You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@struts.apache.org by Apache Jenkins Server <je...@builds.apache.org> on 2025/12/22 06:44:25 UTC
Build failed in Jenkins: Struts » Struts-master-dependency-check #247
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/247/display/redirect?page=changes>
Changes:
[github] Bump org.apache.maven.plugins:maven-assembly-plugin from 3.7.1 to 3.8.0 (#1444)
[github] WW-5256 Add configurable FreeMarker whitespace stripping and compress tag (#1418)
[github] refactor(config): WW-5256 move compress constants to struts.tag.compress namespace (#1446)
[github] Bump github/codeql-action from 4.31.5 to 4.31.7 (#1447)
[github] Bump org.apache.maven.plugins:maven-war-plugin from 3.4.0 to 3.5.1 (#1449)
[github] Bump org.apache.commons:commons-text from 1.14.0 to 1.15.0 (#1448)
[github] Bump byte-buddy.version from 1.17.7 to 1.18.2 (#1450)
[github] Bump com.fasterxml.jackson:jackson-bom from 2.19.1 to 2.20.1 (#1456)
[github] feat(release): uses release/struts-6-8-x as based branch for next Struts 6.x release (#1457)
[github] Bump org.jacoco:jacoco-maven-plugin from 0.8.13 to 0.8.14
[github] Bump org.apache.maven.plugins:maven-release-plugin from 3.2.0 to 3.3.0
[github] Bump org.codehaus.mojo:versions-maven-plugin from 2.19.0 to 2.20.1
[github] WW-5444 Add HTML5 theme with comprehensive unit tests (#1422)
[github] fix(convention): WW-5594 exclude root package classes with wildcard patterns (#1468)
[github] fix(convention): WW-5593 handle NoClassDefFoundError in action class scanning (#1469)
[github] Bump org.springframework:spring-framework-bom from 6.2.12 to 7.0.1 (#1467)
[github] build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#1470)
[github] build(deps): bump github/codeql-action from 4.31.7 to 4.31.8 (#1471)
[github] build(deps): bump org.mockito:mockito-core from 5.20.0 to 5.21.0 (#1472)
[github] build(deps): bump org.apache.maven.plugins:maven-release-plugin (#1473)
------------------------------------------
[...truncated 930.48 KiB...]
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (259 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (1 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (1 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports/target/dependency-check-report.html>
[INFO]
[INFO] ----------< org.apache.struts:struts2-jasperreports7-plugin >-----------
[INFO] Building Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] 7.1.2-SNAPSHOT [18/29]
[INFO] from plugins/jasperreports7/pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce) @ struts2-jasperreports7-plugin ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence passed
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce-maven-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce-java-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- remote-resources:3.1.0:process (process-resource-bundles) @ struts2-jasperreports7-plugin ---
[INFO] Preparing remote bundle org.apache.apache.resources:apache-jar-resource-bundle:1.5
[INFO] Copying 3 resources from 1 bundle.
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 3 resources from src/main/resources to target/classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ struts2-jasperreports7-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 12 source files with javac [debug release 17] to target/classes
[INFO]
[INFO] --- bundle:6.0.0:manifest (bundle-manifest) @ struts2-jasperreports7-plugin ---
[INFO] Writing manifest: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/classes/META-INF/MANIFEST.MF>
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 2 resources from src/test/resources to target/test-classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/test-classes
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ struts2-jasperreports7-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 1 source file with javac [debug release 17] to target/test-classes
[INFO]
[INFO] --- surefire:3.5.4:test (default-test) @ struts2-jasperreports7-plugin ---
[INFO] Using configured provider org.apache.maven.surefire.junitcore.JUnitCoreProvider
[INFO]
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
Standard Commons Logging discovery in action with spring-jcl: please remove commons-logging.jar from classpath in order to avoid potential conflicts
[WARN ] util.DebugUtils (DebugUtils.java:50) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getReportParameters()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getDatasource()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 8.137 s -- in org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0
[INFO]
[INFO]
[INFO] --- apache-rat:0.17:check (default) @ struts2-jasperreports7-plugin ---
[WARNING] Basedir is : <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7>
[INFO] Excluding patterns: CLAUDE.md, CODEOWNERS, SECURITY.md, **/README.md, src/main/resources/*-LICENSE.txt, src/site/resources/tags/**/*.html, src/test/resources/**/*.txt, src/main/resources/org/apache/struts2/static/domTT.js, src/main/webapp/**/*.css, src/main/webapp/**/*.map, src/main/webapp/**/*.js, src/main/webapp/**/*.svg, src/main/webapp/**/*.txt, **/src/main/resources/**/docs-urls.txt, src/etc/header.txt, src/main/resources/static/css/**/*.css, src/main/resources/static/js/**/*.js, **/src/main/resources/docs.cfg, src/main/webapp/fonts/**/*, thoughts/**/*.md, test-output/**
[INFO] Excluding ALL collection.
[INFO] Excluding MAVEN collection.
[INFO] Excluding ECLIPSE collection.
[INFO] Excluding IDEA collection.
[INFO] Processing exclude file from STANDARD_SCMS.
[INFO] Excluding STANDARD_SCMS collection.
[INFO] Excluding MISC collection.
[INFO] Excluding HIDDEN_DIR collection.
[INFO] RAT summary:
[INFO] Approved: 17
[INFO] Archives: 0
[INFO] Binaries: 0
[INFO] Document types: 3
[INFO] Ignored: 2
[INFO] License categories: 1
[INFO] License names: 1
[INFO] Notices: 2
[INFO] Standards: 17
[INFO] Unapproved: 0
[INFO] Unknown: 0
[INFO]
[INFO] --- jar:3.3.0:jar (default-jar) @ struts2-jasperreports7-plugin ---
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/struts2-jasperreports7-plugin-7.1.2-SNAPSHOT.jar>
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (attach-descriptor) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (site-inheritance) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- dependency-check:12.1.9:check (default) @ struts2-jasperreports7-plugin ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (267 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (1 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2011-5057, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0391, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0392, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0393, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0394, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,CVE-2017-1000487,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL]:
jasperreports-7.0.3.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.3, cpe:2.3:a:cloud:jasperreports_library:7.0.3:*:*:*:*:*:*:*) : CVE-2025-10492
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 7.1.2-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... SUCCESS [ 25.839 s]
[INFO] Struts BOM ......................................... SUCCESS [ 3.794 s]
[INFO] Struts Parent POM .................................. SUCCESS [ 3.857 s]
[INFO] Struts 2 Jakarta EE Compatible modules ............. SUCCESS [ 3.556 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools View . SUCCESS [ 9.501 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp .. SUCCESS [ 5.340 s]
[INFO] Struts 2 Core ...................................... SUCCESS [02:38 min]
[INFO] Struts 2 Plugins ................................... SUCCESS [ 4.817 s]
[INFO] Struts 2 Async Plugin .............................. SUCCESS [ 4.681 s]
[INFO] Struts 2 Bean Validation Plugin .................... SUCCESS [ 8.464 s]
[INFO] Struts 2 CDI Plugin ................................ SUCCESS [ 6.255 s]
[INFO] Struts 2 Spring Plugin ............................. SUCCESS [ 11.242 s]
[INFO] Struts 2 JUnit Plugin .............................. SUCCESS [ 10.381 s]
[INFO] Struts 2 Velocity Plugin ........................... SUCCESS [ 10.196 s]
[INFO] Struts 2 Configuration Browser Plugin .............. SUCCESS [ 3.972 s]
[INFO] Struts 2 Convention Plugin ......................... SUCCESS [ 14.905 s]
[INFO] Struts 2 Jasper Reports Plugin ..................... SUCCESS [ 9.428 s]
[INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] .... FAILURE [ 14.573 s]
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 05:11 min
[INFO] Finished at: 2025-12-22T06:44:24Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.1.9:check (default) on project struts2-jasperreports7-plugin:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] jasperreports-7.0.3.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.3, cpe:2.3:a:cloud:jasperreports_library:7.0.3:*:*:*:*:*:*:*): CVE-2025-10492(8.7)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :struts2-jasperreports7-plugin
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Jenkins build is back to normal : Struts » Struts-master-dependency-check #262
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/262/display/redirect?page=changes>
Build failed in Jenkins: Struts » Struts-master-dependency-check #261
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/261/display/redirect?page=changes>
Changes:
[github] build(deps): bump org.htmlunit:htmlunit from 5.1.0 to 5.2.0 (#1762)
[github] build(deps): bump github/codeql-action/upload-sarif (#1758)
[github] WW-5640 Add WebJars support to Struts core (#1765)
[github] build(deps-dev): bump byte-buddy.version from 1.18.10 to 1.18.11 (#1771)
[github] build(deps): bump github/codeql-action from 4.36.2 to 4.36.3 (#1769)
[github] build(deps): bump github/codeql-action/upload-sarif (#1768)
[github] build(deps): bump org.apache.logging.log4j:log4j-bom (#1767)
[github] WW-5641 Restore struts.json.writer / struts.json.reader override in JSON plugin (#1766)
[github] WW-4858 Honor parameter filtering during JSON population (#1773)
[github] build(deps-dev): bump commons-logging:commons-logging (#1760)
[github] build(deps): bump net.sf.jasperreports:jasperreports (#1779)
[github] WW-5643 fix(json): confine StrutsJSONReader parse state to the parsing thread (#1775)
[github] WW-5644 fix(json): confine StrutsJSONWriter write state to the writing thread (#1776)
[github] WW-5645 Canonicalise static content paths and remove redundant URL decode (#1777)
[github] WW-4858 test(json): cover nested-leaf accepted-name and include patterns (#1783)
[github] docs(security): treat a fix or PR as disclosure, require private report first (#1785)
[github] WW-5642 fix(rest): authorize @StrutsParameter on record/creator-bound REST body properties (#1774)
[github] WW-5646 Modernize path normalization in Include component (#1780)
[github] build(deps): bump com.fasterxml.jackson:jackson-bom (#1787)
[github] build(deps): bump github/codeql-action from 4.36.3 to 4.37.0 (#1786)
[github] build(deps-dev): bump org.webjars:jquery from 3.7.1 to 4.0.0 (#1789)
[github] WW-5650 Obtain a fresh JSON reader/writer per request in JSONInterceptor (#1782)
[github] WW-5647 Use ConcurrentHashMap for XSLT template cache (#1781)
[github] WW-5652 Add support for Java records and Optional serialization in the JSON plugin. (#1792)
[github] WW-5620 Standardize logging on Log4j2 (#1794)
[github] WW-5640 refactor(webjars): rename DefaultWebJarUrlProvider to StrutsWebJarUrlProvider (#1795)
[github] WW-5653 Upgrade Bootstrap to 5.3.x in sample apps (#1793)
[github] WW-5604 Recognize CDI/Weld client proxies in SecurityMemberAccess (#1796)
[github] WW-4858 Evaluate JSON name allowlist at leaf keys only (#1784)
[github] WW-5591 chore(core): mark XWorkObjectPropertyAccessor as deprecated (#1797)
[github] WW-5580 chore(core): use Configuration.VERSION_2_3_34 for FreeMarker config (#1798)
------------------------------------------
[...truncated 1.29 MiB...]
at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:495)
2026-07-22 14:14:23,878 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:23,935 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:23,961 WARN [errorabale process] exec.StrutsBackgroundProcess (StrutsBackgroundProcess.java:71) - Exception during invokeActionOnly() execution
java.lang.IllegalStateException: boom
at org.apache.struts2.interceptor.exec.StrutsBackgroundProcessTest.lambda$testErrorableProcesses1$2(StrutsBackgroundProcessTest.java:128)
at org.apache.struts2.interceptor.exec.StrutsBackgroundProcessTest$MockActionInvocationWithActionInvoker.invokeActionOnly(StrutsBackgroundProcessTest.java:173)
at org.apache.struts2.interceptor.exec.StrutsBackgroundProcess.lambda$prepare$0(StrutsBackgroundProcess.java:69)
at java.base/java.lang.Thread.run(Thread.java:840)
2026-07-22 14:14:24,091 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:24,123 WARN [errorabale process] exec.StrutsBackgroundProcess (StrutsBackgroundProcess.java:80) - Exception during afterInvocation() execution
java.lang.IllegalStateException: after!
at org.apache.struts2.interceptor.exec.StrutsBackgroundProcessTest.testErrorableProcesses2(StrutsBackgroundProcessTest.java:142)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at junit.framework.TestCase.runTest(TestCase.java:177)
at junit.framework.TestCase.runBare(TestCase.java:142)
at junit.framework.TestResult$1.protect(TestResult.java:122)
at junit.framework.TestResult.runProtected(TestResult.java:142)
at junit.framework.TestResult.run(TestResult.java:125)
at junit.framework.TestCase.run(TestCase.java:130)
at junit.framework.TestSuite.runTest(TestSuite.java:241)
at junit.framework.TestSuite.run(TestSuite.java:236)
at org.junit.internal.runners.JUnit38ClassRunner.run(JUnit38ClassRunner.java:90)
at org.junit.runners.Suite.runChild(Suite.java:128)
at org.junit.runners.Suite.runChild(Suite.java:27)
at org.junit.runners.ParentRunner$4.run(ParentRunner.java:331)
at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:79)
at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:329)
at org.junit.runners.ParentRunner.access$100(ParentRunner.java:66)
at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:293)
at org.junit.runners.ParentRunner$3.evaluate(ParentRunner.java:306)
at org.junit.runners.ParentRunner.run(ParentRunner.java:413)
at org.apache.maven.surefire.junitcore.JUnitCore.run(JUnitCore.java:49)
at org.apache.maven.surefire.junitcore.JUnitCoreWrapper.createRequestAndRun(JUnitCoreWrapper.java:120)
at org.apache.maven.surefire.junitcore.JUnitCoreWrapper.executeEager(JUnitCoreWrapper.java:95)
at org.apache.maven.surefire.junitcore.JUnitCoreWrapper.execute(JUnitCoreWrapper.java:75)
at org.apache.maven.surefire.junitcore.JUnitCoreWrapper.execute(JUnitCoreWrapper.java:69)
at org.apache.maven.surefire.junitcore.JUnitCoreProvider.invoke(JUnitCoreProvider.java:146)
at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:385)
at org.apache.maven.surefire.booter.ForkedBooter.execute(ForkedBooter.java:162)
at org.apache.maven.surefire.booter.ForkedBooter.run(ForkedBooter.java:507)
at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:495)
[INFO] Tests run: 5, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 2.252 s -- in org.apache.struts2.interceptor.exec.StrutsBackgroundProcessTest
[INFO] Running org.apache.struts2.interceptor.RolesInterceptorTest
2026-07-22 14:14:24,248 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:24,299 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:24,336 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:24,373 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:24,411 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:24,453 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:24,490 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:24,511 FATAL [main] interceptor.RolesInterceptor (RolesInterceptor.java:112) - An unknown Role was configured: [hacker, abuser]
2026-07-22 14:14:24,511 FATAL [main] interceptor.RolesInterceptor (RolesInterceptor.java:112) - An unknown Role was configured: [nonadmin, nonuser]
2026-07-22 14:14:24,525 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[INFO] Tests run: 8, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.307 s -- in org.apache.struts2.interceptor.RolesInterceptorTest
[INFO] Running org.apache.struts2.interceptor.PrepareInterceptorTest
[INFO] Tests run: 9, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s -- in org.apache.struts2.interceptor.PrepareInterceptorTest
[INFO] Running org.apache.struts2.interceptor.httpmethod.HttpMethodInterceptorTest
2026-07-22 14:14:24,567 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:24,603 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:24,638 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:24,673 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:24,707 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:24,739 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:24,773 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:24,851 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:24,884 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:24,917 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:24,950 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:24,983 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:25,016 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:25,049 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:25,081 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[INFO] Tests run: 16, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.540 s -- in org.apache.struts2.interceptor.httpmethod.HttpMethodInterceptorTest
[INFO] Running org.apache.struts2.interceptor.httpmethod.HttpMethodTest
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s -- in org.apache.struts2.interceptor.httpmethod.HttpMethodTest
[INFO] Running org.apache.struts2.interceptor.ValidationInterceptorPrefixMethodInvocationTest
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.012 s -- in org.apache.struts2.interceptor.ValidationInterceptorPrefixMethodInvocationTest
[INFO] Running org.apache.struts2.interceptor.validation.AnnotationValidationInterceptorTest
2026-07-22 14:14:25,140 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:25,176 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:25,209 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:25,242 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:25,277 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:25,310 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:25,343 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
2026-07-22 14:14:25,382 WARN [main] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[INFO] Tests run: 8, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.269 s -- in org.apache.struts2.interceptor.validation.AnnotationValidationInterceptorTest
[INFO] Running org.apache.struts2.interceptor.StaticParametersInterceptorTest
[INFO] Tests run: 8, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.034 s -- in org.apache.struts2.interceptor.StaticParametersInterceptorTest
[INFO] Running org.apache.struts2.interceptor.ValidationErrorAwareTest
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.019 s -- in org.apache.struts2.interceptor.ValidationErrorAwareTest
[INFO] Running org.apache.struts2.ActionContextTest
[INFO] Tests run: 8, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.032 s -- in org.apache.struts2.ActionContextTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 2997, Failures: 0, Errors: 0, Skipped: 0
[INFO]
[INFO]
[INFO] --- apache-rat:0.18:check (default) @ struts2-core ---
[INFO] No issues found.
[INFO]
[INFO] --- jar:3.3.0:jar (default-jar) @ struts2-core ---
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/core/target/struts2-core-7.2.2-SNAPSHOT.jar>
[INFO]
[INFO] --- site:3.22.0:attach-descriptor (attach-descriptor) @ struts2-core ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- site:3.22.0:attach-descriptor (site-inheritance) @ struts2-core ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- dependency-check:12.2.2:check (default) @ struts2-core ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (415 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (3 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished RetireJS Analyzer (0 seconds)
[WARNING] Sonatype OSS Index Analyzer disabled due to missing credentials. Authentication with token is now required, and OSS Index is migrating to Sonatype Guide. See https://dependency-check.github.io/DependencyCheck/analyzers/oss-index-analyzer.html for more information on authentication with Sonatype Guide OSS Index.
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2011-5057, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0391, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0392, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0393, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0394, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,CVE-2017-1000487,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (4 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/core/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Core:
spring-core-6.2.12.jar (pkg:maven/org.springframework/spring-core@6.2.12, cpe:2.3:a:pivotal_software:spring_framework:6.2.12:*:*:*:*:*:*:*, cpe:2.3:a:springsource:spring_framework:6.2.12:*:*:*:*:*:*:*, cpe:2.3:a:vmware:spring_framework:6.2.12:*:*:*:*:*:*:*) : CVE-2026-41855, CVE-2026-41838, CVE-2026-41842, CVE-2026-41848, CVE-2026-41850, CVE-2026-41851, CVE-2026-22740, CVE-2026-41854, CVE-2026-41844, CVE-2026-41845, CVE-2026-41846, CVE-2026-22737, CVE-2026-41840, CVE-2026-41841, CVE-2026-41843, CVE-2026-22745, CVE-2026-41852, CVE-2026-41853, CVE-2026-41839, CVE-2026-22741, CVE-2026-22735
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 7.2.2-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... SUCCESS [ 07:32 h]
[INFO] Struts BOM ......................................... SUCCESS [ 4.193 s]
[INFO] Struts Parent POM .................................. SUCCESS [ 3.279 s]
[INFO] Struts 2 Jakarta EE Compatible modules ............. SUCCESS [ 3.197 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools View . SUCCESS [ 9.958 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp .. SUCCESS [ 6.203 s]
[INFO] Struts 2 Core ...................................... FAILURE [02:48 min]
[INFO] Struts 2 Plugins ................................... SKIPPED
[INFO] Struts 2 Async Plugin .............................. SKIPPED
[INFO] Struts 2 Bean Validation Plugin .................... SKIPPED
[INFO] Struts 2 CDI Plugin ................................ SKIPPED
[INFO] Struts 2 Spring Plugin ............................. SKIPPED
[INFO] Struts 2 JUnit Plugin .............................. SKIPPED
[INFO] Struts 2 Velocity Plugin ........................... SKIPPED
[INFO] Struts 2 Configuration Browser Plugin .............. SKIPPED
[INFO] Struts 2 Convention Plugin ......................... SKIPPED
[INFO] Struts 2 Jasper Reports Plugin ..................... SKIPPED
[INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] .... SKIPPED
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 07:35 h
[INFO] Finished at: 2026-07-22T14:14:42Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.2:check (default) on project struts2-core:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] spring-core-6.2.12.jar (pkg:maven/org.springframework/spring-core@6.2.12, cpe:2.3:a:pivotal_software:spring_framework:6.2.12:*:*:*:*:*:*:*, cpe:2.3:a:springsource:spring_framework:6.2.12:*:*:*:*:*:*:*, cpe:2.3:a:vmware:spring_framework:6.2.12:*:*:*:*:*:*:*): CVE-2026-41838(7.5), CVE-2026-41848(7.5), CVE-2026-41851(7.5), CVE-2026-41850(7.5), CVE-2026-41855(9.8), CVE-2026-41842(7.5)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :struts2-core
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-dependency-check #260
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/260/display/redirect?page=changes>
Changes:
[github] Add CONTRIBUTING.md for new contributors (#1757)
[github] build(deps-dev): bump byte-buddy.version from 1.18.8 to 1.18.10 (#1745)
[github] build(deps): bump org.sitemesh:sitemesh from 3.2.2 to 3.2.3 (#1749)
[github] build(deps-dev): bump org.jacoco:jacoco-maven-plugin (#1751)
[github] build(deps): bump org.glassfish.jaxb:jaxb-bom from 4.0.8 to 4.0.9 (#1753)
[github] build(deps): bump actions/checkout from 6 to 7 (#1755)
[github] Release 7.2.1-RC1 (#1744)
[github] Add draft security threat model (THREAT_MODEL.md) + discoverability pointer (#1756)
------------------------------------------
[...truncated 2.74 KiB...]
[INFO] Struts 2 Spring Plugin [jar]
[INFO] Struts 2 JUnit Plugin [jar]
[INFO] Struts 2 Velocity Plugin [jar]
[INFO] Struts 2 Configuration Browser Plugin [jar]
[INFO] Struts 2 Convention Plugin [jar]
[INFO] Struts 2 Jasper Reports Plugin [jar]
[INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] [jar]
[INFO] Struts 2 Java Templates Plugin [jar]
[INFO] Struts 2 JFreeChart Plugin [jar]
[INFO] Struts 2 JSON Plugin [jar]
[INFO] Struts 2 REST Plugin [jar]
[INFO] Struts 2 TestNG Plugin [jar]
[INFO] Struts 2 Tiles Plugin [jar]
[INFO] Struts 2 XSLT Plugin [jar]
[INFO] Struts 2 Webapps [pom]
[INFO] Struts 2 Showcase Webapp [war]
[INFO] Struts 2 Rest Showcase Webapp [war]
[INFO] Struts 2 Assembly [pom]
[INFO]
[INFO] -----------------< org.apache.struts:struts2-project >------------------
[INFO] Building Struts 2 7.2.2-SNAPSHOT [1/29]
[INFO] from pom.xml
[INFO] --------------------------------[ pom ]---------------------------------
[INFO]
[INFO] --- enforcer:3.6.3:enforce (enforce) @ struts2-project ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.BannedDependencies passed
[INFO]
[INFO] --- enforcer:3.6.3:enforce (enforce-maven-version) @ struts2-project ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.version.RequireMavenVersion passed
[INFO]
[INFO] --- enforcer:3.6.3:enforce (enforce-java-version) @ struts2-project ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.version.RequireJavaVersion passed
[INFO]
[INFO] --- remote-resources:3.1.0:process (process-resource-bundles) @ struts2-project ---
[INFO] Preparing remote bundle org.apache.apache.resources:apache-jar-resource-bundle:1.5
[INFO] Copying 3 resources from 1 bundle.
[INFO]
[INFO] --- bundle:6.0.2:manifest (bundle-manifest) @ struts2-project ---
[WARNING] Ignoring project type pom - supportedProjectTypes = [jar, bundle]
[INFO]
[INFO] --- apache-rat:0.18:check (default) @ struts2-project ---
[INFO] No issues found.
[INFO]
[INFO] --- site:3.22.0:attach-descriptor (attach-descriptor) @ struts2-project ---
[INFO] Attaching 'src/site/site.xml' site descriptor with classifier 'site'.
[INFO]
[INFO] --- site:3.22.0:attach-descriptor (site-inheritance) @ struts2-project ---
[INFO] Attaching 'src/site/site.xml' site descriptor with classifier 'site'.
[WARNING] artifact org.apache.struts:struts2-project:xml:site:7.2.2-SNAPSHOT already attached, replace previous instance
[INFO]
[INFO] --- dependency-check:12.2.2:check (default) @ struts2-project ---
[INFO] Checking for updates
[WARNING] An NVD API Key was not provided - it is highly recommended to use an NVD API key as the update can take a VERY long time without an API Key
[INFO] NVD API has 344,862 records in this update
[INFO] Downloaded 10,000/344,862 (3%)
[INFO] Downloaded 20,000/344,862 (6%)
[INFO] Downloaded 30,000/344,862 (9%)
[INFO] Downloaded 40,000/344,875 (12%)
[INFO] Downloaded 50,000/344,875 (14%)
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=56000 : 2nd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=56000 : 3rd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=58000 : 2nd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=58000 : 3rd time
[INFO] Downloaded 60,000/344,875 (17%)
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=66000 : 2nd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=66000 : 3rd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=68000 : 2nd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=68000 : 3rd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=68000 : 4th time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=68000 : 5th time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=68000 : 6th time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=68000 : 7th time
[INFO] Downloaded 70,000/344,891 (20%)
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=70000 : 2nd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=72000 : 2nd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=74000 : 2nd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=74000 : 3rd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=74000 : 4th time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=78000 : 2nd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=78000 : 3rd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=78000 : 4th time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=78000 : 5th time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=78000 : 6th time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=78000 : 7th time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=78000 : 8th time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=78000 : 9th time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=78000 : 10th time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=78000 : 11th time
[INFO] Downloaded 80,000/344,891 (23%)
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=80000 : 2nd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=80000 : 3rd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=82000 : 2nd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=82000 : 3rd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=82000 : 4th time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=84000 : 2nd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=84000 : 3rd time
[INFO] Downloaded 90,000/344,894 (26%)
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=94000 : 2nd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=94000 : 3rd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=94000 : 4th time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=96000 : 2nd time
[WARNING] Retrying request /rest/json/cves/2.0?lastModStartDate=2026-06-16T08%3A16%3A24Z&lastModEndDate=2026-10-14T08%3A16%3A24Z&resultsPerPage=2000&startIndex=98000 : 2nd time
[WARNING] NVD API request failures are occurring; retrying request for the 15th time
[WARNING] NVD API request failures are occurring; retrying request for the 16th time
[WARNING] NVD API request failures are occurring; retrying request for the 17th time
[WARNING] NVD API request failures are occurring; retrying request for the 18th time
[WARNING] NVD API request failures are occurring; retrying request for the 19th time
[WARNING] NVD API request failures are occurring; retrying request for the 20th time
[WARNING] NVD API request failures are occurring; retrying request for the 21st time
[WARNING] NVD API request failures are occurring; retrying request for the 22nd time
[WARNING] NVD API request failures are occurring; retrying request for the 23rd time
[WARNING] NVD API request failures are occurring; retrying request for the 24th time
[WARNING] NVD API request failures are occurring; retrying request for the 25th time
[WARNING] NVD API request failures are occurring; retrying request for the 26th time
[WARNING] NVD API request failures are occurring; retrying request for the 27th time
[WARNING] NVD API request failures are occurring; retrying request for the 28th time
[WARNING] NVD API request failures are occurring; retrying request for the 29th time
[WARNING] NVD API request failures are occurring; retrying request for the 30th time
[WARNING] NVD API request failures are occurring; retrying request for the 31st time
[ERROR] Error updating the NVD Data
org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:387)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:128)
at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:887)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:692)
at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:619)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:2093)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1291)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174)
at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75)
at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162)
at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:906)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:283)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:206)
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:77)
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:569)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:361)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314)
Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: NVD Returned Status Code: 429
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:445)
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next (NvdCveClient.java:356)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:343)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:128)
at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:887)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:692)
at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:619)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:2093)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1291)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174)
at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75)
at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162)
at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:906)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:283)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:206)
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:77)
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:569)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:361)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314)
[INFO] Updating CISA Known Exploited Vulnerability list: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
[INFO] Begin database defrag
[INFO] End database defrag (10487 ms)
[WARNING] Unable to update 1 or more Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities.
[ERROR] Unable to continue dependency-check analysis.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 7.2.2-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... FAILURE [ 04:19 h]
[INFO] Struts BOM ......................................... SKIPPED
[INFO] Struts Parent POM .................................. SKIPPED
[INFO] Struts 2 Jakarta EE Compatible modules ............. SKIPPED
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools View . SKIPPED
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp .. SKIPPED
[INFO] Struts 2 Core ...................................... SKIPPED
[INFO] Struts 2 Plugins ................................... SKIPPED
[INFO] Struts 2 Async Plugin .............................. SKIPPED
[INFO] Struts 2 Bean Validation Plugin .................... SKIPPED
[INFO] Struts 2 CDI Plugin ................................ SKIPPED
[INFO] Struts 2 Spring Plugin ............................. SKIPPED
[INFO] Struts 2 JUnit Plugin .............................. SKIPPED
[INFO] Struts 2 Velocity Plugin ........................... SKIPPED
[INFO] Struts 2 Configuration Browser Plugin .............. SKIPPED
[INFO] Struts 2 Convention Plugin ......................... SKIPPED
[INFO] Struts 2 Jasper Reports Plugin ..................... SKIPPED
[INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] .... SKIPPED
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 04:19 h
[INFO] Finished at: 2026-07-01T10:58:54Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.2:check (default) on project struts2-project: Fatal exception(s) analyzing Struts 2: One or more exceptions occurred during analysis:
[ERROR] UpdateException: Error updating the NVD Data
[ERROR] caused by NvdApiException: NVD Returned Status Code: 429
[ERROR] NoDataException: No documents exist
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-dependency-check #259
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/259/display/redirect?page=changes>
Changes:
[github] docs(skills): add triaging-security-reports skill (#1722)
[github] WW-5631 Add opt-in @StrutsParameter enforcement to ChainingInterceptor (#1719)
[github] build(deps): bump maven-surefire-plugin.version from 3.5.5 to 3.5.6 (#1731)
[github] build(deps): bump org.apache.maven.plugins:maven-dependency-plugin (#1730)
[github] build(deps): bump github/codeql-action from 4.36.0 to 4.36.2 (#1734)
[github] build(deps-dev): bump org.apache.maven.plugins:maven-failsafe-plugin (#1732)
[github] WW-5630 - Performance Issue SecurityMemberAccess (#1721)
[github] WW-5632 Harden commons-fileupload2 dependency against milestone binary-incompatibility (#1735)
[github] build(deps): bump com.fasterxml.jackson:jackson-bom (#1729)
[github] build(deps): bump org.htmlunit:htmlunit from 4.21.0 to 5.1.0 (#1733)
[github] WW-5630 test: streamline ConfigParseUtilTest and convert to JUnit 4 (#1740)
[github] WW-5636 Harden redirect URL escaping in non-302 response body (#1737)
[github] WW-5635 Avoid logging sensitive token values in TokenHelper (#1738)
[github] Release 7.2.0-RC1 (#1742)
[github] WW-5256 Decouple FreeMarker whitespace stripping from devMode (#1743)
------------------------------------------
Started by timer
Running as SYSTEM
[EnvInject] - Loading node environment variables.
Building remotely on builds24 (ubuntu) in workspace <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/>
The recommended git tool is: NONE
No credentials specified
> git rev-parse --resolve-git-dir <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/.git> # timeout=10
Fetching changes from the remote Git repository
> git config remote.origin.url https://gitbox.apache.org/repos/asf/struts.git # timeout=10
Fetching upstream changes from https://gitbox.apache.org/repos/asf/struts.git
> git --version # timeout=10
> git --version # 'git version 2.34.1'
> git fetch --tags --force --progress -- https://gitbox.apache.org/repos/asf/struts.git +refs/heads/*:refs/remotes/origin/* # timeout=10
> git rev-parse refs/remotes/origin/main^{commit} # timeout=10
Checking out Revision 59e342488d9ee6c67861eef1753aeffb09125939 (refs/remotes/origin/main)
> git config core.sparsecheckout # timeout=10
> git checkout -f 59e342488d9ee6c67861eef1753aeffb09125939 # timeout=10
Commit message: "WW-5256 Decouple FreeMarker whitespace stripping from devMode (#1743)"
> git rev-list --no-walk e637bb16a3f1a011a1bd627b7c06fbf54be06525 # timeout=10
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
[Struts-master-dependency-check] $ /bin/sh -xe /tmp/jenkins9131346237606821382.sh
+ export MAVEN_OPTS=-Xms2g -Xmx2g
+ /home/jenkins/tools/maven/latest3/bin/mvn verify -Pdependency-check
[INFO] Scanning for projects...
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Build Order:
[INFO]
[INFO] Struts 2 [pom]
[INFO] Struts BOM [pom]
[INFO] Struts Parent POM [pom]
[INFO] Struts 2 Jakarta EE Compatible modules [pom]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools View [jar]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp [jar]
[INFO] Struts 2 Core [jar]
[INFO] Struts 2 Plugins [pom]
[INFO] Struts 2 Async Plugin [jar]
[INFO] Struts 2 Bean Validation Plugin [jar]
[INFO] Struts 2 CDI Plugin [jar]
[INFO] Struts 2 Spring Plugin [jar]
[INFO] Struts 2 JUnit Plugin [jar]
[INFO] Struts 2 Velocity Plugin [jar]
[INFO] Struts 2 Configuration Browser Plugin [jar]
[INFO] Struts 2 Convention Plugin [jar]
[INFO] Struts 2 Jasper Reports Plugin [jar]
[INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] [jar]
[INFO] Struts 2 Java Templates Plugin [jar]
[INFO] Struts 2 JFreeChart Plugin [jar]
[INFO] Struts 2 JSON Plugin [jar]
[INFO] Struts 2 REST Plugin [jar]
[INFO] Struts 2 TestNG Plugin [jar]
[INFO] Struts 2 Tiles Plugin [jar]
[INFO] Struts 2 XSLT Plugin [jar]
[INFO] Struts 2 Webapps [pom]
[INFO] Struts 2 Showcase Webapp [war]
[INFO] Struts 2 Rest Showcase Webapp [war]
[INFO] Struts 2 Assembly [pom]
[INFO]
[INFO] -----------------< org.apache.struts:struts2-project >------------------
[INFO] Building Struts 2 7.2.1-SNAPSHOT [1/29]
[INFO] from pom.xml
[INFO] --------------------------------[ pom ]---------------------------------
[INFO]
[INFO] --- enforcer:3.6.3:enforce (enforce) @ struts2-project ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.BannedDependencies passed
[INFO]
[INFO] --- enforcer:3.6.3:enforce (enforce-maven-version) @ struts2-project ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.version.RequireMavenVersion passed
[INFO]
[INFO] --- enforcer:3.6.3:enforce (enforce-java-version) @ struts2-project ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.version.RequireJavaVersion passed
[INFO]
[INFO] --- remote-resources:3.1.0:process (process-resource-bundles) @ struts2-project ---
[INFO] Preparing remote bundle org.apache.apache.resources:apache-jar-resource-bundle:1.5
[INFO] Copying 3 resources from 1 bundle.
[INFO]
[INFO] --- bundle:6.0.2:manifest (bundle-manifest) @ struts2-project ---
[WARNING] Ignoring project type pom - supportedProjectTypes = [jar, bundle]
[INFO]
[INFO] --- apache-rat:0.18:check (default) @ struts2-project ---
[INFO] No issues found.
[INFO]
[INFO] --- site:3.22.0:attach-descriptor (attach-descriptor) @ struts2-project ---
[INFO] Attaching 'src/site/site.xml' site descriptor with classifier 'site'.
[INFO]
[INFO] --- site:3.22.0:attach-descriptor (site-inheritance) @ struts2-project ---
[INFO] Attaching 'src/site/site.xml' site descriptor with classifier 'site'.
[WARNING] artifact org.apache.struts:struts2-project:xml:site:7.2.1-SNAPSHOT already attached, replace previous instance
[INFO]
[INFO] --- dependency-check:12.2.2:check (default) @ struts2-project ---
[INFO] Checking for updates
[WARNING] An NVD API Key was not provided - it is highly recommended to use an NVD API key as the update can take a VERY long time without an API Key
[WARNING] NVD API request failures are occurring; retrying request for the 15th time
[WARNING] NVD API request failures are occurring; retrying request for the 16th time
[WARNING] NVD API request failures are occurring; retrying request for the 17th time
[WARNING] NVD API request failures are occurring; retrying request for the 18th time
[WARNING] NVD API request failures are occurring; retrying request for the 19th time
[WARNING] NVD API request failures are occurring; retrying request for the 20th time
[WARNING] NVD API request failures are occurring; retrying request for the 21st time
[WARNING] NVD API request failures are occurring; retrying request for the 22nd time
[WARNING] NVD API request failures are occurring; retrying request for the 23rd time
[WARNING] NVD API request failures are occurring; retrying request for the 24th time
[WARNING] NVD API request failures are occurring; retrying request for the 25th time
[WARNING] NVD API request failures are occurring; retrying request for the 26th time
[WARNING] NVD API request failures are occurring; retrying request for the 27th time
[WARNING] NVD API request failures are occurring; retrying request for the 28th time
[WARNING] NVD API request failures are occurring; retrying request for the 29th time
[WARNING] NVD API request failures are occurring; retrying request for the 30th time
[WARNING] NVD API request failures are occurring; retrying request for the 31st time
[ERROR] Error updating the NVD Data
org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:387)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:128)
at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:887)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:692)
at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:619)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:2093)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1291)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174)
at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75)
at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162)
at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:906)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:283)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:206)
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:77)
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:569)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:361)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314)
Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: NVD Returned Status Code: 429
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:445)
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next (NvdCveClient.java:356)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:343)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:128)
at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:887)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:692)
at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:619)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:2093)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1291)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328)
at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174)
at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75)
at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162)
at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:906)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:283)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:206)
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:77)
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:569)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:361)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314)
[INFO] Updating CISA Known Exploited Vulnerability list: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
[INFO] Begin database defrag
[INFO] End database defrag (12037 ms)
[WARNING] Unable to update 1 or more Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities.
