See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/264/display/redirect?page=changes>
Changes: [github] docs: correct stale facts in CLAUDE.md (#1857) [github] WW-5675 Share parsed OGNL security configuration across SecurityMemberAccess instances (#1847) [github] WW-5676 test(ognl): pin the array package-resolution decision (#1858) [github] WW-5677 perf(ognl): drop the residual getPackage() lookups on the access path (#1859) [github] build(deps): bump github/codeql-action from 4.37.6 to 4.37.7 (#1856) [github] build(deps): bump org.htmlunit:htmlunit from 5.3.0 to 5.4.0 (#1853) [github] build(deps): bump org.apache.felix:maven-bundle-plugin (#1831) [github] WW-5685 fix(conversion): skip the mapped key instead of abandoning the file (#1860) [github] WW-1742 docs(execAndWait): document token-scoped background process naming (#1861) [github] WW-5688 fix(rest): resolve id-bearing URIs into the root namespace when declared (#1862) [github] WW-5690 perf(dispatcher): load the dev-mode error template on first use (#1864) [github] Update Maven Central badge link in README (#1875) [github] chore(copilot): add code-review agent skill (#1876) [github] docs: add merging-dependabot-prs skill (#1877) [github] WW-5695 Derive HTML5 constraint attributes from validators, deprecate the JS validator (#1865) [github] build(deps): bump org.apache.maven.wrapper:maven-wrapper from 3.3.2 to 3.3.4 (#1870) [github] build(deps): bump github/codeql-action from 4.37.7 to 4.37.8 (#1867) [github] build(deps-dev): bump byte-buddy.version from 1.18.11 to 1.18.12 (#1866) [github] build(deps-dev): bump org.apache.commons:commons-collections4 from 4.5.0 to 4.6.0 (#1838) [github] build(deps-dev): bump commons-validator:commons-validator from 1.10.1 to 1.11.0 (#1833) [github] chore: remove stale Claude Code agents and commands (#1884) [github] docs: point CLAUDE.md at THREAT_MODEL.md for security scope (#1885) [github] docs: drop hardcoded test-class counts from the review guides (#1886) [github] WW-5697 Restrict the indexed-access fast path in XWorkMethodAccessor to real indexed properties (#1871) [github] WW-5698 Scope the ModelDriven exemption in StrutsParameterAuthorizer to the model object (#1872) [github] WW-5700 fix(ognl): skip the store when a map or list element cannot be converted (#1873) [github] WW-5701 fix(conversion): compare the conversion marker by identity, not equals (#1874) [github] WW-5706 fix(core): align RestfulActionMapper action name handling with DefaultActionMapper (#1880) [github] WW-5707 chore(core): deprecate legacy restful and restful2 action mappers (#1882) ------------------------------------------ Started by timer Running as SYSTEM [EnvInject] - Loading node environment variables. Building remotely on builds24 (ubuntu) in workspace <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/> The recommended git tool is: NONE No credentials specified > git rev-parse --resolve-git-dir > <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/.git> > # timeout=10 Fetching changes from the remote Git repository > git config remote.origin.url https://gitbox.apache.org/repos/asf/struts.git > # timeout=10 Fetching upstream changes from https://gitbox.apache.org/repos/asf/struts.git > git --version # timeout=10 > git --version # 'git version 2.34.1' > git fetch --tags --force --progress -- > https://gitbox.apache.org/repos/asf/struts.git > +refs/heads/*:refs/remotes/origin/* # timeout=10 > git rev-parse refs/remotes/origin/main^{commit} # timeout=10 Checking out Revision 98fb891aac36b338d054425be129f3cd8ddd7fe9 (refs/remotes/origin/main) > git config core.sparsecheckout # timeout=10 > git checkout -f 98fb891aac36b338d054425be129f3cd8ddd7fe9 # timeout=10 Commit message: "WW-5707 chore(core): deprecate legacy restful and restful2 action mappers (#1882)" > git rev-list --no-walk 80278c16f6c193bd4cb7eb7d1501ff69b4b76b9b # timeout=10 ERROR: No tool found matching MAVEN_3_LATEST__HOME Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3 [Struts-master-dependency-check] $ /bin/sh -xe /tmp/jenkins16166536771524235760.sh + export MAVEN_OPTS=-Xms2g -Xmx2g + /home/jenkins/tools/maven/latest3/bin/mvn verify -Pdependency-check [INFO] Scanning for projects... [INFO] ------------------------------------------------------------------------ [INFO] Reactor Build Order: [INFO] [INFO] Struts 2 [pom] [INFO] Struts BOM [pom] [INFO] Struts Parent POM [pom] [INFO] Struts 2 Jakarta EE Compatible modules [pom] [INFO] Struts 2 Jakarta EE Compatible Velocity Tools View [jar] [INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp [jar] [INFO] Struts 2 Core [jar] [INFO] Struts 2 Plugins [pom] [INFO] Struts 2 Async Plugin [jar] [INFO] Struts 2 Bean Validation Plugin [jar] [INFO] Struts 2 CDI Plugin [jar] [INFO] Struts 2 Spring Plugin [jar] [INFO] Struts 2 JUnit Plugin [jar] [INFO] Struts 2 Velocity Plugin [jar] [INFO] Struts 2 Configuration Browser Plugin [jar] [INFO] Struts 2 Convention Plugin [jar] [INFO] Struts 2 Jasper Reports Plugin [jar] [INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] [jar] [INFO] Struts 