This is an automated email from the ASF dual-hosted git repository.
epugh pushed a commit to branch branch_9x
in repository https://gitbox.apache.org/repos/asf/solr.git
The following commit(s) were added to refs/heads/branch_9x by this push:
new dda8c58b79e Update plugin org.owasp.dependencycheck to v13 (branch_9x)
(#4720)
dda8c58b79e is described below
commit dda8c58b79e2aa54ab5f328adc34f24508ece728
Author: Solr Bot <[email protected]>
AuthorDate: Wed Aug 12 21:31:02 2026 +0200
Update plugin org.owasp.dependencycheck to v13 (branch_9x) (#4720)
Co-authored-by: Eric Pugh <[email protected]>
---
build.gradle | 2 +-
dev-docs/FAQ.adoc | 3 +++
dev-docs/gradle-help/workflow.txt | 1 +
gradle/validation/owasp-dependency-check.gradle | 5 +++++
4 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/build.gradle b/build.gradle
index 2f2d7916020..0a1fdebb1e8 100644
--- a/build.gradle
+++ b/build.gradle
@@ -21,7 +21,7 @@ import java.time.format.DateTimeFormatter
plugins {
id 'base'
id 'com.palantir.consistent-versions' version '2.32.0'
- id 'org.owasp.dependencycheck' version '12.2.2'
+ id 'org.owasp.dependencycheck' version '13.0.0'
id 'ca.cutterslade.analyze' version '1.10.0'
id 'de.thetaphi.forbiddenapis' version '3.10' apply false
id 'net.ltgt.errorprone' version '5.1.0' apply false
diff --git a/dev-docs/FAQ.adoc b/dev-docs/FAQ.adoc
index 30bbcc52507..46b4c169ff4 100644
--- a/dev-docs/FAQ.adoc
+++ b/dev-docs/FAQ.adoc
@@ -66,6 +66,9 @@ Run via:
`./gradlew owasp`
+This task downloads the NVD CVE database, which is heavily rate-limited for
unauthenticated requests and will fail with an error from `NvdApiDataSource`
without an API key.
+Request a free key at https://nvd.nist.gov/developers/request-an-api-key and
pass it via `-PnvdApiKey=<your-key>` or the `NVD_API_KEY` environment variable.
+
There are a number of other tasks that get run to validate the source code,
and you can find them in the ./gradle/validation source tree.
=== Generated files
diff --git a/dev-docs/gradle-help/workflow.txt
b/dev-docs/gradle-help/workflow.txt
index 47cde864f53..0c5c2d1142b 100644
--- a/dev-docs/gradle-help/workflow.txt
+++ b/dev-docs/gradle-help/workflow.txt
@@ -53,6 +53,7 @@ Other validation and checks
Generate a report of dependencies with known OWASP vulnerabilities:
gradlew :dependencyCheckAnalyze
open ./build/reports/dependency-check-report.html
+(requires an NVD API key, see dev-docs/FAQ.adoc)
Additional General Options
==========================
diff --git a/gradle/validation/owasp-dependency-check.gradle
b/gradle/validation/owasp-dependency-check.gradle
index 921248e7e03..912c1c7b219 100644
--- a/gradle/validation/owasp-dependency-check.gradle
+++ b/gradle/validation/owasp-dependency-check.gradle
@@ -32,6 +32,11 @@ configure(rootProject) {
analyzers {
assemblyEnabled = false
}
+ nvd {
+ // NVD heavily rate-limits the CVE data feed for unauthenticated
requests.
+ // Get a free key from https://nvd.nist.gov/developers/request-an-api-key
+ apiKey = project.findProperty("nvdApiKey") ?:
System.getenv("NVD_API_KEY")
+ }
}
task owasp() {