[ERROR] Unable to continue dependency-check analysis.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 7.2.1-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... FAILURE [ 27.079 s]
[INFO] Struts BOM ......................................... SKIPPED
[INFO] Struts Parent POM .................................. SKIPPED
[INFO] Struts 2 Jakarta EE Compatible modules ............. SKIPPED
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools View . SKIPPED
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp .. SKIPPED
[INFO] Struts 2 Core ...................................... SKIPPED
[INFO] Struts 2 Plugins ................................... SKIPPED
[INFO] Struts 2 Async Plugin .............................. SKIPPED
[INFO] Struts 2 Bean Validation Plugin .................... SKIPPED
[INFO] Struts 2 CDI Plugin ................................ SKIPPED
[INFO] Struts 2 Spring Plugin ............................. SKIPPED
[INFO] Struts 2 JUnit Plugin .............................. SKIPPED
[INFO] Struts 2 Velocity Plugin ........................... SKIPPED
[INFO] Struts 2 Configuration Browser Plugin .............. SKIPPED
[INFO] Struts 2 Convention Plugin ......................... SKIPPED
[INFO] Struts 2 Jasper Reports Plugin ..................... SKIPPED
[INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] .... SKIPPED
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 29.488 s
[INFO] Finished at: 2026-06-22T06:39:41Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.2:check (default) on project struts2-project: Fatal exception(s) analyzing Struts 2: One or more exceptions occurred during analysis:
[ERROR] UpdateException: Error updating the NVD Data
[ERROR] caused by NvdApiException: NVD Returned Status Code: 429
[ERROR] NoDataException: No documents exist
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-dependency-check #258
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/258/display/redirect?page=changes>
Changes:
[github] build(deps): bump github/codeql-action from 4.35.5 to 4.36.0 (#1710)
[github] build(deps): bump org.apache.maven.plugins:maven-site-plugin (#1711)
[github] build(deps): bump asm.version from 9.10 to 9.10.1 (#1713)
------------------------------------------
[...truncated 1.37 MiB...]
[INFO] --- apache-rat:0.18:check (default) @ struts2-jasperreports-plugin ---
[INFO] No issues found.
[INFO]
[INFO] --- jar:3.3.0:jar (default-jar) @ struts2-jasperreports-plugin ---
[INFO]
[INFO] --- site:3.22.0:attach-descriptor (attach-descriptor) @ struts2-jasperreports-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- site:3.22.0:attach-descriptor (site-inheritance) @ struts2-jasperreports-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- dependency-check:12.2.2:check (default) @ struts2-jasperreports-plugin ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (275 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (1 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Sonatype OSS Index Analyzer disabled due to missing credentials. Authentication with token is now required, and OSS Index is migrating to Sonatype Guide. See https://dependency-check.github.io/DependencyCheck/analyzers/oss-index-analyzer.html for more information on authentication with Sonatype Guide OSS Index.
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (1 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports/target/dependency-check-report.html>
[INFO]
[INFO] ----------< org.apache.struts:struts2-jasperreports7-plugin >-----------
[INFO] Building Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] 7.2.0-SNAPSHOT [18/29]
[INFO] from plugins/jasperreports7/pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- enforcer:3.6.3:enforce (enforce) @ struts2-jasperreports7-plugin ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence passed
[INFO]
[INFO] --- enforcer:3.6.3:enforce (enforce-maven-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- enforcer:3.6.3:enforce (enforce-java-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- remote-resources:3.1.0:process (process-resource-bundles) @ struts2-jasperreports7-plugin ---
[INFO] Preparing remote bundle org.apache.apache.resources:apache-jar-resource-bundle:1.5
[INFO] Copying 3 resources from 1 bundle.
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 3 resources from src/main/resources to target/classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ struts2-jasperreports7-plugin ---
[INFO] Nothing to compile - all classes are up to date
[INFO]
[INFO] --- bundle:6.0.2:manifest (bundle-manifest) @ struts2-jasperreports7-plugin ---
[INFO] Writing manifest: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/classes/META-INF/MANIFEST.MF>
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 2 resources from src/test/resources to target/test-classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/test-classes
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ struts2-jasperreports7-plugin ---
[INFO] Nothing to compile - all classes are up to date
[INFO]
[INFO] --- surefire:3.5.5:test (default-test) @ struts2-jasperreports7-plugin ---
[INFO] Using configured provider org.apache.maven.surefire.junitcore.JUnitCoreProvider
[INFO]
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
Standard Commons Logging discovery in action with spring-jcl: please remove commons-logging.jar from classpath in order to avoid potential conflicts
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getReportParameters()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getDatasource()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 8.095 s -- in org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0
[INFO]
[INFO]
[INFO] --- apache-rat:0.18:check (default) @ struts2-jasperreports7-plugin ---
[INFO] No issues found.
[INFO]
[INFO] --- jar:3.3.0:jar (default-jar) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- site:3.22.0:attach-descriptor (attach-descriptor) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- site:3.22.0:attach-descriptor (site-inheritance) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- dependency-check:12.2.2:check (default) @ struts2-jasperreports7-plugin ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (278 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Sonatype OSS Index Analyzer disabled due to missing credentials. Authentication with token is now required, and OSS Index is migrating to Sonatype Guide. See https://dependency-check.github.io/DependencyCheck/analyzers/oss-index-analyzer.html for more information on authentication with Sonatype Guide OSS Index.
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2011-5057, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0391, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0392, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0393, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0394, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,CVE-2017-1000487,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL]:
jasperreports-7.0.4.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.4, cpe:2.3:a:cloud:jasperreports_library:7.0.4:*:*:*:*:*:*:*) : CVE-2025-10492
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 7.2.0-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... SUCCESS [ 42.651 s]
[INFO] Struts BOM ......................................... SUCCESS [ 3.954 s]
[INFO] Struts Parent POM .................................. SUCCESS [ 4.384 s]
[INFO] Struts 2 Jakarta EE Compatible modules ............. SUCCESS [ 3.902 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools View . SUCCESS [ 12.549 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp .. SUCCESS [ 6.541 s]
[INFO] Struts 2 Core ...................................... SUCCESS [02:49 min]
[INFO] Struts 2 Plugins ................................... SUCCESS [ 7.488 s]
[INFO] Struts 2 Async Plugin .............................. SUCCESS [ 7.284 s]
[INFO] Struts 2 Bean Validation Plugin .................... SUCCESS [ 10.782 s]
[INFO] Struts 2 CDI Plugin ................................ SUCCESS [ 6.778 s]
[INFO] Struts 2 Spring Plugin ............................. SUCCESS [ 13.155 s]
[INFO] Struts 2 JUnit Plugin .............................. SUCCESS [ 10.037 s]
[INFO] Struts 2 Velocity Plugin ........................... SUCCESS [ 9.544 s]
[INFO] Struts 2 Configuration Browser Plugin .............. SUCCESS [ 3.551 s]
[INFO] Struts 2 Convention Plugin ......................... SUCCESS [ 14.294 s]
[INFO] Struts 2 Jasper Reports Plugin ..................... SUCCESS [ 10.032 s]
[INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] .... FAILURE [ 13.780 s]
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 05:52 min
[INFO] Finished at: 2026-06-01T06:45:04Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.2:check (default) on project struts2-jasperreports7-plugin:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] jasperreports-7.0.4.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.4, cpe:2.3:a:cloud:jasperreports_library:7.0.4:*:*:*:*:*:*:*): CVE-2025-10492(8.7)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :struts2-jasperreports7-plugin
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-dependency-check #257
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/257/display/redirect?page=changes>
Changes:
[github] fix(core): WW-5623 HTML-encode form action in PostbackResult to prevent XSS (#1653)
[github] WW-5624: Enforce @StrutsParameter on JSON/REST body deserialization (#1657)
[github] build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (#1668)
[github] build(deps): bump com.fasterxml.jackson:jackson-bom (#1669)
[github] build(deps): bump commons-io:commons-io from 2.21.0 to 2.22.0 (#1672)
[github] WW-5626 cleanup follow-ups for @StrutsParameter JSON/REST enforcement (#1673)
[github] build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#1675)
[github] build(deps): bump org.glassfish.jaxb:jaxb-bom from 4.0.7 to 4.0.8 (#1676)
[github] build(deps): bump org.owasp:dependency-check-maven from 12.2.1 to 12.2.2 (#1677)
[github] build(deps): bump com.github.ben-manes.caffeine:caffeine (#1679)
[github] build(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#1682)
[github] build(deps): bump slf4j.version from 2.0.17 to 2.0.18 (#1683)
[github] WW-5626 per-property authorization for Jackson REST handlers (#1674)
[github] chore(agents): defines a new AGENTS.md focused on reporting vulnerabilities (#1680)
[github] WW-5627 Gate CookieInterceptor through ParameterAuthorizer (#1681)
[github] chore(rat): excludes Markdown files in docs/ folder (#1691)
[github] fix(core): enforce class-level HTTP method annotations for wildcard-resolved unannotated methods (#1690)
[github] WW-5535 test(core): cover wildcard-resolved unannotated methods via real proxy (#1692)
[github] build(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#1694)
[github] build(deps-dev): bump org.apache.maven.plugins:maven-enforcer-plugin (#1698)
[github] ci(dependabot): fix cooldown property name (#1702)
[github] build(deps): bump asm.version from 9.9.1 to 9.10 (#1695)
[github] build(deps): bump org.apache.logging.log4j:log4j-bom (#1685)
[github] security(versions): updates list of supported versions (#1708)
------------------------------------------
[...truncated 1.42 MiB...]
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports/target/struts2-jasperreports-plugin-7.2.0-SNAPSHOT.jar>
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (attach-descriptor) @ struts2-jasperreports-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (site-inheritance) @ struts2-jasperreports-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- dependency-check:12.2.2:check (default) @ struts2-jasperreports-plugin ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (322 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (1 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Sonatype OSS Index Analyzer disabled due to missing credentials. Authentication with token is now required, and OSS Index is migrating to Sonatype Guide. See https://dependency-check.github.io/DependencyCheck/analyzers/oss-index-analyzer.html for more information on authentication with Sonatype Guide OSS Index.
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (1 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports/target/dependency-check-report.html>
[INFO]
[INFO] ----------< org.apache.struts:struts2-jasperreports7-plugin >-----------
[INFO] Building Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] 7.2.0-SNAPSHOT [18/29]
[INFO] from plugins/jasperreports7/pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- enforcer:3.6.3:enforce (enforce) @ struts2-jasperreports7-plugin ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence passed
[INFO]
[INFO] --- enforcer:3.6.3:enforce (enforce-maven-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- enforcer:3.6.3:enforce (enforce-java-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- remote-resources:3.1.0:process (process-resource-bundles) @ struts2-jasperreports7-plugin ---
[INFO] Preparing remote bundle org.apache.apache.resources:apache-jar-resource-bundle:1.5
[INFO] Copying 3 resources from 1 bundle.
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 3 resources from src/main/resources to target/classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ struts2-jasperreports7-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 12 source files with javac [debug release 17] to target/classes
[INFO]
[INFO] --- bundle:6.0.2:manifest (bundle-manifest) @ struts2-jasperreports7-plugin ---
[INFO] Writing manifest: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/classes/META-INF/MANIFEST.MF>
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 2 resources from src/test/resources to target/test-classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/test-classes
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ struts2-jasperreports7-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 1 source file with javac [debug release 17] to target/test-classes
[INFO]
[INFO] --- surefire:3.5.5:test (default-test) @ struts2-jasperreports7-plugin ---
[INFO] Using configured provider org.apache.maven.surefire.junitcore.JUnitCoreProvider
[INFO]
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
Standard Commons Logging discovery in action with spring-jcl: please remove commons-logging.jar from classpath in order to avoid potential conflicts
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getReportParameters()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getDatasource()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 8.446 s -- in org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0
[INFO]
[INFO]
[INFO] --- apache-rat:0.18:check (default) @ struts2-jasperreports7-plugin ---
[INFO] No issues found.
[INFO]
[INFO] --- jar:3.3.0:jar (default-jar) @ struts2-jasperreports7-plugin ---
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/struts2-jasperreports7-plugin-7.2.0-SNAPSHOT.jar>
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (attach-descriptor) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (site-inheritance) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- dependency-check:12.2.2:check (default) @ struts2-jasperreports7-plugin ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (354 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (1 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Sonatype OSS Index Analyzer disabled due to missing credentials. Authentication with token is now required, and OSS Index is migrating to Sonatype Guide. See https://dependency-check.github.io/DependencyCheck/analyzers/oss-index-analyzer.html for more information on authentication with Sonatype Guide OSS Index.
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2011-5057, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0391, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0392, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0393, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0394, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,CVE-2017-1000487,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL]:
jasperreports-7.0.4.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.4, cpe:2.3:a:cloud:jasperreports_library:7.0.4:*:*:*:*:*:*:*) : CVE-2025-10492
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 7.2.0-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... SUCCESS [ 35.620 s]
[INFO] Struts BOM ......................................... SUCCESS [ 3.926 s]
[INFO] Struts Parent POM .................................. SUCCESS [ 3.777 s]
[INFO] Struts 2 Jakarta EE Compatible modules ............. SUCCESS [ 3.777 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools View . SUCCESS [ 10.032 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp .. SUCCESS [ 5.829 s]
[INFO] Struts 2 Core ...................................... SUCCESS [02:42 min]
[INFO] Struts 2 Plugins ................................... SUCCESS [ 3.528 s]
[INFO] Struts 2 Async Plugin .............................. SUCCESS [ 4.681 s]
[INFO] Struts 2 Bean Validation Plugin .................... SUCCESS [ 8.713 s]
[INFO] Struts 2 CDI Plugin ................................ SUCCESS [ 6.499 s]
[INFO] Struts 2 Spring Plugin ............................. SUCCESS [ 11.806 s]
[INFO] Struts 2 JUnit Plugin .............................. SUCCESS [ 9.716 s]
[INFO] Struts 2 Velocity Plugin ........................... SUCCESS [ 10.243 s]
[INFO] Struts 2 Configuration Browser Plugin .............. SUCCESS [ 3.965 s]
[INFO] Struts 2 Convention Plugin ......................... SUCCESS [ 14.871 s]
[INFO] Struts 2 Jasper Reports Plugin ..................... SUCCESS [ 10.418 s]
[INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] .... FAILURE [ 15.282 s]
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 05:27 min
[INFO] Finished at: 2026-05-22T06:44:41Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.2:check (default) on project struts2-jasperreports7-plugin:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] jasperreports-7.0.4.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.4, cpe:2.3:a:cloud:jasperreports_library:7.0.4:*:*:*:*:*:*:*): CVE-2025-10492(8.7)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :struts2-jasperreports7-plugin
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-dependency-check #256
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/256/display/redirect>
Changes:
------------------------------------------
[...truncated 1.35 MiB...]
[INFO] --- apache-rat:0.18:check (default) @ struts2-jasperreports-plugin ---
[INFO] No issues found.
[INFO]
[INFO] --- jar:3.3.0:jar (default-jar) @ struts2-jasperreports-plugin ---
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (attach-descriptor) @ struts2-jasperreports-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (site-inheritance) @ struts2-jasperreports-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- dependency-check:12.2.1:check (default) @ struts2-jasperreports-plugin ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (486 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (1 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports/target/dependency-check-report.html>
[INFO]
[INFO] ----------< org.apache.struts:struts2-jasperreports7-plugin >-----------
[INFO] Building Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] 7.2.0-SNAPSHOT [18/29]
[INFO] from plugins/jasperreports7/pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce) @ struts2-jasperreports7-plugin ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence passed
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce-maven-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce-java-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- remote-resources:3.1.0:process (process-resource-bundles) @ struts2-jasperreports7-plugin ---
[INFO] Preparing remote bundle org.apache.apache.resources:apache-jar-resource-bundle:1.5
[INFO] Copying 3 resources from 1 bundle.
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 3 resources from src/main/resources to target/classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ struts2-jasperreports7-plugin ---
[INFO] Nothing to compile - all classes are up to date
[INFO]
[INFO] --- bundle:6.0.2:manifest (bundle-manifest) @ struts2-jasperreports7-plugin ---
[INFO] Writing manifest: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/classes/META-INF/MANIFEST.MF>
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 2 resources from src/test/resources to target/test-classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/test-classes
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ struts2-jasperreports7-plugin ---
[INFO] Nothing to compile - all classes are up to date
[INFO]
[INFO] --- surefire:3.5.5:test (default-test) @ struts2-jasperreports7-plugin ---
[INFO] Using configured provider org.apache.maven.surefire.junitcore.JUnitCoreProvider
[INFO]
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
Standard Commons Logging discovery in action with spring-jcl: please remove commons-logging.jar from classpath in order to avoid potential conflicts
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getReportParameters()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getDatasource()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 9.663 s -- in org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0
[INFO]
[INFO]
[INFO] --- apache-rat:0.18:check (default) @ struts2-jasperreports7-plugin ---
[INFO] No issues found.
