dejan2609 commented on code in PR #23358: URL: https://github.com/apache/kafka/pull/23358#discussion_r4436077814
########## README.md: ########## @@ -121,6 +121,14 @@ Core Module (:core): `core/build/reports/scoverageTest/index.html` Other Modules: `<module>/build/reports/jacoco/test/html/index.html` +### Running dependency vulnerability checks +To reduce NVD API rate limiting, supply an [NVD API key](https://nvd.nist.gov/developers/request-an-api-key) +through the `NVD_API_KEY` environment variable when running a dependency check: + +```bash +NVD_API_KEY=your-nvd-api-key ./gradlew dependencyCheckAggregate --no-parallel +``` Review Comment: There is a pitfall with this command: `NVD_API_KEY=your-nvd-api-key ./gradlew dependencyCheckAggregate --no-parallel` shows results in the terminal on the first execution: ``` One or more dependencies were identified with known vulnerabilities in kafka: <some vulnerabilities> See the dependency-check report for more details. ``` while on subsequent executions nothing is shown. **The reason:** the dependency-check tasks declare only an output directory and no inputs, so Gradle marks them `UP-TO-DATE` and skips them entirely. The scan does not run, the NVD database is not updated, and the HTML report stays as it was, even if dependency versions change or new CVEs are published. Only `clean` (or `--rerun`) makes the task execute again (or a Gradle / dependency-check plugin version change, etc.). **Could you address this with one of these options:** 1. via `build.gradle`: configure dependencyCheck related tasks with `outputs.upToDateWhen { false }` ```groovy tasks.matching { it.name in ['dependencyCheckAggregate', 'dependencyCheckAnalyze'] }.configureEach { outputs.upToDateWhen { false } } ``` 2. via `README.md`, add `--rerun`: `NVD_API_KEY=your-nvd-api-key ./gradlew dependencyCheckAggregate --rerun --no-parallel` Reasons for option 1: it works no matter how the task is invoked (no flag to remember, and also when the task is triggered by another task), while NVD traffic stays limited by the plugin's `nvd.validForHours` (4 hours by default). Reasons for option 2: simplicity (but it only helps when people remember to add the flag). ___ _Note: Drafted with Claude, then reviewed and edited._ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
