See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/259/display/redirect?page=changes>
Changes: [github] docs(skills): add triaging-security-reports skill (#1722) [github] WW-5631 Add opt-in @StrutsParameter enforcement to ChainingInterceptor (#1719) [github] build(deps): bump maven-surefire-plugin.version from 3.5.5 to 3.5.6 (#1731) [github] build(deps): bump org.apache.maven.plugins:maven-dependency-plugin (#1730) [github] build(deps): bump github/codeql-action from 4.36.0 to 4.36.2 (#1734) [github] build(deps-dev): bump org.apache.maven.plugins:maven-failsafe-plugin (#1732) [github] WW-5630 - Performance Issue SecurityMemberAccess (#1721) [github] WW-5632 Harden commons-fileupload2 dependency against milestone binary-incompatibility (#1735) [github] build(deps): bump com.fasterxml.jackson:jackson-bom (#1729) [github] build(deps): bump org.htmlunit:htmlunit from 4.21.0 to 5.1.0 (#1733) [github] WW-5630 test: streamline ConfigParseUtilTest and convert to JUnit 4 (#1740) [github] WW-5636 Harden redirect URL escaping in non-302 response body (#1737) [github] WW-5635 Avoid logging sensitive token values in TokenHelper (#1738) [github] Release 7.2.0-RC1 (#1742) [github] WW-5256 Decouple FreeMarker whitespace stripping from devMode (#1743) ------------------------------------------ Started by timer Running as SYSTEM [EnvInject] - Loading node environment variables. Building remotely on builds24 (ubuntu) in workspace <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/> The recommended git tool is: NONE No credentials specified > git rev-parse --resolve-git-dir > <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/.git> > # timeout=10 Fetching changes from the remote Git repository > git config remote.origin.url https://gitbox.apache.org/repos/asf/struts.git > # timeout=10 Fetching upstream changes from https://gitbox.apache.org/repos/asf/struts.git > git --version # timeout=10 > git --version # 'git version 2.34.1' > git fetch --tags --force --progress -- > https://gitbox.apache.org/repos/asf/struts.git > +refs/heads/*:refs/remotes/origin/* # timeout=10 > git rev-parse refs/remotes/origin/main^{commit} # timeout=10 Checking out Revision 59e342488d9ee6c67861eef1753aeffb09125939 (refs/remotes/origin/main) > git config core.sparsecheckout # timeout=10 > git checkout -f 59e342488d9ee6c67861eef1753aeffb09125939 # timeout=10 Commit message: "WW-5256 Decouple FreeMarker whitespace stripping from devMode (#1743)" > git rev-list --no-walk e637bb16a3f1a011a1bd627b7c06fbf54be06525 # timeout=10 ERROR: No tool found matching MAVEN_3_LATEST__HOME Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3 [Struts-master-dependency-check] $ /bin/sh -xe /tmp/jenkins9131346237606821382.sh + export MAVEN_OPTS=-Xms2g -Xmx2g + /home/jenkins/tools/maven/latest3/bin/mvn verify -Pdependency-check [INFO] Scanning for projects... [INFO] ------------------------------------------------------------------------ [INFO] Reactor Build Order: [INFO] [INFO] Struts 2 [pom] [INFO] Struts BOM [pom] [INFO] Struts Parent POM [pom] [INFO] Struts 2 Jakarta EE Compatible modules [pom] [INFO] Struts 2 Jakarta EE Compatible Velocity Tools View [jar] [INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp [jar] [INFO] Struts 2 Core [jar] [INFO] Struts 2 Plugins [pom] [INFO] Struts 2 Async Plugin [jar] [INFO] Struts 2 Bean Validation Plugin [jar] [INFO] Struts 2 CDI Plugin [jar] [INFO] Struts 2 Spring Plugin [jar] [INFO] Struts 2 JUnit Plugin [jar] [INFO] Struts 2 Velocity Plugin [jar] [INFO] Struts 2 Configuration Browser Plugin [jar] [INFO] Struts 2 Convention Plugin [jar] [INFO] Struts 2 Jasper Reports Plugin [jar] [INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] [jar] [INFO] Struts 2 Java Templates Plugin [jar] [INFO] Struts 2 JFreeChart Plugin [jar] [INFO] Struts 2 JSON Plugin [jar] [INFO] Struts 2 REST Plugin [jar] [INFO] Struts 2 TestNG Plugin [jar] [INFO] Struts 2 Tiles Plugin [jar] [INFO] Struts 2 XSLT Plugin [jar] [INFO] Struts 2 Webapps [pom] [INFO] Struts 2 Showcase Webapp [war] [INFO] Struts 2 Rest Showcase Webapp [war] [INFO] Struts 2 Assembly [pom] [INFO] [INFO] -----------------< org.apache.struts:struts2-project >------------------ [INFO] Building Struts 2 7.2.1-SNAPSHOT [1/29] [INFO] from pom.xml [INFO] --------------------------------[ pom ]--------------------------------- [INFO] [INFO] --- enforcer:3.6.3:enforce (enforce) @ struts2-project --- [INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.BannedDependencies passed [INFO] [INFO] --- enforcer:3.6.3:enforce (enforce-maven-version) @ struts2-project --- [INFO] Rule 0: org.apache.maven.enforcer.rules.version.RequireMavenVersion passed [INFO] [INFO] --- enforcer:3.6.3:enforce (enforce-java-version) @ struts2-project --- [INFO] Rule 0: org.apache.maven.enforcer.rules.version.RequireJavaVersion passed [INFO] [INFO] --- remote-resources:3.1.0:process (process-resource-bundles) @ struts2-project --- [INFO] Preparing remote bundle org.apache.apache.resources:apache-jar-resource-bundle:1.5 [INFO] Copying 3 resources from 1 bundle. [INFO] [INFO] --- bundle:6.0.2:manifest (bundle-manifest) @ struts2-project --- [WARNING] Ignoring project type pom - supportedProjectTypes = [jar, bundle] [INFO] [INFO] --- apache-rat:0.18:check (default) @ struts2-project --- [INFO] No issues found. [INFO] [INFO] --- site:3.22.0:attach-descriptor (attach-descriptor) @ struts2-project --- [INFO] Attaching 'src/site/site.xml' site descriptor with classifier 'site'. [INFO] [INFO] --- site:3.22.0:attach-descriptor (site-inheritance) @ struts2-project --- [INFO] Attaching 'src/site/site.xml' site descriptor with classifier 'site'. [WARNING] artifact org.apache.struts:struts2-project:xml:site:7.2.1-SNAPSHOT already attached, replace previous instance [INFO] [INFO] --- dependency-check:12.2.2:check (default) @ struts2-project --- [INFO] Checking for updates [WARNING] An NVD API Key was not provided - it is highly recommended to use an NVD API key as the update can take a VERY long time without an API Key [WARNING] NVD API request failures are occurring; retrying request for the 15th time [WARNING] NVD API request failures are occurring; retrying request for the 16th time [WARNING] NVD API request failures are occurring; retrying request for the 17th time [WARNING] NVD API request failures are occurring; retrying request for the 18th time [WARNING] NVD API request failures are occurring; retrying request for the 19th time [WARNING] NVD API request failures are occurring; retrying request for the 20th time [WARNING] NVD API request failures are occurring; retrying request for the 21st time [WARNING] NVD API request failures are occurring; retrying request for the 22nd time [WARNING] NVD API request failures are occurring; retrying request for the 23rd time [WARNING] NVD API request failures are occurring; retrying request for the 24th time [WARNING] NVD API request failures are occurring; retrying request for the 25th time [WARNING] NVD API request failures are occurring; retrying request for the 26th time [WARNING] NVD API request failures are occurring; retrying request for the 27th time [WARNING] NVD API request failures are occurring; retrying request for the 28th time [WARNING] NVD API request failures are occurring; retrying request for the 29th time [WARNING] NVD API request failures are occurring; retrying request for the 30th time [WARNING] NVD API request failures are occurring; retrying request for the 31st time [ERROR] Error updating the NVD Data org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:387) at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:128) at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:887) at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:692) at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:619) at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:2093) at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1291) at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126) at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328) at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174) at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75) at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162) at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159) at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105) at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73) at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53) at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118) at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261) at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173) at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101) at org.apache.maven.cli.MavenCli.execute (MavenCli.java:906) at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:283) at org.apache.maven.cli.MavenCli.main (MavenCli.java:206) at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method) at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:77) at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke (Method.java:569) at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255) at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201) at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:361) at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314) Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: NVD Returned Status Code: 429 at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:445) at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next (NvdCveClient.java:356) at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:343) at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:128) at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:887) at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:692) at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:619) at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:2093) at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1291) at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126) at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328) at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174) at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75) at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162) at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159) at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105) at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73) at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53) at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118) at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261) at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173) at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101) at org.apache.maven.cli.MavenCli.execute (MavenCli.java:906) at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:283) at org.apache.maven.cli.MavenCli.main (MavenCli.java:206) at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method) at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:77) at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke (Method.java:569) at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255) at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201) at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:361) at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314) [INFO] Updating CISA Known Exploited Vulnerability list: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json [INFO] Begin database defrag [INFO] End database defrag (12037 ms) [WARNING] Unable to update 1 or more Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities. [ERROR] Unable to continue dependency-check analysis. [INFO] ------------------------------------------------------------------------ [INFO] Reactor Summary for Struts 2 7.2.1-SNAPSHOT: [INFO] [INFO] Struts 2 ........................................... FAILURE [ 27.079 s] [INFO] Struts BOM ......................................... SKIPPED [INFO] Struts Parent POM .................................. SKIPPED [INFO] Struts 2 Jakarta EE Compatible modules ............. SKIPPED [INFO] Struts 2 Jakarta EE Compatible Velocity Tools View . SKIPPED [INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp .. SKIPPED [INFO] Struts 2 Core ...................................... SKIPPED [INFO] Struts 2 Plugins ................................... SKIPPED [INFO] Struts 2 Async Plugin .............................. SKIPPED [INFO] Struts 2 Bean Validation Plugin .................... SKIPPED [INFO] Struts 2 CDI Plugin ................................ SKIPPED [INFO] Struts 2 Spring Plugin ............................. SKIPPED [INFO] Struts 2 JUnit Plugin .............................. SKIPPED [INFO] Struts 2 Velocity Plugin ........................... SKIPPED [INFO] Struts 2 Configuration Browser Plugin .............. SKIPPED [INFO] Struts 2 Convention Plugin ......................... SKIPPED [INFO] Struts 2 Jasper Reports Plugin ..................... SKIPPED [INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] .... SKIPPED [INFO] Struts 2 Java Templates Plugin ..................... SKIPPED [INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED [INFO] Struts 2 JSON Plugin ............................... SKIPPED [INFO] Struts 2 REST Plugin ............................... SKIPPED [INFO] Struts 2 TestNG Plugin ............................. SKIPPED [INFO] Struts 2 Tiles Plugin .............................. SKIPPED [INFO] Struts 2 XSLT Plugin ............................... SKIPPED [INFO] Struts 2 Webapps ................................... SKIPPED [INFO] Struts 2 Showcase Webapp ........................... SKIPPED [INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED [INFO] Struts 2 Assembly .................................. SKIPPED [INFO] ------------------------------------------------------------------------ [INFO] BUILD FAILURE [INFO] ------------------------------------------------------------------------ [INFO] Total time: 29.488 s [INFO] Finished at: 2026-06-22T06:39:41Z [INFO] ------------------------------------------------------------------------ [ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.2:check (default) on project struts2-project: Fatal exception(s) analyzing Struts 2: One or more exceptions occurred during analysis: [ERROR] UpdateException: Error updating the NVD Data [ERROR] caused by NvdApiException: NVD Returned Status Code: 429 [ERROR] NoDataException: No documents exist [ERROR] -> [Help 1] [ERROR] [ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch. [ERROR] Re-run Maven using the -X switch to enable full debug logging. [ERROR] [ERROR] For more information about the errors and possible solutions, please read the following articles: [ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException Build step 'Execute shell' marked build as failure ERROR: No tool found matching MAVEN_3_LATEST__HOME Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