[INFO]
[INFO] --- jar:3.3.0:jar (default-jar) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (attach-descriptor) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (site-inheritance) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- dependency-check:12.2.1:check (default) @ struts2-jasperreports7-plugin ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (322 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2011-5057, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0391, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0392, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0393, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0394, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,CVE-2017-1000487,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL]:
jasperreports-7.0.4.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.4, cpe:2.3:a:cloud:jasperreports_library:7.0.4:*:*:*:*:*:*:*) : CVE-2025-10492
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 7.2.0-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... SUCCESS [ 40.605 s]
[INFO] Struts BOM ......................................... SUCCESS [ 7.025 s]
[INFO] Struts Parent POM .................................. SUCCESS [ 5.860 s]
[INFO] Struts 2 Jakarta EE Compatible modules ............. SUCCESS [ 4.081 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools View . SUCCESS [ 12.209 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp .. SUCCESS [ 7.831 s]
[INFO] Struts 2 Core ...................................... SUCCESS [02:37 min]
[INFO] Struts 2 Plugins ................................... SUCCESS [ 4.501 s]
[INFO] Struts 2 Async Plugin .............................. SUCCESS [ 5.216 s]
[INFO] Struts 2 Bean Validation Plugin .................... SUCCESS [ 8.770 s]
[INFO] Struts 2 CDI Plugin ................................ SUCCESS [ 5.872 s]
[INFO] Struts 2 Spring Plugin ............................. SUCCESS [ 14.431 s]
[INFO] Struts 2 JUnit Plugin .............................. SUCCESS [ 10.800 s]
[INFO] Struts 2 Velocity Plugin ........................... SUCCESS [ 11.857 s]
[INFO] Struts 2 Configuration Browser Plugin .............. SUCCESS [ 4.684 s]
[INFO] Struts 2 Convention Plugin ......................... SUCCESS [ 18.046 s]
[INFO] Struts 2 Jasper Reports Plugin ..................... SUCCESS [ 17.030 s]
[INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] .... FAILURE [ 16.621 s]
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 05:56 min
[INFO] Finished at: 2026-05-01T06:45:09Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.1:check (default) on project struts2-jasperreports7-plugin:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] jasperreports-7.0.4.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.4, cpe:2.3:a:cloud:jasperreports_library:7.0.4:*:*:*:*:*:*:*): CVE-2025-10492(8.7)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :struts2-jasperreports7-plugin
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-dependency-check #255
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/255/display/redirect?page=changes>
Changes:
[github] build(deps): bump github/codeql-action from 4.34.1 to 4.35.1 (#1645)
[github] build(deps-dev): bump byte-buddy.version from 1.18.7 to 1.18.8 (#1646)
[github] build(deps): bump org.apache.logging.log4j:log4j-bom (#1648)
[github] WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks (#1642)
[github] WW-5622 perf(core): optimize Hibernate proxy detection when Hibernate is absent (#1649)
[github] ci(dependabot): add cooldown (#1656)
[github] build(deps): bump ognl:ognl from 3.4.10 to 3.4.11 (#1655)
[github] ci(struts6): adjusts workflows to use the new branch (#1659)
[github] cd(checks): uses proper context names for checks (#1660)
[github] build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#1663)
[github] build(deps): bump org.owasp:dependency-check-maven from 12.2.0 to 12.2.1 (#1664)
[github] introduce private method to remove clones (#1666)
------------------------------------------
[...truncated 1.41 MiB...]
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports/target/struts2-jasperreports-plugin-7.2.0-SNAPSHOT.jar>
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (attach-descriptor) @ struts2-jasperreports-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (site-inheritance) @ struts2-jasperreports-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- dependency-check:12.2.1:check (default) @ struts2-jasperreports-plugin ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (276 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (1 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (1 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports/target/dependency-check-report.html>
[INFO]
[INFO] ----------< org.apache.struts:struts2-jasperreports7-plugin >-----------
[INFO] Building Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] 7.2.0-SNAPSHOT [18/29]
[INFO] from plugins/jasperreports7/pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce) @ struts2-jasperreports7-plugin ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence passed
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce-maven-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce-java-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- remote-resources:3.1.0:process (process-resource-bundles) @ struts2-jasperreports7-plugin ---
[INFO] Preparing remote bundle org.apache.apache.resources:apache-jar-resource-bundle:1.5
[INFO] Copying 3 resources from 1 bundle.
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 3 resources from src/main/resources to target/classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ struts2-jasperreports7-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 12 source files with javac [debug release 17] to target/classes
[INFO]
[INFO] --- bundle:6.0.2:manifest (bundle-manifest) @ struts2-jasperreports7-plugin ---
[INFO] Writing manifest: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/classes/META-INF/MANIFEST.MF>
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 2 resources from src/test/resources to target/test-classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/test-classes
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ struts2-jasperreports7-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 1 source file with javac [debug release 17] to target/test-classes
[INFO]
[INFO] --- surefire:3.5.5:test (default-test) @ struts2-jasperreports7-plugin ---
[INFO] Using configured provider org.apache.maven.surefire.junitcore.JUnitCoreProvider
[INFO]
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
Standard Commons Logging discovery in action with spring-jcl: please remove commons-logging.jar from classpath in order to avoid potential conflicts
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getReportParameters()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getDatasource()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 8.325 s -- in org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0
[INFO]
[INFO]
[INFO] --- apache-rat:0.18:check (default) @ struts2-jasperreports7-plugin ---
[INFO] No issues found.
[INFO]
[INFO] --- jar:3.3.0:jar (default-jar) @ struts2-jasperreports7-plugin ---
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/struts2-jasperreports7-plugin-7.2.0-SNAPSHOT.jar>
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (attach-descriptor) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (site-inheritance) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- dependency-check:12.2.1:check (default) @ struts2-jasperreports7-plugin ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (347 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2011-5057, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0391, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0392, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0393, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0394, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,CVE-2017-1000487,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL]:
jasperreports-7.0.4.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.4, cpe:2.3:a:cloud:jasperreports_library:7.0.4:*:*:*:*:*:*:*) : CVE-2025-10492
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 7.2.0-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... SUCCESS [ 59.466 s]
[INFO] Struts BOM ......................................... SUCCESS [ 4.238 s]
[INFO] Struts Parent POM .................................. SUCCESS [ 3.777 s]
[INFO] Struts 2 Jakarta EE Compatible modules ............. SUCCESS [ 3.280 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools View . SUCCESS [ 10.050 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp .. SUCCESS [ 5.958 s]
[INFO] Struts 2 Core ...................................... SUCCESS [02:44 min]
[INFO] Struts 2 Plugins ................................... SUCCESS [ 4.132 s]
[INFO] Struts 2 Async Plugin .............................. SUCCESS [ 5.001 s]
[INFO] Struts 2 Bean Validation Plugin .................... SUCCESS [ 8.721 s]
[INFO] Struts 2 CDI Plugin ................................ SUCCESS [ 6.558 s]
[INFO] Struts 2 Spring Plugin ............................. SUCCESS [ 11.536 s]
[INFO] Struts 2 JUnit Plugin .............................. SUCCESS [ 9.926 s]
[INFO] Struts 2 Velocity Plugin ........................... SUCCESS [ 10.371 s]
[INFO] Struts 2 Configuration Browser Plugin .............. SUCCESS [ 4.024 s]
[INFO] Struts 2 Convention Plugin ......................... SUCCESS [ 16.289 s]
[INFO] Struts 2 Jasper Reports Plugin ..................... SUCCESS [ 11.082 s]
[INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] .... FAILURE [ 17.824 s]
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 05:59 min
[INFO] Finished at: 2026-04-22T06:45:10Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.1:check (default) on project struts2-jasperreports7-plugin:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] jasperreports-7.0.4.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.4, cpe:2.3:a:cloud:jasperreports_library:7.0.4:*:*:*:*:*:*:*): CVE-2025-10492(8.7)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :struts2-jasperreports7-plugin
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-dependency-check #254
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/254/display/redirect?page=changes>
Changes:
[github] build(deps): bump github/codeql-action from 4.33.0 to 4.34.1 (#1633)
[github] deps(rat): excludes updatding the RAT plugin as it requires Java 17 (#1641)
[github] build(deps): bump com.fasterxml.jackson:jackson-bom (#1634)
[github] build(deps): bump org.apache.rat:apache-rat-plugin from 0.17 to 0.18 (#1639)
[github] build(deps): bump org.apache.maven.doxia:doxia-core from 2.0.0 to 2.1.0 (#1640)
[github] WW-5537 Resolve classloader/memory leaks during Tomcat hot deployment (#1632)
------------------------------------------
[...truncated 1.87 MiB...]
Progress (1): 7.7/486 kBProgress (1): 16/486 kB Progress (1): 32/486 kBProgress (1): 49/486 kBProgress (1): 65/486 kBProgress (1): 81/486 kBProgress (1): 98/486 kBProgress (1): 114/486 kBProgress (1): 131/486 kBProgress (1): 147/486 kBProgress (1): 163/486 kBProgress (1): 180/486 kBProgress (1): 196/486 kBProgress (1): 213/486 kBProgress (1): 229/486 kBProgress (1): 245/486 kBProgress (1): 262/486 kBProgress (1): 278/486 kBProgress (1): 294/486 kBProgress (1): 311/486 kBProgress (1): 327/486 kBProgress (1): 344/486 kBProgress (1): 360/486 kBProgress (1): 376/486 kBProgress (1): 393/486 kBProgress (1): 409/486 kBProgress (1): 426/486 kBProgress (1): 442/486 kBProgress (1): 458/486 kBProgress (1): 475/486 kBProgress (1): 486 kB Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-anim/1.19/batik-anim-1.19.jar (486 kB at 22 MB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-script/1.19/batik-script-1.19.jar
Progress (1): 6.7 kB Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-shared-resources/1.19/batik-shared-resources-1.19.jar (6.7 kB at 318 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-xml/1.19/batik-xml-1.19.jar
Progress (1): 7.7/705 kBProgress (1): 16/705 kB Progress (1): 25/705 kBProgress (1): 41/705 kBProgress (1): 57/705 kBProgress (1): 74/705 kBProgress (2): 74/705 kB | 7.7/77 kBProgress (2): 90/705 kB | 7.7/77 kBProgress (2): 90/705 kB | 16/77 kB Progress (2): 106/705 kB | 16/77 kBProgress (2): 106/705 kB | 32/77 kBProgress (2): 123/705 kB | 32/77 kBProgress (2): 123/705 kB | 48/77 kBProgress (2): 139/705 kB | 48/77 kBProgress (2): 139/705 kB | 65/77 kBProgress (2): 156/705 kB | 65/77 kBProgress (2): 156/705 kB | 77 kB Progress (2): 172/705 kB | 77 kBProgress (2): 188/705 kB | 77 kBProgress (2): 205/705 kB | 77 kBProgress (2): 221/705 kB | 77 kBProgress (3): 221/705 kB | 77 kB | 7.7/10 kBProgress (3): 221/705 kB | 77 kB | 10 kB Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-ext/1.19/batik-ext-1.19.jar (10 kB at 324 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/xmlgraphics-commons/2.11/xmlgraphics-commons-2.11.jar
Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-parser/1.19/batik-parser-1.19.jar (77 kB at 2.6 MB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-dom/1.19/batik-dom-1.19.jar
Progress (1): 238/705 kBProgress (1): 254/705 kBProgress (1): 270/705 kBProgress (1): 287/705 kBProgress (1): 303/705 kBProgress (1): 319/705 kBProgress (1): 336/705 kBProgress (1): 352/705 kBProgress (1): 369/705 kBProgress (1): 385/705 kBProgress (1): 401/705 kBProgress (1): 418/705 kBProgress (2): 418/705 kB | 7.7/25 kBProgress (2): 418/705 kB | 16/25 kB Progress (2): 418/705 kB | 25 kB Progress (2): 434/705 kB | 25 kBProgress (2): 451/705 kB | 25 kBProgress (2): 467/705 kB | 25 kBProgress (2): 473/705 kB | 25 kB Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-script/1.19/batik-script-1.19.jar (25 kB at 774 kB/s)
Progress (1): 490/705 kB Downloading from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-svg-dom/1.19/batik-svg-dom-1.19.jar
Progress (1): 506/705 kBProgress (1): 522/705 kBProgress (2): 522/705 kB | 7.7/34 kBProgress (2): 522/705 kB | 16/34 kB Progress (2): 539/705 kB | 16/34 kBProgress (2): 539/705 kB | 32/34 kBProgress (2): 555/705 kB | 32/34 kBProgress (2): 555/705 kB | 34 kB Progress (2): 572/705 kB | 34 kBProgress (2): 588/705 kB | 34 kBProgress (2): 604/705 kB | 34 kB Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-xml/1.19/batik-xml-1.19.jar (34 kB at 1.0 MB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-awt-util/1.19/batik-awt-util-1.19.jar
Progress (1): 621/705 kBProgress (1): 637/705 kBProgress (1): 653/705 kBProgress (1): 670/705 kBProgress (1): 686/705 kBProgress (1): 703/705 kBProgress (1): 705 kB Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-bridge/1.19/batik-bridge-1.19.jar (705 kB at 20 MB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-gvt/1.19/batik-gvt-1.19.jar
Progress (1): 7.7/425 kBProgress (1): 12/425 kB Progress (1): 29/425 kBProgress (1): 45/425 kBProgress (1): 61/425 kBProgress (1): 78/425 kBProgress (1): 94/425 kBProgress (1): 111/425 kBProgress (2): 111/425 kB | 7.7/686 kBProgress (2): 111/425 kB | 12/686 kB Progress (2): 127/425 kB | 12/686 kBProgress (2): 127/425 kB | 28/686 kBProgress (2): 127/425 kB | 44/686 kBProgress (2): 127/425 kB | 61/686 kBProgress (2): 127/425 kB | 77/686 kBProgress (2): 127/425 kB | 93/686 kBProgress (2): 127/425 kB | 110/686 kBProgress (2): 127/425 kB | 126/686 kBProgress (2): 127/425 kB | 143/686 kBProgress (2): 127/425 kB | 159/686 kBProgress (2): 127/425 kB | 175/686 kBProgress (2): 127/425 kB | 192/686 kBProgress (2): 143/425 kB | 192/686 kBProgress (2): 160/425 kB | 192/686 kBProgress (2): 160/425 kB | 208/686 kBProgress (2): 176/425 kB | 208/686 kBProgress (2): 176/425 kB | 225/686 kBProgress (2): 193/425 kB | 225/686 kBProgress (2): 209/425 kB | 225/686 kBProgress (2): 209/425 kB | 241/686 kBProgress (2): 213/425 kB | 241/686 kBProgress (2): 213/425 kB | 257/686 kBProgress (2): 229/425 kB | 257/686 kBProgress (2): 229/425 kB | 274/686 kBProgress (2): 246/425 kB | 274/686 kBProgress (2): 246/425 kB | 290/686 kBProgress (2): 262/425 kB | 290/686 kBProgress (3): 262/425 kB | 290/686 kB | 7.7/231 kBProgress (3): 262/425 kB | 290/686 kB | 12/231 kB Progress (3): 279/425 kB | 290/686 kB | 12/231 kBProgress (3): 279/425 kB | 290/686 kB | 28/231 kBProgress (3): 295/425 kB | 290/686 kB | 28/231 kBProgress (3): 295/425 kB | 306/686 kB | 28/231 kBProgress (3): 295/425 kB | 306/686 kB | 44/231 kBProgress (3): 311/425 kB | 306/686 kB | 44/231 kBProgress (3): 311/425 kB | 323/686 kB | 44/231 kBProgress (3): 311/425 kB | 323/686 kB | 61/231 kBProgress (3): 328/425 kB | 323/686 kB | 61/231 kBProgress (3): 328/425 kB | 339/686 kB | 61/231 kBProgress (3): 328/425 kB | 339/686 kB | 77/231 kBProgress (3): 344/425 kB | 339/686 kB | 77/231 kBProgress (3): 344/425 kB | 356/686 kB | 77/231 kBProgress (3): 344/425 kB | 356/686 kB | 93/231 kBProgress (3): 360/425 kB | 356/686 kB | 93/231 kBProgress (3): 360/425 kB | 372/686 kB | 93/231 kBProgress (3): 360/425 kB | 372/686 kB | 110/231 kBProgress (3): 360/425 kB | 372/686 kB | 126/231 kBProgress (3): 360/425 kB | 372/686 kB | 143/231 kBProgress (3): 360/425 kB | 372/686 kB | 159/231 kBProgress (4): 360/425 kB | 372/686 kB | 159/231 kB | 7.5/184 kBProgress (4): 360/425 kB | 372/686 kB | 175/231 kB | 7.5/184 kBProgress (4): 360/425 kB | 372/686 kB | 175/231 kB | 24/184 kB Progress (4): 360/425 kB | 372/686 kB | 192/231 kB | 24/184 kBProgress (4): 360/425 kB | 372/686 kB | 192/231 kB | 40/184 kBProgress (4): 360/425 kB | 372/686 kB | 208/231 kB | 40/184 kBProgress (4): 360/425 kB | 372/686 kB | 208/231 kB | 57/184 kBProgress (4): 360/425 kB | 372/686 kB | 208/231 kB | 73/184 kBProgress (4): 360/425 kB | 372/686 kB | 208/231 kB | 89/184 kBProgress (4): 360/425 kB | 372/686 kB | 208/231 kB | 106/184 kBProgress (4): 360/425 kB | 372/686 kB | 208/231 kB | 122/184 kBProgress (4): 360/425 kB | 372/686 kB | 208/231 kB | 139/184 kBProgress (4): 360/425 kB | 372/686 kB | 208/231 kB | 155/184 kBProgress (4): 360/425 kB | 372/686 kB | 208/231 kB | 171/184 kBProgress (4): 360/425 kB | 372/686 kB | 208/231 kB | 184 kB Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-dom/1.19/batik-dom-1.19.jar (184 kB at 3.3 MB/s)