2 Java Templates Plugin [jar] [INFO] Struts 2 JFreeChart Plugin [jar] [INFO] Struts 2 JSON Plugin [jar] [INFO] Struts 2 REST Plugin [jar] [INFO] Struts 2 TestNG Plugin [jar] [INFO] Struts 2 Tiles Plugin [jar] [INFO] Struts 2 XSLT Plugin [jar] [INFO] Struts 2 Webapps [pom] [INFO] Struts 2 Showcase Webapp [war] [INFO] Struts 2 Rest Showcase Webapp [war] [INFO] Struts 2 Assembly [pom] [INFO] [INFO] -----------------< org.apache.struts:struts2-project >------------------ [INFO] Building Struts 2 7.4.0-SNAPSHOT [1/29] [INFO] from pom.xml [INFO] --------------------------------[ pom ]--------------------------------- [INFO] [INFO] --- enforcer:3.6.3:enforce (enforce) @ struts2-project --- [INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.BannedDependencies passed [INFO] [INFO] --- enforcer:3.6.3:enforce (enforce-maven-version) @ struts2-project --- [INFO] Rule 0: org.apache.maven.enforcer.rules.version.RequireMavenVersion passed [INFO] [INFO] --- enforcer:3.6.3:enforce (enforce-java-version) @ struts2-project --- [INFO] Rule 0: org.apache.maven.enforcer.rules.version.RequireJavaVersion passed [INFO] [INFO] --- dependency-check:13.0.0:check (default) @ struts2-project --- [INFO] Checking for updates [ERROR] Error updating the NVD Data org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:387) at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:128) at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:873) at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:678) at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:605) at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:2072) at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1272) at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126) at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328) at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174) at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75) at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162) at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159) at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105) at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73) at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53) at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118) at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261) at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173) at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101) at org.apache.maven.cli.MavenCli.execute (MavenCli.java:919) at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:285) at org.apache.maven.cli.MavenCli.main (MavenCli.java:207) at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method) at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:77) at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke (Method.java:569) at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255) at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201) at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:362) at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314) Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: Invalid API Key, length of 0 too short to provided a masked partial key at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:436) at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next (NvdCveClient.java:356) at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:343) at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:128) at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:873) at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:678) at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:605) at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:2072) at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1272) at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126) at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328) at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174) at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75) at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162) at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39) at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159) at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105) at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73) at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53) at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118) at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261) at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173) at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101) at org.apache.maven.cli.MavenCli.execute (MavenCli.java:919) at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:285) at org.apache.maven.cli.MavenCli.main (MavenCli.java:207) at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method) at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:77) at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke (Method.java:569) at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255) at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201) at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:362) at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314) [INFO] Updating CISA Known Exploited Vulnerability list: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json [INFO] Begin database defrag [INFO] End database defrag (11696 ms) [INFO] Check for updates complete (14124 ms) [WARNING] Unable to update 1 or more Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities. [INFO] Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report. About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html [INFO] Analysis Started [INFO] Finished File Name Analyzer (0 seconds) [INFO] Finished Dependency Merging Analyzer (0 seconds) [INFO] Finished Hint Analyzer (0 seconds) [INFO] Created CPE Index (4 seconds) [INFO] Finished CPE Analyzer (4 seconds) [INFO] Finished False Positive Analyzer (0 seconds) [INFO] Finished NVD CVE Analyzer (0 seconds) [WARNING] Sonatype OSS Index Analyzer disabled due to missing credentials. Authentication with token is now required, and OSS Index is migrating to Sonatype Guide. See https://dependency-check.github.io/DependencyCheck/analyzers/oss-index-analyzer.html for more information on authentication with Sonatype Guide OSS Index. [INFO] Finished Vulnerability Suppression Analyzer (0 seconds) [INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds) [INFO] Finished Dependency Bundling Analyzer (0 seconds) [INFO] Finished Unused Suppression Rule Analyzer (0 seconds) [INFO] Analysis Complete (4 seconds) [INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/target/dependency-check-report.html> [INFO] ------------------------------------------------------------------------ [INFO] Reactor Summary for Struts 2 7.4.0-SNAPSHOT: [INFO] [INFO] Struts 2 ........................................... FAILURE [ 24.500 s] [INFO] Struts BOM ......................................... SKIPPED [INFO] Struts Parent POM .................................. SKIPPED [INFO] Struts 2 Jakarta EE Compatible modules ............. SKIPPED [INFO] Struts 2 Jakarta EE Compatible Velocity Tools View . SKIPPED [INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp .. SKIPPED [INFO] Struts 2 Core ...................................... SKIPPED [INFO] Struts 2 Plugins ................................... SKIPPED [INFO] Struts 2 Async Plugin .............................. SKIPPED [INFO] Struts 2 Bean Validation Plugin .................... SKIPPED [INFO] Struts 2 CDI Plugin ................................ SKIPPED [INFO] Struts 2 Spring Plugin ............................. SKIPPED [INFO] Struts 2 JUnit Plugin .............................. SKIPPED [INFO] Struts 2 Velocity Plugin ........................... SKIPPED [INFO] Struts 2 Configuration Browser Plugin .............. SKIPPED [INFO] Struts 2 Convention Plugin ......................... SKIPPED [INFO] Struts 2 Jasper Reports Plugin ..................... SKIPPED [INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] .... SKIPPED [INFO] Struts 2 Java Templates Plugin ..................... SKIPPED [INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED [INFO] Struts 2 JSON Plugin ............................... SKIPPED [INFO] Struts 2 REST Plugin ............................... SKIPPED [INFO] Struts 2 TestNG Plugin ............................. SKIPPED [INFO] Struts 2 Tiles Plugin .............................. SKIPPED [INFO] Struts 2 XSLT Plugin ............................... SKIPPED [INFO] Struts 2 Webapps ................................... SKIPPED [INFO] Struts 2 Showcase Webapp ........................... SKIPPED [INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED [INFO] Struts 2 Assembly .................................. SKIPPED [INFO] ------------------------------------------------------------------------ [INFO] BUILD FAILURE [INFO] ------------------------------------------------------------------------ [INFO] Total time: 26.727 s [INFO] Finished at: 2026-09-01T06:39:40Z [INFO] ------------------------------------------------------------------------ [ERROR] Failed to execute goal org.owasp:dependency-check-maven:13.0.0:check (default) on project struts2-project: One or more exceptions occurred during dependency-check analysis: One or more exceptions occurred during analysis: [ERROR] UpdateException: Error updating the NVD Data [ERROR] caused by NvdApiException: Invalid API Key, length of 0 too short to provided a masked partial key [ERROR] -> [Help 1] [ERROR] [ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch. [ERROR] Re-run Maven using the -X switch to enable full debug logging. [ERROR] [ERROR] For more information about the errors and possible solutions, please read the following articles: [ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException Build step 'Execute shell' marked build as failure ERROR: No tool found matching MAVEN_3_LATEST__HOME Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
