This is an automated email from the ASF dual-hosted git repository.
epugh pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/solr.git
The following commit(s) were added to refs/heads/main by this push:
new 2ad41731f5a Wire up NVD API key for the owasp Gradle task (#4725)
2ad41731f5a is described below
commit 2ad41731f5a1c451f511f5b6685561d493304c1c
Author: Eric Pugh <[email protected]>
AuthorDate: Wed Aug 12 15:32:01 2026 -0400
Wire up NVD API key for the owasp Gradle task (#4725)
Co-authored-by: Claude Sonnet 5 <[email protected]>
---
changelog/unreleased/owasp-nvd-apikey.yml | 11 +++++++++++
dev-docs/FAQ.adoc | 7 ++++++-
dev-docs/gradle-help/workflow.txt | 1 +
gradle/libs.versions.toml | 2 +-
gradle/validation/owasp-dependency-check.gradle | 5 +++++
5 files changed, 24 insertions(+), 2 deletions(-)
diff --git a/changelog/unreleased/owasp-nvd-apikey.yml
b/changelog/unreleased/owasp-nvd-apikey.yml
new file mode 100644
index 00000000000..2892a3d3708
--- /dev/null
+++ b/changelog/unreleased/owasp-nvd-apikey.yml
@@ -0,0 +1,11 @@
+title: >
+ The `./gradlew owasp` dependency vulnerability check now supports an NVD API
key
+ (via `-PnvdApiKey` or `NVD_API_KEY`), and requires `--no-parallel` due to an
upstream
+ Gradle plugin issue. See dev-docs/FAQ.adoc for details.
+type: other
+authors:
+ - name: Eric Pugh
+links:
+ - name: PR#4725
+ url: https://github.com/apache/solr/pull/4725
+
diff --git a/dev-docs/FAQ.adoc b/dev-docs/FAQ.adoc
index 0690f557e5c..f4e98b90cc9 100644
--- a/dev-docs/FAQ.adoc
+++ b/dev-docs/FAQ.adoc
@@ -74,7 +74,12 @@ Learn more about using Forbidden APIs via `./gradlew
:helpForbiddenApis`.
To run a check for dependencies of Solr that have security vulnerabilities
using the https://plugins.gradle.org/plugin/org.owasp.dependencycheck[OWASP]
Gradle plugin.
Run via:
-`./gradlew owasp`
+`./gradlew owasp --no-parallel`
+
+This task downloads the NVD CVE database, which is heavily rate-limited for
unauthenticated requests and will fail with an error from `NvdApiDataSource`
without an API key.
+Request a free key at https://nvd.nist.gov/developers/request-an-api-key and
pass it via `-PnvdApiKey=<your-key>` or the `NVD_API_KEY` environment variable.
+
+The `--no-parallel` flag is required because of an unresolved upstream bug
where `dependencyCheckAggregate` resolves other projects' configurations
unsafely under Gradle's parallel project execution:
https://github.com/dependency-check/dependency-check-gradle/issues/462
There are a number of other tasks that get run to validate the source code,
and you can find them in the ./gradle/validation source tree.
diff --git a/dev-docs/gradle-help/workflow.txt
b/dev-docs/gradle-help/workflow.txt
index 47cde864f53..0c5c2d1142b 100644
--- a/dev-docs/gradle-help/workflow.txt
+++ b/dev-docs/gradle-help/workflow.txt
@@ -53,6 +53,7 @@ Other validation and checks
Generate a report of dependencies with known OWASP vulnerabilities:
gradlew :dependencyCheckAnalyze
open ./build/reports/dependency-check-report.html
+(requires an NVD API key, see dev-docs/FAQ.adoc)
Additional General Options
==========================
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 0c06757df4b..7f82ce16a6c 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -182,7 +182,7 @@ opentelemetry-runtime-telemetry = "2.27.0-alpha"
oshai-logging = "8.0.4"
# @keep for version alignment
ow2-asm = "9.10.1"
-owasp-dependencycheck = "12.2.2"
+owasp-dependencycheck = "13.0.0"
# @keep for version alignment
perfmark = "0.27.0"
prometheus-metrics = "1.8.0"
diff --git a/gradle/validation/owasp-dependency-check.gradle
b/gradle/validation/owasp-dependency-check.gradle
index b319dd48a35..cbeec495830 100644
--- a/gradle/validation/owasp-dependency-check.gradle
+++ b/gradle/validation/owasp-dependency-check.gradle
@@ -31,6 +31,11 @@ configure(rootProject) {
analyzers {
assemblyEnabled = false
}
+ nvd {
+ // NVD heavily rate-limits the CVE data feed for unauthenticated
requests.
+ // Get a free key from https://nvd.nist.gov/developers/request-an-api-key
+ apiKey = project.findProperty("nvdApiKey") ?:
System.getenv("NVD_API_KEY")
+ }
}
task owasp() {