Progress (4): 360/425 kB | 372/686 kB | 208/231 kB | 7.7/192 kBProgress (4): 360/425 kB | 372/686 kB | 208/231 kB | 16/192 kB Progress (4): 360/425 kB | 372/686 kB | 208/231 kB | 32/192 kBProgress (4): 360/425 kB | 372/686 kB | 208/231 kB | 48/192 kBProgress (4): 360/425 kB | 372/686 kB | 208/231 kB | 65/192 kBProgress (4): 377/425 kB | 372/686 kB | 208/231 kB | 65/192 kBProgress (4): 377/425 kB | 372/686 kB | 208/231 kB | 81/192 kBProgress (4): 377/425 kB | 372/686 kB | 225/231 kB | 81/192 kBProgress (4): 393/425 kB | 372/686 kB | 225/231 kB | 81/192 kBProgress (4): 393/425 kB | 372/686 kB | 225/231 kB | 98/192 kBProgress (4): 393/425 kB | 372/686 kB | 231 kB | 98/192 kB Progress (4): 393/425 kB | 372/686 kB | 231 kB | 114/192 kBProgress (4): 410/425 kB | 372/686 kB | 231 kB | 114/192 kBProgress (4): 425 kB | 372/686 kB | 231 kB | 114/192 kB Progress (4): 425 kB | 372/686 kB | 231 kB | 130/192 kBProgress (4): 425 kB | 372/686 kB | 231 kB | 147/192 kB Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-svg-dom/1.19/batik-svg-dom-1.19.jar (231 kB at 4.0 MB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-util/1.19/batik-util-1.19.jar
Progress (3): 425 kB | 372/686 kB | 163/192 kBProgress (3): 425 kB | 372/686 kB | 179/192 kBProgress (3): 425 kB | 372/686 kB | 192 kB Progress (3): 425 kB | 388/686 kB | 192 kBProgress (3): 425 kB | 401/686 kB | 192 kBProgress (3): 425 kB | 417/686 kB | 192 kBProgress (3): 425 kB | 434/686 kB | 192 kBProgress (3): 425 kB | 450/686 kB | 192 kBProgress (3): 425 kB | 466/686 kB | 192 kBProgress (3): 425 kB | 483/686 kB | 192 kBProgress (3): 425 kB | 499/686 kB | 192 kBProgress (3): 425 kB | 515/686 kB | 192 kBProgress (3): 425 kB | 532/686 kB | 192 kBProgress (3): 425 kB | 548/686 kB | 192 kB Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-awt-util/1.19/batik-awt-util-1.19.jar (425 kB at 7.2 MB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-i18n/1.19/batik-i18n-1.19.jar
Progress (2): 565/686 kB | 192 kBProgress (2): 581/686 kB | 192 kBProgress (2): 597/686 kB | 192 kBProgress (2): 614/686 kB | 192 kBProgress (2): 620/686 kB | 192 kBProgress (2): 636/686 kB | 192 kBProgress (2): 653/686 kB | 192 kBProgress (2): 669/686 kB | 192 kB Downloading from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-constants/1.19/batik-constants-1.19.jar
Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-gvt/1.19/batik-gvt-1.19.jar (192 kB at 3.2 MB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-css/1.19/batik-css-1.19.jar
Progress (1): 686/686 kBProgress (1): 686 kB Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/xmlgraphics-commons/2.11/xmlgraphics-commons-2.11.jar (686 kB at 11 MB/s)
Downloading from central: https://repo.maven.apache.org/maven2/xml-apis/xml-apis-ext/1.3.04/xml-apis-ext-1.3.04.jar
Progress (1): 7.7/12 kBProgress (1): 12 kB Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-i18n/1.19/batik-i18n-1.19.jar (12 kB at 160 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/org/apache/commons/commons-beanutils2/2.0.0-M2/commons-beanutils2-2.0.0-M2.jar
Progress (1): 7.7/127 kBProgress (2): 7.7/127 kB | 7.7/8.6 kBProgress (2): 7.7/127 kB | 8.6 kB Progress (2): 16/127 kB | 8.6 kB Progress (2): 32/127 kB | 8.6 kBProgress (2): 48/127 kB | 8.6 kB Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-constants/1.19/batik-constants-1.19.jar (8.6 kB at 113 kB/s)
Progress (1): 65/127 kB Downloading from central: https://repo.maven.apache.org/maven2/net/sf/jasperreports/jasperreports-pdf/7.0.4/jasperreports-pdf-7.0.4.jar
Progress (1): 81/127 kBProgress (1): 98/127 kBProgress (1): 114/127 kBProgress (1): 127 kB Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-util/1.19/batik-util-1.19.jar (127 kB at 1.7 MB/s)
Downloading from central: https://repo.maven.apache.org/maven2/com/github/librepdf/openpdf/1.3.43/openpdf-1.3.43.jar
Progress (1): 7.7/86 kBProgress (1): 16/86 kB Progress (1): 32/86 kBProgress (1): 48/86 kBProgress (1): 65/86 kBProgress (2): 65/86 kB | 7.7/331 kBProgress (2): 81/86 kB | 7.7/331 kBProgress (2): 81/86 kB | 16/331 kB Progress (2): 86 kB | 16/331 kB Progress (2): 86 kB | 32/331 kBProgress (2): 86 kB | 49/331 kBProgress (2): 86 kB | 65/331 kB Downloaded from central: https://repo.maven.apache.org/maven2/xml-apis/xml-apis-ext/1.3.04/xml-apis-ext-1.3.04.jar (86 kB at 1.1 MB/s)
Downloading from central: https://repo.maven.apache.org/maven2/com/adobe/xmp/xmpcore/6.1.11/xmpcore-6.1.11.jar
Progress (1): 81/331 kBProgress (1): 98/331 kBProgress (1): 114/331 kBProgress (1): 131/331 kBProgress (1): 147/331 kBProgress (1): 163/331 kBProgress (1): 180/331 kBProgress (1): 196/331 kBProgress (1): 213/331 kBProgress (1): 229/331 kBProgress (1): 245/331 kBProgress (1): 262/331 kBProgress (1): 278/331 kBProgress (1): 294/331 kBProgress (1): 311/331 kBProgress (1): 327/331 kBProgress (1): 331 kB Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/xmlgraphics/batik-css/1.19/batik-css-1.19.jar (331 kB at 3.9 MB/s)
Downloading from central: https://repo.maven.apache.org/maven2/com/fasterxml/jackson/core/jackson-databind/2.21.2/jackson-databind-2.21.2.jar
Progress (1): 7.7/260 kBProgress (1): 16/260 kB Progress (1): 32/260 kBProgress (1): 48/260 kBProgress (1): 65/260 kBProgress (1): 81/260 kBProgress (1): 98/260 kBProgress (1): 114/260 kBProgress (1): 115/260 kBProgress (1): 131/260 kBProgress (1): 147/260 kBProgress (1): 164/260 kBProgress (1): 176/260 kBProgress (1): 180/260 kBProgress (1): 197/260 kBProgress (1): 213/260 kBProgress (1): 225/260 kBProgress (1): 242/260 kBProgress (1): 246/260 kBProgress (1): 260 kB Downloaded from central: https://repo.maven.apache.org/maven2/org/apache/commons/commons-beanutils2/2.0.0-M2/commons-beanutils2-2.0.0-M2.jar (260 kB at 2.9 MB/s)
Downloading from central: https://repo.maven.apache.org/maven2/com/fasterxml/jackson/core/jackson-annotations/2.21/jackson-annotations-2.21.jar
Progress (1): 7.7/156 kBProgress (1): 12/156 kB Progress (1): 29/156 kBProgress (1): 45/156 kBProgress (1): 61/156 kBProgress (1): 78/156 kBProgress (1): 94/156 kBProgress (1): 111/156 kBProgress (1): 127/156 kBProgress (1): 143/156 kBProgress (1): 156 kB Downloaded from central: https://repo.maven.apache.org/maven2/net/sf/jasperreports/jasperreports-pdf/7.0.4/jasperreports-pdf-7.0.4.jar (156 kB at 1.7 MB/s)
Progress (1): 0/2.2 MBProgress (1): 0/2.2 MBProgress (1): 0/2.2 MBProgress (1): 0/2.2 MBProgress (2): 0/2.2 MB | 7.7/143 kBProgress (2): 0/2.2 MB | 16/143 kB Progress (2): 0/2.2 MB | 32/143 kBProgress (2): 0.1/2.2 MB | 32/143 kBProgress (2): 0.1/2.2 MB | 49/143 kBProgress (2): 0.1/2.2 MB | 49/143 kBProgress (2): 0.1/2.2 MB | 65/143 kBProgress (2): 0.1/2.2 MB | 81/143 kBProgress (2): 0.1/2.2 MB | 81/143 kBProgress (2): 0.1/2.2 MB | 98/143 kBProgress (2): 0.1/2.2 MB | 114/143 kBProgress (2): 0.1/2.2 MB | 130/143 kBProgress (2): 0.1/2.2 MB | 143 kB Progress (2): 0.1/2.2 MB | 143 kB Downloaded from central: https://repo.maven.apache.org/maven2/com/adobe/xmp/xmpcore/6.1.11/xmpcore-6.1.11.jar (143 kB at 1.4 MB/s)
Progress (1): 0.1/2.2 MBProgress (1): 0.1/2.2 MBProgress (2): 0.1/2.2 MB | 7.7/82 kBProgress (2): 0.2/2.2 MB | 7.7/82 kBProgress (2): 0.2/2.2 MB | 16/82 kB Progress (2): 0.2/2.2 MB | 24/82 kBProgress (2): 0.2/2.2 MB | 40/82 kBProgress (3): 0.2/2.2 MB | 40/82 kB | 0/1.7 MBProgress (3): 0.2/2.2 MB | 40/82 kB | 0/1.7 MBProgress (3): 0.2/2.2 MB | 57/82 kB | 0/1.7 MBProgress (3): 0.2/2.2 MB | 57/82 kB | 0/1.7 MBProgress (3): 0.2/2.2 MB | 73/82 kB | 0/1.7 MBProgress (3): 0.2/2.2 MB | 73/82 kB | 0/1.7 MBProgress (3): 0.2/2.2 MB | 82 kB | 0/1.7 MB Progress (3): 0.2/2.2 MB | 82 kB | 0/1.7 MB Downloaded from central: https://repo.maven.apache.org/maven2/com/fasterxml/jackson/core/jackson-annotations/2.21/jackson-annotations-2.21.jar (82 kB at 797 kB/s)
Progress (2): 0.2/2.2 MB | 0.1/1.7 MBProgress (2): 0.2/2.2 MB | 0.1/1.7 MBProgress (2): 0.2/2.2 MB | 0.1/1.7 MBProgress (2): 0.2/2.2 MB | 0.1/1.7 MBProgress (2): 0.2/2.2 MB | 0.1/1.7 MBProgress (2): 0.2/2.2 MB | 0.1/1.7 MBProgress (2): 0.2/2.2 MB | 0.1/1.7 MBProgress (2): 0.2/2.2 MB | 0.1/1.7 MBProgress (2): 0.3/2.2 MB | 0.1/1.7 MBProgress (2): 0.3/2.2 MB | 0.1/1.7 MBProgress (2): 0.3/2.2 MB | 0.1/1.7 MBProgress (2): 0.3/2.2 MB | 0.1/1.7 MBProgress (2): 0.3/2.2 MB | 0.1/1.7 MBProgress (2): 0.3/2.2 MB | 0.1/1.7 MBProgress (2): 0.3/2.2 MB | 0.1/1.7 MBProgress (2): 0.3/2.2 MB | 0.2/1.7 MBProgress (2): 0.3/2.2 MB | 0.2/1.7 MBProgress (2): 0.4/2.2 MB | 0.2/1.7 MBProgress (2): 0.4/2.2 MB | 0.2/1.7 MBProgress (2): 0.4/2.2 MB | 0.2/1.7 MBProgress (2): 0.4/2.2 MB | 0.2/1.7 MBProgress (2): 0.4/2.2 MB | 0.2/1.7 MBProgress (2): 0.4/2.2 MB | 0.2/1.7 MBProgress (2): 0.4/2.2 MB | 0.2/1.7 MBProgress (2): 0.4/2.2 MB | 0.2/1.7 MBProgress (2): 0.4/2.2 MB | 0.2/1.7 MBProgress (2): 0.4/2.2 MB | 0.2/1.7 MBProgress (2): 0.5/2.2 MB | 0.2/1.7 MBProgress (2): 0.5/2.2 MB | 0.2/1.7 MBProgress (2): 0.5/2.2 MB | 0.2/1.7 MBProgress (2): 0.5/2.2 MB | 0.2/1.7 MBProgress (2): 0.5/2.2 MB | 0.2/1.7 MBProgress (2): 0.5/2.2 MB | 0.2/1.7 MBProgress (2): 0.5/2.2 MB | 0.2/1.7 MBProgress (2): 0.5/2.2 MB | 0.3/1.7 MBProgress (2): 0.5/2.2 MB | 0.3/1.7 MBProgress (2): 0.5/2.2 MB | 0.3/1.7 MBProgress (2): 0.6/2.2 MB | 0.3/1.7 MBProgress (2): 0.6/2.2 MB | 0.3/1.7 MBProgress (2): 0.6/2.2 MB | 0.3/1.7 MBProgress (2): 0.6/2.2 MB | 0.3/1.7 MBProgress (2): 0.6/2.2 MB | 0.3/1.7 MBProgress (2): 0.6/2.2 MB | 0.3/1.7 MBProgress (2): 0.6/2.2 MB | 0.3/1.7 MBProgress (2): 0.6/2.2 MB | 0.3/1.7 MBProgress (2): 0.6/2.2 MB | 0.3/1.7 MBProgress (2): 0.6/2.2 MB | 0.3/1.7 MBProgress (2): 0.6/2.2 MB | 0.4/1.7 MBProgress (2): 0.6/2.2 MB | 0.4/1.7 MBProgress (2): 0.6/2.2 MB | 0.4/1.7 MBProgress (2): 0.7/2.2 MB | 0.4/1.7 MBProgress (2): 0.7/2.2 MB | 0.4/1.7 MBProgress (2): 0.7/2.2 MB | 0.4/1.7 MBProgress (2): 0.7/2.2 MB | 0.4/1.7 MBProgress (2): 0.7/2.2 MB | 0.4/1.7 MBProgress (2): 0.7/2.2 MB | 0.4/1.7 MBProgress (2): 0.7/2.2 MB | 0.4/1.7 MBProgress (2): 0.7/2.2 MB | 0.4/1.7 MBProgress (2): 0.7/2.2 MB | 0.4/1.7 MBProgress (2): 0.7/2.2 MB | 0.5/1.7 MBProgress (2): 0.7/2.2 MB | 0.5/1.7 MBProgress (2): 0.8/2.2 MB | 0.5/1.7 MBProgress (2): 0.8/2.2 MB | 0.5/1.7 MBProgress (2): 0.8/2.2 MB | 0.5/1.7 MBProgress (2): 0.8/2.2 MB | 0.5/1.7 MBProgress (2): 0.8/2.2 MB | 0.5/1.7 MBProgress (2): 0.8/2.2 MB | 0.5/1.7 MBProgress (2): 0.8/2.2 MB | 0.5/1.7 MBProgress (2): 0.8/2.2 MB | 0.5/1.7 MBProgress (2): 0.8/2.2 MB | 0.5/1.7 MBProgress (2): 0.8/2.2 MB | 0.5/1.7 MBProgress (2): 0.8/2.2 MB | 0.5/1.7 MBProgress (2): 0.8/2.2 MB | 0.6/1.7 MBProgress (2): 0.9/2.2 MB | 0.6/1.7 MBProgress (2): 0.9/2.2 MB | 0.6/1.7 MBProgress (2): 0.9/2.2 MB | 0.6/1.7 MBProgress (2): 0.9/2.2 MB | 0.6/1.7 MBProgress (2): 0.9/2.2 MB | 0.6/1.7 MBProgress (2): 0.9/2.2 MB | 0.6/1.7 MBProgress (2): 0.9/2.2 MB | 0.6/1.7 MBProgress (2): 0.9/2.2 MB | 0.6/1.7 MBProgress (2): 0.9/2.2 MB | 0.6/1.7 MBProgress (2): 0.9/2.2 MB | 0.6/1.7 MBProgress (2): 1.0/2.2 MB | 0.6/1.7 MBProgress (2): 1.0/2.2 MB | 0.6/1.7 MBProgress (2): 1.0/2.2 MB | 0.6/1.7 MBProgress (2): 1.0/2.2 MB | 0.6/1.7 MBProgress (2): 1.0/2.2 MB | 0.6/1.7 MBProgress (2): 1.0/2.2 MB | 0.6/1.7 MBProgress (2): 1.0/2.2 MB | 0.6/1.7 MBProgress (2): 1.0/2.2 MB | 0.7/1.7 MBProgress (2): 1.0/2.2 MB | 0.7/1.7 MBProgress (2): 1.0/2.2 MB | 0.7/1.7 MBProgress (2): 1.1/2.2 MB | 0.7/1.7 MBProgress (2): 1.1/2.2 MB | 0.7/1.7 MBProgress (2): 1.1/2.2 MB | 0.7/1.7 MBProgress (2): 1.1/2.2 MB | 0.7/1.7 MBProgress (2): 1.1/2.2 MB | 0.7/1.7 MBProgress (2): 1.1/2.2 MB | 0.7/1.7 MBProgress (2): 1.1/2.2 MB | 0.7/1.7 MBProgress (2): 1.1/2.2 MB | 0.7/1.7 MBProgress (2): 1.1/2.2 MB | 0.7/1.7 MBProgress (2): 1.1/2.2 MB | 0.7/1.7 MBProgress (2): 1.2/2.2 MB | 0.7/1.7 MBProgress (2): 1.2/2.2 MB | 0.8/1.7 MBProgress (2): 1.2/2.2 MB | 0.8/1.7 MBProgress (2): 1.2/2.2 MB | 0.8/1.7 MBProgress (2): 1.2/2.2 MB | 0.8/1.7 MBProgress (2): 1.2/2.2 MB | 0.8/1.7 MBProgress (2): 1.2/2.2 MB | 0.8/1.7 MBProgress (2): 1.2/2.2 MB | 0.8/1.7 MBProgress (2): 1.2/2.2 MB | 0.8/1.7 MBProgress (2): 1.2/2.2 MB | 0.8/1.7 MBProgress (2): 1.2/2.2 MB | 0.8/1.7 MBProgress (2): 1.3/2.2 MB | 0.8/1.7 MBProgress (2): 1.3/2.2 MB | 0.8/1.7 MBProgress (2): 1.3/2.2 MB | 0.8/1.7 MBProgress (2): 1.3/2.2 MB | 0.8/1.7 MBProgress (2): 1.3/2.2 MB | 0.9/1.7 MBProgress (2): 1.3/2.2 MB | 0.9/1.7 MBProgress (2): 1.3/2.2 MB | 0.9/1.7 MBProgress (2): 1.3/2.2 MB | 0.9/1.7 MBProgress (2): 1.3/2.2 MB | 0.9/1.7 MBProgress (2): 1.3/2.2 MB | 0.9/1.7 MBProgress (2): 1.4/2.2 MB | 0.9/1.7 MBProgress (2): 1.4/2.2 MB | 0.9/1.7 MBProgress (2): 1.4/2.2 MB | 0.9/1.7 MBProgress (2): 1.4/2.2 MB | 0.9/1.7 MBProgress (2): 1.4/2.2 MB | 0.9/1.7 MBProgress (2): 1.4/2.2 MB | 0.9/1.7 MBProgress (2): 1.4/2.2 MB | 0.9/1.7 MBProgress (2): 1.4/2.2 MB | 0.9/1.7 MBProgress (2): 1.4/2.2 MB | 0.9/1.7 MBProgress (2): 1.4/2.2 MB | 1.0/1.7 MBProgress (2): 1.5/2.2 MB | 1.0/1.7 MBProgress (2): 1.5/2.2 MB | 1.0/1.7 MBProgress (2): 1.5/2.2 MB | 1.0/1.7 MBProgress (2): 1.5/2.2 MB | 1.0/1.7 MBProgress (2): 1.5/2.2 MB | 1.0/1.7 MBProgress (2): 1.5/2.2 MB | 1.0/1.7 MBProgress (2): 1.5/2.2 MB | 1.0/1.7 MBProgress (2): 1.5/2.2 MB | 1.0/1.7 MBProgress (2): 1.5/2.2 MB | 1.0/1.7 MBProgress (2): 1.5/2.2 MB | 1.0/1.7 MBProgress (2): 1.6/2.2 MB | 1.0/1.7 MBProgress (2): 1.6/2.2 MB | 1.0/1.7 MBProgress (2): 1.6/2.2 MB | 1.0/1.7 MBProgress (2): 1.6/2.2 MB | 1.0/1.7 MBProgress (2): 1.6/2.2 MB | 1.0/1.7 MBProgress (2): 1.6/2.2 MB | 1.0/1.7 MBProgress (2): 1.6/2.2 MB | 1.1/1.7 MBProgress (2): 1.6/2.2 MB | 1.1/1.7 MBProgress (2): 1.6/2.2 MB | 1.1/1.7 MBProgress (2): 1.6/2.2 MB | 1.1/1.7 MBProgress (2): 1.6/2.2 MB | 1.1/1.7 MBProgress (2): 1.7/2.2 MB | 1.1/1.7 MBProgress (2): 1.7/2.2 MB | 1.1/1.7 MBProgress (2): 1.7/2.2 MB | 1.1/1.7 MBProgress (2): 1.7/2.2 MB | 1.1/1.7 MBProgress (2): 1.7/2.2 MB | 1.1/1.7 MBProgress (2): 1.7/2.2 MB | 1.1/1.7 MBProgress (2): 1.7/2.2 MB | 1.1/1.7 MBProgress (2): 1.7/2.2 MB | 1.1/1.7 MBProgress (2): 1.7/2.2 MB | 1.1/1.7 MBProgress (2): 1.7/2.2 MB | 1.2/1.7 MBProgress (2): 1.8/2.2 MB | 1.2/1.7 MBProgress (2): 1.8/2.2 MB | 1.2/1.7 MBProgress (2): 1.8/2.2 MB | 1.2/1.7 MBProgress (2): 1.8/2.2 MB | 1.2/1.7 MBProgress (2): 1.8/2.2 MB | 1.2/1.7 MBProgress (2): 1.8/2.2 MB | 1.2/1.7 MBProgress (2): 1.8/2.2 MB | 1.2/1.7 MBProgress (2): 1.8/2.2 MB | 1.2/1.7 MBProgress (2): 1.8/2.2 MB | 1.2/1.7 MBProgress (2): 1.8/2.2 MB | 1.2/1.7 MBProgress (2): 1.8/2.2 MB | 1.2/1.7 MBProgress (2): 1.9/2.2 MB | 1.2/1.7 MBProgress (2): 1.9/2.2 MB | 1.3/1.7 MBProgress (2): 1.9/2.2 MB | 1.3/1.7 MBProgress (2): 1.9/2.2 MB | 1.3/1.7 MBProgress (2): 1.9/2.2 MB | 1.3/1.7 MBProgress (2): 1.9/2.2 MB | 1.3/1.7 MBProgress (2): 1.9/2.2 MB | 1.3/1.7 MBProgress (2): 1.9/2.2 MB | 1.3/1.7 MBProgress (2): 1.9/2.2 MB | 1.3/1.7 MBProgress (2): 1.9/2.2 MB | 1.3/1.7 MBProgress (2): 1.9/2.2 MB | 1.3/1.7 MBProgress (2): 1.9/2.2 MB | 1.3/1.7 MBProgress (2): 1.9/2.2 MB | 1.3/1.7 MBProgress (2): 1.9/2.2 MB | 1.4/1.7 MBProgress (2): 2.0/2.2 MB | 1.4/1.7 MBProgress (2): 2.0/2.2 MB | 1.4/1.7 MBProgress (2): 2.0/2.2 MB | 1.4/1.7 MBProgress (2): 2.0/2.2 MB | 1.4/1.7 MBProgress (2): 2.0/2.2 MB | 1.4/1.7 MBProgress (2): 2.0/2.2 MB | 1.4/1.7 MBProgress (2): 2.0/2.2 MB | 1.4/1.7 MBProgress (2): 2.0/2.2 MB | 1.4/1.7 MBProgress (2): 2.0/2.2 MB | 1.4/1.7 MBProgress (2): 2.1/2.2 MB | 1.4/1.7 MBProgress (2): 2.1/2.2 MB | 1.4/1.7 MBProgress (2): 2.1/2.2 MB | 1.4/1.7 MBProgress (2): 2.1/2.2 MB | 1.4/1.7 MBProgress (2): 2.1/2.2 MB | 1.4/1.7 MBProgress (2): 2.1/2.2 MB | 1.4/1.7 MBProgress (2): 2.1/2.2 MB | 1.4/1.7 MBProgress (2): 2.1/2.2 MB | 1.4/1.7 MBProgress (2): 2.1/2.2 MB | 1.5/1.7 MBProgress (2): 2.1/2.2 MB | 1.5/1.7 MBProgress (2): 2.2 MB | 1.5/1.7 MB Progress (2): 2.2 MB | 1.5/1.7 MBProgress (2): 2.2 MB | 1.5/1.7 MBProgress (2): 2.2 MB | 1.5/1.7 MBProgress (2): 2.2 MB | 1.5/1.7 MB Downloaded from central: https://repo.maven.apache.org/maven2/com/github/librepdf/openpdf/1.3.43/openpdf-1.3.43.jar (2.2 MB at 18 MB/s)
