/org.owasp/dependency-check-core/6.0.5 (lein-nvd's dependency as of today), you can see that I'd check out that all jackson-related dependencies consistently have One technique I've come to find handy is to preventively place a 'wall' of jackson deps, so that no transitive dep can change one of those: |
rm-hull
pushed a commit
that referenced
this issue
May 12, 2021
* Accept an optional classpath argument By accepting a fixed user-provided string as the classpath, one can be sure that lein-nvd is not interfering in classpath computation and therefore one prevents false positives/negatives. Fixes #46 Also gives a way to easily solve: #50 #73 #74 * Draft an end-to-end test script * Adapt various tests * CI: introduce a JVM matrix * Run the integration test script in a parallel job
Sorry, my bad for muddying the waters. It actually looks like the issue I had has gone away, and I suspect it having something to do with the NVD database itself. |
|
lein-nvd 1.5.0 in conjunction with the following guide https://github.com/rm-hull/lein-nvd#avoiding-classpath-interference should make these issues go away. Would love to hear an experience report. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Edit: in order to clarify better what is going on:
We've been running lein nvd check to automate a patch process in our team, and it has been really smooth, since yesterday things started breaking (as stated below). We had a hypothesis that it could be the dependency-check dependency, that was outdated, so we bumped it and released a "1.4.2" nvd-clojure dependency locally (via lein install). but we just got another error. Not sure where to look at to debug it.
Dependency-check released a new version yesterday
Since yesterday, wheven I run
lein nvd checkI get this stacktrace backI've tried patching locally the dependency-check to
6.1.3(a release that was made yesterday)And the stack changed to this:
In some scenarios it works without fails, but I was unable to figure out why.
If you need more info, let me know!
The text was updated successfully, but these errors were encountered: