Update OWASP dependency check plugin version

[sberyozkin]

No description provided.

[jmartisk]

Do we have a way to test that this will fix the failure?

[sberyozkin]

@jmartisk Jan, I think maybe we can manually trigger the action ? The update is long overdue in any case

[jmartisk]

We can trigger it manually, but to run it in this repo, we would have to merge it first. Could you try executing it in your repo? You'd go to https://github.com/sberyozkin/quarkus/actions/workflows/owasp-check.yml and trigger it using the "Run workflow" button that I don't see because I'm not an admin of your fork

[jmartisk]

If it turns out to be a problem, we can just merge it and wait for the next nightly run

[sberyozkin]

@jmartisk Sure, just did it, will take awhile :-)

[sberyozkin]

@jmartisk It does not want to run it in my fork: https://github.com/sberyozkin/quarkus/actions/runs/11702263054/job/32590086209

I've run it on this PR's branch, while the action references the main branch, but all previous scheduled runs were cancelled after just 2 secs too.

We can just merge and users can also try to run it locally

[jmartisk]

I think you'd have to change/remove this line https://github.com/sberyozkin/quarkus/blob/816a3521115210ebc0552149653b97ba7ab3b477/.github/workflows/owasp-check.yml#L12 to allow it to run on your fork (so I guess you'd need to create another branch with just this change - to avoid polluting this PR... it's a bit tricky).

But yeah I don't mind just merging it here too, after the regular CI finishes

[quarkus-bot]

Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit 121e4a9.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

You can consult the Develocity build scans.

---

Flaky tests - Develocity

⚙️ JVM Tests - JDK 17

📦 extensions/vertx-http/deployment

✖ io.quarkus.devui.ConfigurationTest.testConfigurationUpdate - History

• Request failed: WebSocket upgrade failure: 500 - java.lang.IllegalStateException

java.lang.IllegalStateException: Request failed: WebSocket upgrade failure: 500
	at io.quarkus.devui.tests.DevUIJsonRPCTest$WebSocketResponse.message(DevUIJsonRPCTest.java:254)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:155)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:167)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:148)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.getJsonRPCResponse(DevUIJsonRPCTest.java:124)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.getJsonRPCResponse(DevUIJsonRPCTest.java:119)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.executeJsonRPCMethod(DevUIJsonRPCTest.java:86)

---

⚙️ JVM Tests - JDK 21

📦 extensions/smallrye-reactive-messaging/deployment

✖ io.quarkus.smallrye.reactivemessaging.hotreload.ConnectorChangeTest.testUpdatingConnector - History

• Expecting actual: ["-4","-5","-6","-7","-8","-9","-10","-11"] to start with: ["-3", "-4", "-5", "-6"] - java.lang.AssertionError

java.lang.AssertionError: 

Expecting actual:
  ["-4","-5","-6","-7","-8","-9","-10","-11"]
to start with:
  ["-3", "-4", "-5", "-6"]

	at io.quarkus.smallrye.reactivemessaging.hotreload.ConnectorChangeTest.testUpdatingConnector(ConnectorChangeTest.java:36)

[sberyozkin]

Let me merge, and I'll trigger an action

[sberyozkin]

Sorry @jmartisk, I merged and then decided to scroll and noticed your comment, my apologies :-), the version update itself should be fine in any case, let me trigger the action

[sberyozkin]

@jmartisk @aloubyansky It worked :-), I guess the next step is to see how to wire in sbom

[jmartisk]

@sberyozkin are you sure the plugin supports working from sbom? Or do you have a different plugin in mind?

On the other hand, I found https://jeremylong.github.io/DependencyCheck/dependency-check-maven/index.html where Example 7 shows how to exclude vulnerabilities that we don't want to pollute the report, which may be useful

[sberyozkin]

Thanks @jmartisk, yeah, this one does not accept BOM AFAIK... Yeah, I'm not seeing which OWASP plugin can take SBOM as input for the CVE checks on dependencies... We may have to do exclusions, I'll have a look