Progress (1): 1.5/1.7 MBProgress (1): 1.6/1.7 MBProgress (1): 1.6/1.7 MBProgress (1): 1.6/1.7 MBProgress (1): 1.6/1.7 MBProgress (1): 1.6/1.7 MBProgress (1): 1.6/1.7 MBProgress (1): 1.7/1.7 MBProgress (1): 1.7/1.7 MBProgress (1): 1.7/1.7 MBProgress (1): 1.7 MB Downloaded from central: https://repo.maven.apache.org/maven2/com/fasterxml/jackson/core/jackson-databind/2.21.2/jackson-databind-2.21.2.jar (1.7 MB at 14 MB/s)
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce) @ struts2-jasperreports7-plugin ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence passed
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce-maven-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce-java-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- remote-resources:3.1.0:process (process-resource-bundles) @ struts2-jasperreports7-plugin ---
[INFO] Preparing remote bundle org.apache.apache.resources:apache-jar-resource-bundle:1.5
[INFO] Copying 3 resources from 1 bundle.
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 3 resources from src/main/resources to target/classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ struts2-jasperreports7-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 12 source files with javac [debug release 17] to target/classes
[INFO]
[INFO] --- bundle:6.0.2:manifest (bundle-manifest) @ struts2-jasperreports7-plugin ---
[INFO] No MANIFEST.MF file found, generating manifest.
[INFO] Writing manifest: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/classes/META-INF/MANIFEST.MF>
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 2 resources from src/test/resources to target/test-classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/test-classes
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ struts2-jasperreports7-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 1 source file with javac [debug release 17] to target/test-classes
[INFO]
[INFO] --- surefire:3.5.5:test (default-test) @ struts2-jasperreports7-plugin ---
[INFO] Using configured provider org.apache.maven.surefire.junitcore.JUnitCoreProvider
[INFO]
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
Standard Commons Logging discovery in action with spring-jcl: please remove commons-logging.jar from classpath in order to avoid potential conflicts
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getReportParameters()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getDatasource()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] util.DebugUtils (DebugUtils.java:57) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 7.143 s -- in org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0
[INFO]
[INFO]
[INFO] --- apache-rat:0.18:check (default) @ struts2-jasperreports7-plugin ---
[INFO] No issues found.
[INFO]
[INFO] --- jar:3.3.0:jar (default-jar) @ struts2-jasperreports7-plugin ---
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/struts2-jasperreports7-plugin-7.2.0-SNAPSHOT.jar>
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (attach-descriptor) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (site-inheritance) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- dependency-check:12.2.0:check (default) @ struts2-jasperreports7-plugin ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (66 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (1 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2011-5057, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0391, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0392, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0393, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0394, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,CVE-2017-1000487,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (1 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL]:
jasperreports-7.0.4.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.4, cpe:2.3:a:cloud:jasperreports_library:7.0.4:*:*:*:*:*:*:*) : CVE-2025-10492
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 7.2.0-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... SUCCESS [ 01:45 h]
[INFO] Struts BOM ......................................... SUCCESS [ 2.271 s]
[INFO] Struts Parent POM .................................. SUCCESS [ 2.090 s]
[INFO] Struts 2 Jakarta EE Compatible modules ............. SUCCESS [ 1.979 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools View . SUCCESS [ 8.123 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp .. SUCCESS [ 3.944 s]
[INFO] Struts 2 Core ...................................... SUCCESS [02:18 min]
[INFO] Struts 2 Plugins ................................... SUCCESS [ 2.121 s]
[INFO] Struts 2 Async Plugin .............................. SUCCESS [ 3.054 s]
[INFO] Struts 2 Bean Validation Plugin .................... SUCCESS [ 6.450 s]
[INFO] Struts 2 CDI Plugin ................................ SUCCESS [ 4.230 s]
[INFO] Struts 2 Spring Plugin ............................. SUCCESS [ 8.454 s]
[INFO] Struts 2 JUnit Plugin .............................. SUCCESS [ 7.183 s]
[INFO] Struts 2 Velocity Plugin ........................... SUCCESS [ 7.557 s]
[INFO] Struts 2 Configuration Browser Plugin .............. SUCCESS [ 2.283 s]
[INFO] Struts 2 Convention Plugin ......................... SUCCESS [ 11.418 s]
[INFO] Struts 2 Jasper Reports Plugin ..................... SUCCESS [ 13.547 s]
[INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] .... FAILURE [ 12.127 s]
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 01:49 h
[INFO] Finished at: 2026-04-01T08:28:20Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.0:check (default) on project struts2-jasperreports7-plugin:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] jasperreports-7.0.4.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.4, cpe:2.3:a:cloud:jasperreports_library:7.0.4:*:*:*:*:*:*:*): CVE-2025-10492(8.7)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :struts2-jasperreports7-plugin
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-dependency-check #253
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/253/display/redirect?page=changes>
Changes:
[github] docs: streamline CLAUDE.md based on benchmark findings (#1604)
[github] build(deps-dev): bump byte-buddy.version from 1.18.5 to 1.18.7 (#1607)
[github] build(deps): bump org.mockito:mockito-core from 5.21.0 to 5.22.0 (#1609)
[github] build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 (#1612)
[github] build(deps): bump github/codeql-action from 4.32.4 to 4.32.5 (#1611)
[github] build(deps): bump org.apache.felix:maven-bundle-plugin (#1610)
[github] WW-5549 Fix I18nInterceptor supportedLocale breaking request_locale (#1594)
[Lukasz Lenart] chore: remove project-specific test-runner agent
[github] WW-4428 feat(json): add java.time serialization and deserialization support (#1603)
[github] build(deps): bump github/codeql-action from 4.32.5 to 4.32.6 (#1619)
[github] build(deps-dev): bump commons-logging:commons-logging (#1620)
[github] build(deps): bump net.sf.jasperreports:jasperreports (#1618)
[github] WW-2963 default-action-ref fails to find wildcard named actions (#1614)
[github] WW-5617 Replace printStackTrace() with System.err in CompileReport (#1606)
[github] chore: harden showcase apps and convert READMEs to Markdown (#1624)
[github] build(deps): bump github/codeql-action from 4.32.6 to 4.33.0 (#1627)
[github] build(deps): bump org.glassfish.jaxb:jaxb-bom from 4.0.6 to 4.0.7 (#1628)
[github] build(deps): bump org.mockito:mockito-core from 5.22.0 to 5.23.0 (#1629)
[github] WW-5618 feat(json): add configurable limits to JSON plugin (#1625)
------------------------------------------
[...truncated 936.90 KiB...]
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (252 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (2 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports/target/dependency-check-report.html>
[INFO]
[INFO] ----------< org.apache.struts:struts2-jasperreports7-plugin >-----------
[INFO] Building Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] 7.2.0-SNAPSHOT [18/29]
[INFO] from plugins/jasperreports7/pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce) @ struts2-jasperreports7-plugin ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence passed
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce-maven-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce-java-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- remote-resources:3.1.0:process (process-resource-bundles) @ struts2-jasperreports7-plugin ---
[INFO] Preparing remote bundle org.apache.apache.resources:apache-jar-resource-bundle:1.5
[INFO] Copying 3 resources from 1 bundle.
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 3 resources from src/main/resources to target/classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ struts2-jasperreports7-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 12 source files with javac [debug release 17] to target/classes
[INFO]
[INFO] --- bundle:6.0.2:manifest (bundle-manifest) @ struts2-jasperreports7-plugin ---
[INFO] Writing manifest: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/classes/META-INF/MANIFEST.MF>
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 2 resources from src/test/resources to target/test-classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/test-classes
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ struts2-jasperreports7-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 1 source file with javac [debug release 17] to target/test-classes
[INFO]
[INFO] --- surefire:3.5.5:test (default-test) @ struts2-jasperreports7-plugin ---
[INFO] Using configured provider org.apache.maven.surefire.junitcore.JUnitCoreProvider
[INFO]
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
Standard Commons Logging discovery in action with spring-jcl: please remove commons-logging.jar from classpath in order to avoid potential conflicts
[WARN ] util.DebugUtils (DebugUtils.java:50) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getReportParameters()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getDatasource()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 8.917 s -- in org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0
[INFO]
[INFO]
[INFO] --- apache-rat:0.17:check (default) @ struts2-jasperreports7-plugin ---
[WARNING] Basedir is : <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7>
[INFO] Excluding patterns: CLAUDE.md, CODEOWNERS, SECURITY.md, **/README.md, src/main/resources/*-LICENSE.txt, src/site/resources/tags/**/*.html, src/test/resources/**/*.txt, src/main/resources/org/apache/struts2/static/domTT.js, src/main/webapp/**/*.css, src/main/webapp/**/*.map, src/main/webapp/**/*.js, src/main/webapp/**/*.svg, src/main/webapp/**/*.txt, **/src/main/resources/**/docs-urls.txt, src/etc/header.txt, src/main/resources/static/css/**/*.css, src/main/resources/static/js/**/*.js, **/src/main/resources/docs.cfg, src/main/webapp/fonts/**/*, thoughts/**/*.md, test-output/**
[INFO] Excluding ALL collection.
[INFO] Excluding MAVEN collection.
[INFO] Excluding ECLIPSE collection.
[INFO] Excluding IDEA collection.
[INFO] Processing exclude file from STANDARD_SCMS.
[INFO] Excluding STANDARD_SCMS collection.
[INFO] Excluding MISC collection.
[INFO] Excluding HIDDEN_DIR collection.
[INFO] RAT summary:
[INFO] Approved: 17
[INFO] Archives: 0
[INFO] Binaries: 0
[INFO] Document types: 3
[INFO] Ignored: 2
[INFO] License categories: 1
[INFO] License names: 1
[INFO] Notices: 2
[INFO] Standards: 17
[INFO] Unapproved: 0
[INFO] Unknown: 0
[INFO]
[INFO] --- jar:3.3.0:jar (default-jar) @ struts2-jasperreports7-plugin ---
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/struts2-jasperreports7-plugin-7.2.0-SNAPSHOT.jar>
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (attach-descriptor) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (site-inheritance) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- dependency-check:12.2.0:check (default) @ struts2-jasperreports7-plugin ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (272 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (3 seconds)
[INFO] Finished CPE Analyzer (3 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2011-5057, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0391, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0392, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0393, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0394, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,CVE-2017-1000487,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (4 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL]:
jasperreports-7.0.4.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.4, cpe:2.3:a:cloud:jasperreports_library:7.0.4:*:*:*:*:*:*:*) : CVE-2025-10492
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 7.2.0-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... SUCCESS [01:02 min]
[INFO] Struts BOM ......................................... SUCCESS [ 3.690 s]
[INFO] Struts Parent POM .................................. SUCCESS [ 3.667 s]
[INFO] Struts 2 Jakarta EE Compatible modules ............. SUCCESS [ 3.249 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools View . SUCCESS [ 13.424 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp .. SUCCESS [ 7.122 s]
[INFO] Struts 2 Core ...................................... SUCCESS [03:25 min]
[INFO] Struts 2 Plugins ................................... SUCCESS [ 5.264 s]
[INFO] Struts 2 Async Plugin .............................. SUCCESS [ 5.550 s]
[INFO] Struts 2 Bean Validation Plugin .................... SUCCESS [ 9.149 s]
[INFO] Struts 2 CDI Plugin ................................ SUCCESS [ 9.839 s]
[INFO] Struts 2 Spring Plugin ............................. SUCCESS [ 16.202 s]
[INFO] Struts 2 JUnit Plugin .............................. SUCCESS [ 12.346 s]
[INFO] Struts 2 Velocity Plugin ........................... SUCCESS [ 12.960 s]
[INFO] Struts 2 Configuration Browser Plugin .............. SUCCESS [ 5.056 s]
[INFO] Struts 2 Convention Plugin ......................... SUCCESS [ 17.590 s]
[INFO] Struts 2 Jasper Reports Plugin ..................... SUCCESS [ 11.607 s]
[INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] .... FAILURE [ 21.642 s]
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 07:09 min
[INFO] Finished at: 2026-03-22T06:46:24Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.0:check (default) on project struts2-jasperreports7-plugin:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] jasperreports-7.0.4.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.4, cpe:2.3:a:cloud:jasperreports_library:7.0.4:*:*:*:*:*:*:*): CVE-2025-10492(8.7)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :struts2-jasperreports7-plugin
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-dependency-check #252
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/252/display/redirect?page=changes>
Changes:
[github] build(deps-dev): bump org.apache.maven.plugins:maven-failsafe-plugin (#1595)
[github] build(deps): bump maven-surefire-plugin.version from 3.5.4 to 3.5.5 (#1596)
[github] build(deps): bump com.fasterxml.jackson:jackson-bom (#1597)
[github] fix(core): correct isMethodSpecified() for wildcard-resolved methods (#1592)
------------------------------------------
[...truncated 929.10 KiB...]
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (232 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports/target/dependency-check-report.html>
[INFO]
[INFO] ----------< org.apache.struts:struts2-jasperreports7-plugin >-----------
[INFO] Building Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] 7.2.0-SNAPSHOT [18/29]
[INFO] from plugins/jasperreports7/pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce) @ struts2-jasperreports7-plugin ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence passed
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce-maven-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce-java-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- remote-resources:3.1.0:process (process-resource-bundles) @ struts2-jasperreports7-plugin ---
[INFO] Preparing remote bundle org.apache.apache.resources:apache-jar-resource-bundle:1.5
[INFO] Copying 3 resources from 1 bundle.
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 3 resources from src/main/resources to target/classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ struts2-jasperreports7-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 12 source files with javac [debug release 17] to target/classes
[INFO]
[INFO] --- bundle:6.0.0:manifest (bundle-manifest) @ struts2-jasperreports7-plugin ---
[INFO] Writing manifest: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/classes/META-INF/MANIFEST.MF>
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 2 resources from src/test/resources to target/test-classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/test-classes
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ struts2-jasperreports7-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 1 source file with javac [debug release 17] to target/test-classes
[INFO]
[INFO] --- surefire:3.5.5:test (default-test) @ struts2-jasperreports7-plugin ---
[INFO] Using configured provider org.apache.maven.surefire.junitcore.JUnitCoreProvider
[INFO]
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
Standard Commons Logging discovery in action with spring-jcl: please remove commons-logging.jar from classpath in order to avoid potential conflicts
[WARN ] util.DebugUtils (DebugUtils.java:50) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getReportParameters()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getDatasource()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 8.214 s -- in org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0
[INFO]
[INFO]
[INFO] --- apache-rat:0.17:check (default) @ struts2-jasperreports7-plugin ---
[WARNING] Basedir is : <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7>
[INFO] Excluding patterns: CLAUDE.md, CODEOWNERS, SECURITY.md, **/README.md, src/main/resources/*-LICENSE.txt, src/site/resources/tags/**/*.html, src/test/resources/**/*.txt, src/main/resources/org/apache/struts2/static/domTT.js, src/main/webapp/**/*.css, src/main/webapp/**/*.map, src/main/webapp/**/*.js, src/main/webapp/**/*.svg, src/main/webapp/**/*.txt, **/src/main/resources/**/docs-urls.txt, src/etc/header.txt, src/main/resources/static/css/**/*.css, src/main/resources/static/js/**/*.js, **/src/main/resources/docs.cfg, src/main/webapp/fonts/**/*, thoughts/**/*.md, test-output/**
[INFO] Excluding ALL collection.
[INFO] Excluding MAVEN collection.
[INFO] Excluding ECLIPSE collection.
[INFO] Excluding IDEA collection.
[INFO] Processing exclude file from STANDARD_SCMS.
[INFO] Excluding STANDARD_SCMS collection.
[INFO] Excluding MISC collection.
[INFO] Excluding HIDDEN_DIR collection.
[INFO] RAT summary:
[INFO] Approved: 17
[INFO] Archives: 0
[INFO] Binaries: 0
[INFO] Document types: 3
[INFO] Ignored: 2
[INFO] License categories: 1
[INFO] License names: 1
[INFO] Notices: 2
[INFO] Standards: 17
[INFO] Unapproved: 0
[INFO] Unknown: 0
[INFO]
[INFO] --- jar:3.3.0:jar (default-jar) @ struts2-jasperreports7-plugin ---
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/struts2-jasperreports7-plugin-7.2.0-SNAPSHOT.jar>
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (attach-descriptor) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (site-inheritance) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- dependency-check:12.2.0:check (default) @ struts2-jasperreports7-plugin ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (278 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2011-5057, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0391, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0392, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0393, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0394, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,CVE-2017-1000487,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL]:
jasperreports-7.0.3.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.3, cpe:2.3:a:cloud:jasperreports_library:7.0.3:*:*:*:*:*:*:*) : CVE-2025-10492
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 7.2.0-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... SUCCESS [ 16.214 s]
[INFO] Struts BOM ......................................... SUCCESS [ 4.503 s]
[INFO] Struts Parent POM .................................. SUCCESS [ 3.912 s]
[INFO] Struts 2 Jakarta EE Compatible modules ............. SUCCESS [ 3.430 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools View . SUCCESS [ 9.486 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp .. SUCCESS [ 5.573 s]
[INFO] Struts 2 Core ...................................... SUCCESS [02:46 min]
[INFO] Struts 2 Plugins ................................... SUCCESS [ 5.445 s]
[INFO] Struts 2 Async Plugin .............................. SUCCESS [ 5.478 s]
[INFO] Struts 2 Bean Validation Plugin .................... SUCCESS [ 8.725 s]
[INFO] Struts 2 CDI Plugin ................................ SUCCESS [ 5.634 s]
[INFO] Struts 2 Spring Plugin ............................. SUCCESS [ 11.452 s]
[INFO] Struts 2 JUnit Plugin .............................. SUCCESS [ 9.215 s]
[INFO] Struts 2 Velocity Plugin ........................... SUCCESS [ 10.180 s]
[INFO] Struts 2 Configuration Browser Plugin .............. SUCCESS [ 4.413 s]
[INFO] Struts 2 Convention Plugin ......................... SUCCESS [ 16.026 s]
[INFO] Struts 2 Jasper Reports Plugin ..................... SUCCESS [ 10.227 s]
[INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] .... FAILURE [ 14.694 s]
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 05:12 min
[INFO] Finished at: 2026-03-01T06:44:23Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.0:check (default) on project struts2-jasperreports7-plugin:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] jasperreports-7.0.3.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.3, cpe:2.3:a:cloud:jasperreports_library:7.0.3:*:*:*:*:*:*:*): CVE-2025-10492(8.7)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :struts2-jasperreports7-plugin
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-dependency-check #251
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/251/display/redirect?page=changes>
Changes:
[github] chore: updates SNAPSHOT version to reflect current scope of changes (#1563)
[github] docs: streamline CLAUDE.md for clarity and conciseness (#1568)
[github] feat(conversion): WW-4291 allow Spring bean names for type converters (#1562)
[github] build(deps): bump github/codeql-action from 4.32.0 to 4.32.1 (#1566)
[github] fix(spring): WW-3647 change autowire alwaysRespect default to true (#1571)
[git] WW-5614 Remove cache for ProxyUtil#ultimateTargetClass
[github] build(deps): bump github/codeql-action from 4.32.1 to 4.32.2 (#1574)
[github] build(deps): bump org.apache.maven.plugins:maven-dependency-plugin (#1575)
[github] WW-5613 build(deps): bump ognl:ognl from 3.4.8 to 3.4.10 (#1567)
[github] feat(security): WW-5294 add warning when JSP tags accessed directly (#1569)
[github] feat(ui): WW-3429 add configurable checkbox hidden field prefix (#1570)
[github] build(deps-dev): bump byte-buddy.version from 1.18.4 to 1.18.5 (#1583)
[github] build(deps): bump github/codeql-action from 4.32.2 to 4.32.3 (#1580)
[github] build(deps): bump org.apache.commons:commons-fileupload2-jakarta-servlet6 (#1584)
[github] conf(git): Ignores Cursor related paths (#1585)
[github] build(deps): bump org.springframework:spring-framework-bom (#1581)
[Lukasz Lenart] ci: use wildcard to exclude all Spring dependencies from 6.x updates
[github] build(deps): bump github/codeql-action from 4.32.3 to 4.32.4 (#1589)
[github] build(deps): bump org.springframework:spring-framework-bom (#1588)
[github] fix(convention): WW-4421 detect duplicate @Action names when execute() is annotated (#1579)
[github] WW-5514 Add StrutsProxyService for proxy detection and resolution (#1586)
------------------------------------------
[...truncated 936.37 KiB...]
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (259 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (1 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (1 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports/target/dependency-check-report.html>
[INFO]
[INFO] ----------< org.apache.struts:struts2-jasperreports7-plugin >-----------
[INFO] Building Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] 7.2.0-SNAPSHOT [18/29]
[INFO] from plugins/jasperreports7/pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce) @ struts2-jasperreports7-plugin ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence passed
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce-maven-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce-java-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- remote-resources:3.1.0:process (process-resource-bundles) @ struts2-jasperreports7-plugin ---
[INFO] Preparing remote bundle org.apache.apache.resources:apache-jar-resource-bundle:1.5
[INFO] Copying 3 resources from 1 bundle.
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 3 resources from src/main/resources to target/classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ struts2-jasperreports7-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 12 source files with javac [debug release 17] to target/classes
[INFO]
[INFO] --- bundle:6.0.0:manifest (bundle-manifest) @ struts2-jasperreports7-plugin ---
[INFO] Writing manifest: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/classes/META-INF/MANIFEST.MF>
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 2 resources from src/test/resources to target/test-classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/test-classes
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ struts2-jasperreports7-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 1 source file with javac [debug release 17] to target/test-classes
[INFO]
[INFO] --- surefire:3.5.4:test (default-test) @ struts2-jasperreports7-plugin ---
[INFO] Using configured provider org.apache.maven.surefire.junitcore.JUnitCoreProvider
[INFO]
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
Standard Commons Logging discovery in action with spring-jcl: please remove commons-logging.jar from classpath in order to avoid potential conflicts
[WARN ] util.DebugUtils (DebugUtils.java:50) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getReportParameters()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getDatasource()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 8.368 s -- in org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0
[INFO]
[INFO]
[INFO] --- apache-rat:0.17:check (default) @ struts2-jasperreports7-plugin ---
[WARNING] Basedir is : <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7>
[INFO] Excluding patterns: CLAUDE.md, CODEOWNERS, SECURITY.md, **/README.md, src/main/resources/*-LICENSE.txt, src/site/resources/tags/**/*.html, src/test/resources/**/*.txt, src/main/resources/org/apache/struts2/static/domTT.js, src/main/webapp/**/*.css, src/main/webapp/**/*.map, src/main/webapp/**/*.js, src/main/webapp/**/*.svg, src/main/webapp/**/*.txt, **/src/main/resources/**/docs-urls.txt, src/etc/header.txt, src/main/resources/static/css/**/*.css, src/main/resources/static/js/**/*.js, **/src/main/resources/docs.cfg, src/main/webapp/fonts/**/*, thoughts/**/*.md, test-output/**
[INFO] Excluding ALL collection.
[INFO] Excluding MAVEN collection.
[INFO] Excluding ECLIPSE collection.
[INFO] Excluding IDEA collection.
[INFO] Processing exclude file from STANDARD_SCMS.
[INFO] Excluding STANDARD_SCMS collection.
[INFO] Excluding MISC collection.
[INFO] Excluding HIDDEN_DIR collection.
[INFO] RAT summary:
[INFO] Approved: 17
[INFO] Archives: 0
[INFO] Binaries: 0
[INFO] Document types: 3
[INFO] Ignored: 2
[INFO] License categories: 1
[INFO] License names: 1
[INFO] Notices: 2
[INFO] Standards: 17
[INFO] Unapproved: 0
[INFO] Unknown: 0
[INFO]
[INFO] --- jar:3.3.0:jar (default-jar) @ struts2-jasperreports7-plugin ---
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/struts2-jasperreports7-plugin-7.2.0-SNAPSHOT.jar>
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (attach-descriptor) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (site-inheritance) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- dependency-check:12.2.0:check (default) @ struts2-jasperreports7-plugin ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (283 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (2 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2011-5057, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0391, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0392, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0393, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0394, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,CVE-2017-1000487,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (3 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL]:
jasperreports-7.0.3.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.3, cpe:2.3:a:cloud:jasperreports_library:7.0.3:*:*:*:*:*:*:*) : CVE-2025-10492
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 7.2.0-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... SUCCESS [ 44.814 s]
[INFO] Struts BOM ......................................... SUCCESS [ 4.358 s]
[INFO] Struts Parent POM .................................. SUCCESS [ 3.510 s]
[INFO] Struts 2 Jakarta EE Compatible modules ............. SUCCESS [ 3.403 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools View . SUCCESS [ 10.988 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp .. SUCCESS [ 6.725 s]
[INFO] Struts 2 Core ...................................... SUCCESS [02:54 min]
[INFO] Struts 2 Plugins ................................... SUCCESS [ 5.122 s]
[INFO] Struts 2 Async Plugin .............................. SUCCESS [ 5.158 s]
[INFO] Struts 2 Bean Validation Plugin .................... SUCCESS [ 8.770 s]
[INFO] Struts 2 CDI Plugin ................................ SUCCESS [ 6.667 s]
[INFO] Struts 2 Spring Plugin ............................. SUCCESS [ 11.256 s]
[INFO] Struts 2 JUnit Plugin .............................. SUCCESS [ 9.221 s]
[INFO] Struts 2 Velocity Plugin ........................... SUCCESS [ 10.463 s]
[INFO] Struts 2 Configuration Browser Plugin .............. SUCCESS [ 4.054 s]
[INFO] Struts 2 Convention Plugin ......................... SUCCESS [ 15.889 s]
[INFO] Struts 2 Jasper Reports Plugin ..................... SUCCESS [ 10.033 s]
[INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] .... FAILURE [ 15.954 s]
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 05:53 min
[INFO] Finished at: 2026-02-22T06:45:05Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.0:check (default) on project struts2-jasperreports7-plugin:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] jasperreports-7.0.3.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.3, cpe:2.3:a:cloud:jasperreports_library:7.0.3:*:*:*:*:*:*:*): CVE-2025-10492(8.7)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :struts2-jasperreports7-plugin
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-dependency-check #250
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/250/display/redirect?page=changes>
Changes:
[github] fix(core): move xwork-default.xml to test resources (#1513)
[github] chore(deps): excludes org.apache.tomcat:tomcat-api for Struts 6.x (#1548)
[github] build(deps): bump com.fasterxml.jackson:jackson-bom (#1545)
[github] build(deps): bump org.assertj:assertj-core from 3.27.6 to 3.27.7 (#1552)
[github] build(deps): bump org.testng:testng from 7.11.0 to 7.12.0 (#1553)
[github] build(deps): bump github/codeql-action from 4.31.10 to 4.31.11 (#1551)
[github] fix(conf): drops deprecated del_branch_on_merge (#1555)
[github] build(deps): bump github/codeql-action from 4.31.11 to 4.32.0 (#1556)
[github] build(deps): excludes upgrading Tomcat 11 libraries (#1559)
[github] WW-5536 Bump ognl:ognl from 3.3.5 to 3.4.8 (#1405)
------------------------------------------
[...truncated 924.37 KiB...]
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (370 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (2 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports/target/dependency-check-report.html>
[INFO]
[INFO] ----------< org.apache.struts:struts2-jasperreports7-plugin >-----------
[INFO] Building Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] 7.1.2-SNAPSHOT [18/29]
[INFO] from plugins/jasperreports7/pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce) @ struts2-jasperreports7-plugin ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence passed
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce-maven-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce-java-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- remote-resources:3.1.0:process (process-resource-bundles) @ struts2-jasperreports7-plugin ---
[INFO] Preparing remote bundle org.apache.apache.resources:apache-jar-resource-bundle:1.5
[INFO] Copying 3 resources from 1 bundle.
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 3 resources from src/main/resources to target/classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ struts2-jasperreports7-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 12 source files with javac [debug release 17] to target/classes
[INFO]
[INFO] --- bundle:6.0.0:manifest (bundle-manifest) @ struts2-jasperreports7-plugin ---
[INFO] Writing manifest: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/classes/META-INF/MANIFEST.MF>
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 2 resources from src/test/resources to target/test-classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/test-classes
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ struts2-jasperreports7-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 1 source file with javac [debug release 17] to target/test-classes
[INFO]
[INFO] --- surefire:3.5.4:test (default-test) @ struts2-jasperreports7-plugin ---
[INFO] Using configured provider org.apache.maven.surefire.junitcore.JUnitCoreProvider
[INFO]
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
Standard Commons Logging discovery in action with spring-jcl: please remove commons-logging.jar from classpath in order to avoid potential conflicts
[WARN ] util.DebugUtils (DebugUtils.java:50) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getReportParameters()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getDatasource()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 9.001 s -- in org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0
[INFO]
[INFO]
[INFO] --- apache-rat:0.17:check (default) @ struts2-jasperreports7-plugin ---
[WARNING] Basedir is : <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7>
[INFO] Excluding patterns: CLAUDE.md, CODEOWNERS, SECURITY.md, **/README.md, src/main/resources/*-LICENSE.txt, src/site/resources/tags/**/*.html, src/test/resources/**/*.txt, src/main/resources/org/apache/struts2/static/domTT.js, src/main/webapp/**/*.css, src/main/webapp/**/*.map, src/main/webapp/**/*.js, src/main/webapp/**/*.svg, src/main/webapp/**/*.txt, **/src/main/resources/**/docs-urls.txt, src/etc/header.txt, src/main/resources/static/css/**/*.css, src/main/resources/static/js/**/*.js, **/src/main/resources/docs.cfg, src/main/webapp/fonts/**/*, thoughts/**/*.md, test-output/**
[INFO] Excluding ALL collection.
[INFO] Excluding MAVEN collection.
[INFO] Excluding ECLIPSE collection.
[INFO] Excluding IDEA collection.
[INFO] Processing exclude file from STANDARD_SCMS.
[INFO] Excluding STANDARD_SCMS collection.
[INFO] Excluding MISC collection.
[INFO] Excluding HIDDEN_DIR collection.
[INFO] RAT summary:
[INFO] Approved: 17
[INFO] Archives: 0
[INFO] Binaries: 0
[INFO] Document types: 3
[INFO] Ignored: 2
[INFO] License categories: 1
[INFO] License names: 1
[INFO] Notices: 2
[INFO] Standards: 17
[INFO] Unapproved: 0
[INFO] Unknown: 0
[INFO]
[INFO] --- jar:3.3.0:jar (default-jar) @ struts2-jasperreports7-plugin ---
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/struts2-jasperreports7-plugin-7.1.2-SNAPSHOT.jar>
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (attach-descriptor) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (site-inheritance) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- dependency-check:12.2.0:check (default) @ struts2-jasperreports7-plugin ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (246 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2011-5057, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0391, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0392, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0393, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0394, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,CVE-2017-1000487,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL]:
jasperreports-7.0.3.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.3, cpe:2.3:a:cloud:jasperreports_library:7.0.3:*:*:*:*:*:*:*) : CVE-2025-10492
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 7.1.2-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... SUCCESS [ 40.749 s]
[INFO] Struts BOM ......................................... SUCCESS [ 4.547 s]
[INFO] Struts Parent POM .................................. SUCCESS [ 4.542 s]
[INFO] Struts 2 Jakarta EE Compatible modules ............. SUCCESS [ 4.288 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools View . SUCCESS [ 11.699 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp .. SUCCESS [ 6.016 s]
[INFO] Struts 2 Core ...................................... SUCCESS [02:49 min]
[INFO] Struts 2 Plugins ................................... SUCCESS [ 5.070 s]
[INFO] Struts 2 Async Plugin .............................. SUCCESS [ 5.351 s]
[INFO] Struts 2 Bean Validation Plugin .................... SUCCESS [ 8.333 s]
[INFO] Struts 2 CDI Plugin ................................ SUCCESS [ 6.302 s]
[INFO] Struts 2 Spring Plugin ............................. SUCCESS [ 10.568 s]
[INFO] Struts 2 JUnit Plugin .............................. SUCCESS [ 9.300 s]
[INFO] Struts 2 Velocity Plugin ........................... SUCCESS [ 10.101 s]
[INFO] Struts 2 Configuration Browser Plugin .............. SUCCESS [ 4.227 s]
[INFO] Struts 2 Convention Plugin ......................... SUCCESS [ 16.789 s]
[INFO] Struts 2 Jasper Reports Plugin ..................... SUCCESS [ 11.104 s]
[INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] .... FAILURE [ 19.004 s]
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 05:49 min
[INFO] Finished at: 2026-02-01T06:45:00Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.0:check (default) on project struts2-jasperreports7-plugin:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] jasperreports-7.0.3.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.3, cpe:2.3:a:cloud:jasperreports_library:7.0.3:*:*:*:*:*:*:*): CVE-2025-10492(8.7)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :struts2-jasperreports7-plugin
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-dependency-check #249
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/249/display/redirect?page=changes>
Changes:
[github] chore(deps): excludes javax.portlet:portlet-api
[github] chore(deps): excludes javax.servlet:javax.servlet-api
[github] chore(deps): excludes javax.servlet.jsp:jsp-api
[github] chore(deps): excludes org.mortbay.jetty:jsp-2.1
[github] build(deps): bump org.owasp:dependency-check-maven from 12.1.9 to 12.2.0 (#1518)
[github] build(deps): bump github/codeql-action from 4.31.9 to 4.31.10 (#1521)
[github] WW-5602 Fix StreamResult contentCharSet handling and refactor for extensibility (#1510)
[github] Ignores incompatible dependencies with Struts 6.x (#1526)
[github] build(deps-dev): bump weld.version from 6.0.3.Final to 6.0.4.Final (#1530)
[github] Ignores some dependencies for update in 6.x (#1533)
[github] build(deps): bump org.apache.juneau:juneau-marshall from 8.1.3 to 9.2.0 (#1512)
[github] build(deps-dev): bump byte-buddy.version from 1.18.3 to 1.18.4 (#1537)
[github] build(deps-dev): bump org.codehaus.mojo:versions-maven-plugin (#1538)
[github] build(deps): bump org.springframework:spring-framework-bom (#1540)
[github] Excludes some dependencies from upgrade in 6.x (#1541)
------------------------------------------
[...truncated 935.55 KiB...]
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (260 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (1 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (1 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports/target/dependency-check-report.html>
[INFO]
[INFO] ----------< org.apache.struts:struts2-jasperreports7-plugin >-----------
[INFO] Building Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] 7.1.2-SNAPSHOT [18/29]
[INFO] from plugins/jasperreports7/pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce) @ struts2-jasperreports7-plugin ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence passed
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce-maven-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce-java-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- remote-resources:3.1.0:process (process-resource-bundles) @ struts2-jasperreports7-plugin ---
[INFO] Preparing remote bundle org.apache.apache.resources:apache-jar-resource-bundle:1.5
[INFO] Copying 3 resources from 1 bundle.
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 3 resources from src/main/resources to target/classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ struts2-jasperreports7-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 12 source files with javac [debug release 17] to target/classes
[INFO]
[INFO] --- bundle:6.0.0:manifest (bundle-manifest) @ struts2-jasperreports7-plugin ---
[INFO] Writing manifest: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/classes/META-INF/MANIFEST.MF>
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 2 resources from src/test/resources to target/test-classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/test-classes
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ struts2-jasperreports7-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 1 source file with javac [debug release 17] to target/test-classes
[INFO]
[INFO] --- surefire:3.5.4:test (default-test) @ struts2-jasperreports7-plugin ---
[INFO] Using configured provider org.apache.maven.surefire.junitcore.JUnitCoreProvider
[INFO]
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
Standard Commons Logging discovery in action with spring-jcl: please remove commons-logging.jar from classpath in order to avoid potential conflicts
[WARN ] util.DebugUtils (DebugUtils.java:50) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getReportParameters()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getDatasource()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 8.327 s -- in org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0
[INFO]
[INFO]
[INFO] --- apache-rat:0.17:check (default) @ struts2-jasperreports7-plugin ---
[WARNING] Basedir is : <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7>
[INFO] Excluding patterns: CLAUDE.md, CODEOWNERS, SECURITY.md, **/README.md, src/main/resources/*-LICENSE.txt, src/site/resources/tags/**/*.html, src/test/resources/**/*.txt, src/main/resources/org/apache/struts2/static/domTT.js, src/main/webapp/**/*.css, src/main/webapp/**/*.map, src/main/webapp/**/*.js, src/main/webapp/**/*.svg, src/main/webapp/**/*.txt, **/src/main/resources/**/docs-urls.txt, src/etc/header.txt, src/main/resources/static/css/**/*.css, src/main/resources/static/js/**/*.js, **/src/main/resources/docs.cfg, src/main/webapp/fonts/**/*, thoughts/**/*.md, test-output/**
[INFO] Excluding ALL collection.
[INFO] Excluding MAVEN collection.
[INFO] Excluding ECLIPSE collection.
[INFO] Excluding IDEA collection.
[INFO] Processing exclude file from STANDARD_SCMS.
[INFO] Excluding STANDARD_SCMS collection.
[INFO] Excluding MISC collection.
[INFO] Excluding HIDDEN_DIR collection.
[INFO] RAT summary:
[INFO] Approved: 17
[INFO] Archives: 0
[INFO] Binaries: 0
[INFO] Document types: 3
[INFO] Ignored: 2
[INFO] License categories: 1
[INFO] License names: 1
[INFO] Notices: 2
[INFO] Standards: 17
[INFO] Unapproved: 0
[INFO] Unknown: 0
[INFO]
[INFO] --- jar:3.3.0:jar (default-jar) @ struts2-jasperreports7-plugin ---
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/struts2-jasperreports7-plugin-7.1.2-SNAPSHOT.jar>
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (attach-descriptor) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (site-inheritance) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- dependency-check:12.2.0:check (default) @ struts2-jasperreports7-plugin ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (284 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2011-5057, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0391, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0392, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0393, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0394, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,CVE-2017-1000487,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL]:
jasperreports-7.0.3.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.3, cpe:2.3:a:cloud:jasperreports_library:7.0.3:*:*:*:*:*:*:*) : CVE-2025-10492
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 7.1.2-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... SUCCESS [ 32.859 s]
[INFO] Struts BOM ......................................... SUCCESS [ 3.736 s]
[INFO] Struts Parent POM .................................. SUCCESS [ 3.354 s]
[INFO] Struts 2 Jakarta EE Compatible modules ............. SUCCESS [ 3.217 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools View . SUCCESS [ 10.230 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp .. SUCCESS [ 5.523 s]
[INFO] Struts 2 Core ...................................... SUCCESS [02:40 min]
[INFO] Struts 2 Plugins ................................... SUCCESS [ 4.742 s]
[INFO] Struts 2 Async Plugin .............................. SUCCESS [ 4.871 s]
[INFO] Struts 2 Bean Validation Plugin .................... SUCCESS [ 8.519 s]
[INFO] Struts 2 CDI Plugin ................................ SUCCESS [ 6.833 s]
[INFO] Struts 2 Spring Plugin ............................. SUCCESS [ 11.464 s]
[INFO] Struts 2 JUnit Plugin .............................. SUCCESS [ 10.189 s]
[INFO] Struts 2 Velocity Plugin ........................... SUCCESS [ 10.142 s]
[INFO] Struts 2 Configuration Browser Plugin .............. SUCCESS [ 3.835 s]
[INFO] Struts 2 Convention Plugin ......................... SUCCESS [ 15.084 s]
[INFO] Struts 2 Jasper Reports Plugin ..................... SUCCESS [ 11.642 s]
[INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] .... FAILURE [ 15.030 s]
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 05:23 min
[INFO] Finished at: 2026-01-22T06:44:36Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.0:check (default) on project struts2-jasperreports7-plugin:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] jasperreports-7.0.3.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.3, cpe:2.3:a:cloud:jasperreports_library:7.0.3:*:*:*:*:*:*:*): CVE-2025-10492(8.7)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :struts2-jasperreports7-plugin
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3
Build failed in Jenkins: Struts » Struts-master-dependency-check #248
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/248/display/redirect?page=changes>
Changes:
[github] Fix Textfield tag not allowing white space. See WW-5592. (#1489)
[github] build(deps): bump github/codeql-action from 4.31.8 to 4.31.9 (#1481)
[github] build(deps): bump org.apache.logging.log4j:log4j-bom (#1482)
[github] build(deps): bump asm.version from 9.9 to 9.9.1 (#1483)
[github] build(deps): bump commons-io:commons-io from 2.20.0 to 2.21.0 (#1474)
[github] build(deps-dev): bump commons-validator:commons-validator (#1490)
[github] build(deps-dev): bump byte-buddy.version from 1.18.2 to 1.18.3 (#1491)
[github] chore(deps): ignore incompatible updates for release/struts-6-8-x (#1497)
[github] build(deps): bump org.springframework:spring-framework-bom (#1475)
[github] build(deps): bump org.apache.maven.plugins:maven-source-plugin (#1502)
[github] build(deps): bump org.codehaus.mojo:exec-maven-plugin (#1503)
[github] build(deps): bump org.htmlunit:htmlunit from 4.17.0 to 4.21.0 (#1504)
------------------------------------------
[...truncated 889.57 KiB...]
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (303 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (1 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (1 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports/target/dependency-check-report.html>
[INFO]
[INFO] ----------< org.apache.struts:struts2-jasperreports7-plugin >-----------
[INFO] Building Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] 7.1.2-SNAPSHOT [18/29]
[INFO] from plugins/jasperreports7/pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce) @ struts2-jasperreports7-plugin ---
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence passed
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce-maven-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- enforcer:3.6.2:enforce (enforce-java-version) @ struts2-jasperreports7-plugin ---
[INFO]
[INFO] --- remote-resources:3.1.0:process (process-resource-bundles) @ struts2-jasperreports7-plugin ---
[INFO] Preparing remote bundle org.apache.apache.resources:apache-jar-resource-bundle:1.5
[INFO] Copying 3 resources from 1 bundle.
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 3 resources from src/main/resources to target/classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/classes
[INFO]
[INFO] --- compiler:3.11.0:compile (default-compile) @ struts2-jasperreports7-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 12 source files with javac [debug release 17] to target/classes
[INFO]
[INFO] --- bundle:6.0.0:manifest (bundle-manifest) @ struts2-jasperreports7-plugin ---
[INFO] Writing manifest: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/classes/META-INF/MANIFEST.MF>
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ struts2-jasperreports7-plugin ---
[INFO] Copying 2 resources from src/test/resources to target/test-classes
[INFO] Copying 3 resources from target/maven-shared-archive-resources to target/test-classes
[INFO]
[INFO] --- compiler:3.11.0:testCompile (default-testCompile) @ struts2-jasperreports7-plugin ---
[INFO] Changes detected - recompiling the module! :dependency
[INFO] Compiling 1 source file with javac [debug release 17] to target/test-classes
[INFO]
[INFO] --- surefire:3.5.4:test (default-test) @ struts2-jasperreports7-plugin ---
[INFO] Using configured provider org.apache.maven.surefire.junitcore.JUnitCoreProvider
[INFO]
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
Standard Commons Logging discovery in action with spring-jcl: please remove commons-logging.jar from classpath in order to avoid potential conflicts
[WARN ] util.DebugUtils (DebugUtils.java:50) - OGNL allowlist is disabled! We strongly recommend keeping it enabled to protect against critical vulnerabilities. Set the configuration `struts.allowlist.enable=true` to enable it. Please refer to the Struts 7.0 migration guide and security documentation for further information.
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getReportParameters()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[WARN ] jasperreports7.JasperReport7Result (JasperReport7Result.java:346) - Expression [getDatasource()] isn't allowed by pattern [[\w+((\.\w+)|(\[\d+])|(\(\d+\))|(\['(\w-?|[\u4e00-\u9fa5]-?)+'])|(\('(\w-?|[\u4e00-\u9fa5]-?)+'\)))*]]! See Accepted / Excluded patterns at
https://struts.apache.org/security/
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 8.224 s -- in org.apache.struts2.views.jasperreports7.JasperReport7ResultTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 12, Failures: 0, Errors: 0, Skipped: 0
[INFO]
[INFO]
[INFO] --- apache-rat:0.17:check (default) @ struts2-jasperreports7-plugin ---
[WARNING] Basedir is : <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7>
[INFO] Excluding patterns: CLAUDE.md, CODEOWNERS, SECURITY.md, **/README.md, src/main/resources/*-LICENSE.txt, src/site/resources/tags/**/*.html, src/test/resources/**/*.txt, src/main/resources/org/apache/struts2/static/domTT.js, src/main/webapp/**/*.css, src/main/webapp/**/*.map, src/main/webapp/**/*.js, src/main/webapp/**/*.svg, src/main/webapp/**/*.txt, **/src/main/resources/**/docs-urls.txt, src/etc/header.txt, src/main/resources/static/css/**/*.css, src/main/resources/static/js/**/*.js, **/src/main/resources/docs.cfg, src/main/webapp/fonts/**/*, thoughts/**/*.md, test-output/**
[INFO] Excluding ALL collection.
[INFO] Excluding MAVEN collection.
[INFO] Excluding ECLIPSE collection.
[INFO] Excluding IDEA collection.
[INFO] Processing exclude file from STANDARD_SCMS.
[INFO] Excluding STANDARD_SCMS collection.
[INFO] Excluding MISC collection.
[INFO] Excluding HIDDEN_DIR collection.
[INFO] RAT summary:
[INFO] Approved: 17
[INFO] Archives: 0
[INFO] Binaries: 0
[INFO] Document types: 3
[INFO] Ignored: 2
[INFO] License categories: 1
[INFO] License names: 1
[INFO] Notices: 2
[INFO] Standards: 17
[INFO] Unapproved: 0
[INFO] Unknown: 0
[INFO]
[INFO] --- jar:3.3.0:jar (default-jar) @ struts2-jasperreports7-plugin ---
[INFO] Building jar: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/struts2-jasperreports7-plugin-7.1.2-SNAPSHOT.jar>
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (attach-descriptor) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- site:3.21.0:attach-descriptor (site-inheritance) @ struts2-jasperreports7-plugin ---
[INFO] No site descriptor found: nothing to attach.
[INFO]
[INFO] --- dependency-check:12.1.9:check (default) @ struts2-jasperreports7-plugin ---
[INFO] Checking for updates
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
[INFO] Skipping Known Exploited Vulnerabilities update check since last check was within 24 hours.
[INFO] Check for updates complete (239 ms)
[INFO]
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user's risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
About ODC: https://dependency-check.github.io/DependencyCheck/general/internals.html
False Positives: https://dependency-check.github.io/DependencyCheck/general/suppression.html
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (2 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[WARNING] Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Known Exploited Vulnerability Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2011-5057, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0391, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0392, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0393, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0394, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2012-0838, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1965, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-1966, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2115, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2134, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2013-2135, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0094, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2014-0113, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2015-5169, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-0785, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-core@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-4003, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.apache\.struts/struts\-annotations@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{gav=PropertyType{value=^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:apache:struts, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/dom4j/dom4j@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2018-1000632, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.beanshell/bsh@.*$, regex=true, caseSensitive=false},vulnerabilityName={PropertyType{value=CVE-2016-2510, regex=false, caseSensitive=false},}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,CVE-2017-1000487,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$, regex=true, caseSensitive=false},cpe={PropertyType{value=cpe:/a:plexus-utils_project:plexus-utils, regex=false, caseSensitive=false},}cve={CVE-2022-4244,CVE-2022-4245,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/com\.google\.guava/guava@.*$, regex=true, caseSensitive=false},cve={CVE-2018-10237,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.yaml/snakeyaml@.*$, regex=true, caseSensitive=false},cve={CVE-2017-18640,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11022,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:javascript/jquery@.*$, regex=true, caseSensitive=false},cve={CVE-2020-11023,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.testng/testng@.*$, regex=true, caseSensitive=false},cve={CVE-2022-4065,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-.*@.*$, regex=true, caseSensitive=false},cve={CVE-2022-22965,CVE-2022-22950,CVE-2022-22968,CVE-2022-22970,}}
[INFO] Suppression Rule had zero matches: SuppressionRule{packageUrl=PropertyType{value=^pkg:maven/org\.springframework/spring\-web@.*$, regex=true, caseSensitive=false},cve={CVE-2016-1000027,}}
[INFO] Finished Unused Suppression Rule Analyzer (0 seconds)
[INFO] Analysis Complete (2 seconds)
[INFO] Writing HTML report to: <https://ci-builds.apache.org/job/Struts/job/Struts-master-dependency-check/ws/plugins/jasperreports7/target/dependency-check-report.html>
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL]:
jasperreports-7.0.3.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.3, cpe:2.3:a:cloud:jasperreports_library:7.0.3:*:*:*:*:*:*:*) : CVE-2025-10492
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 7.1.2-SNAPSHOT:
[INFO]
[INFO] Struts 2 ........................................... SUCCESS [ 26.900 s]
[INFO] Struts BOM ......................................... SUCCESS [ 4.092 s]
[INFO] Struts Parent POM .................................. SUCCESS [ 3.135 s]
[INFO] Struts 2 Jakarta EE Compatible modules ............. SUCCESS [ 2.778 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools View . SUCCESS [ 9.415 s]
[INFO] Struts 2 Jakarta EE Compatible Velocity Tools Jsp .. SUCCESS [ 5.230 s]
[INFO] Struts 2 Core ...................................... SUCCESS [02:16 min]
[INFO] Struts 2 Plugins ................................... SUCCESS [ 4.039 s]
[INFO] Struts 2 Async Plugin .............................. SUCCESS [ 5.885 s]
[INFO] Struts 2 Bean Validation Plugin .................... SUCCESS [ 8.377 s]
[INFO] Struts 2 CDI Plugin ................................ SUCCESS [ 6.036 s]
[INFO] Struts 2 Spring Plugin ............................. SUCCESS [ 11.546 s]
[INFO] Struts 2 JUnit Plugin .............................. SUCCESS [ 9.994 s]
[INFO] Struts 2 Velocity Plugin ........................... SUCCESS [ 10.486 s]
[INFO] Struts 2 Configuration Browser Plugin .............. SUCCESS [ 4.200 s]
[INFO] Struts 2 Convention Plugin ......................... SUCCESS [ 16.119 s]
[INFO] Struts 2 Jasper Reports Plugin ..................... SUCCESS [ 9.197 s]
[INFO] Struts 2 Jasper Reports 7 Plugin [EXPERIMENTAL] .... FAILURE [ 14.834 s]
[INFO] Struts 2 Java Templates Plugin ..................... SKIPPED
[INFO] Struts 2 JFreeChart Plugin ......................... SKIPPED
[INFO] Struts 2 JSON Plugin ............................... SKIPPED
[INFO] Struts 2 REST Plugin ............................... SKIPPED
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 Tiles Plugin .............................. SKIPPED
[INFO] Struts 2 XSLT Plugin ............................... SKIPPED
[INFO] Struts 2 Webapps ................................... SKIPPED
[INFO] Struts 2 Showcase Webapp ........................... SKIPPED
[INFO] Struts 2 Rest Showcase Webapp ...................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 04:50 min
[INFO] Finished at: 2026-01-01T06:44:01Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.1.9:check (default) on project struts2-jasperreports7-plugin:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] jasperreports-7.0.3.jar (pkg:maven/net.sf.jasperreports/jasperreports@7.0.3, cpe:2.3:a:cloud:jasperreports_library:7.0.3:*:*:*:*:*:*:*): CVE-2025-10492(8.7)
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <args> -rf :struts2-jasperreports7-plugin
Build step 'Execute shell' marked build as failure
ERROR: No tool found matching MAVEN_3_LATEST__HOME
Setting MAVEN_3_LATEST_HOME=/home/jenkins/tools/maven/latest3