You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by "Pankraz76 (via GitHub)" <gi...@apache.org> on 2025/08/17 17:26:02 UTC
[PR] Add `org.owasp.dependencycheck` [kafka]
Pankraz76 opened a new pull request, #20364:
URL: https://github.com/apache/kafka/pull/20364
Delete this text and replace it with a detailed description of your change. The
PR title and body will become the squashed commit message.
If you would like to tag individuals, add some commentary, upload images, or
include other supplemental information that should not be part of the eventual
commit message, please use a separate comment.
If applicable, please include a summary of the testing strategy (including
rationale) for the proposed change. Unit and/or integration tests are expected
for any behavior change and system tests should be considered for larger
changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add and update `org.owasp.dependencycheck` to prevent any CVE [kafka]
Posted by "Pankraz76 (via GitHub)" <gi...@apache.org>.
Pankraz76 commented on code in PR #20364:
URL: https://github.com/apache/kafka/pull/20364#discussion_r2280960370
##########
build.gradle:
##########
@@ -33,7 +34,7 @@ plugins {
id 'idea'
id 'jacoco'
id 'java-library'
- id 'org.owasp.dependencycheck' version '8.2.1'
Review Comment:
**Surprisingly, there were zero vulnerabilities found**, which is a good thing. This offers a great opportunity to **keep it that way** by running the `dependencyCheckAnalyze` goal.
I was surprised not to find this in the codebase—it should ideally be called in a **CI quality gate** to ensure security.
Additionally, **not updating this plugin introduces its own risk**, as this plugin is **critical**. I was considering implementing it but was surprised to find it seemingly **abandoned and not updated**.
**What’s going on with Dependabot here?** This seems like an issue—why isn’t it keeping dependencies up to date?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add and update `org.owasp.dependencycheck` to prevent any CVE [kafka]
Posted by "Pankraz76 (via GitHub)" <gi...@apache.org>.
Pankraz76 commented on code in PR #20364:
URL: https://github.com/apache/kafka/pull/20364#discussion_r2280960370
##########
build.gradle:
##########
@@ -33,7 +34,7 @@ plugins {
id 'idea'
id 'jacoco'
id 'java-library'
- id 'org.owasp.dependencycheck' version '8.2.1'
Review Comment:
**Surprisingly, there were zero vulnerabilities found**, which is a good thing. This offers a great opportunity to **keep it that way** by running the `dependencyCheckAnalyze` goal.
I was surprised not to find this in the codebase—it should ideally be called in a **CI quality gate** to ensure security.
Additionally, **not updating this plugin introduces its own security risk**, as this plugin is **critical**. I was considering implementing it but was surprised to find it seemingly **abandoned and not updated**.
**What’s going on with Dependabot here?** This seems like an issue—why isn’t it keeping dependencies up to date?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add and update `org.owasp.dependencycheck` to prevent any CVE [kafka]
Posted by "Pankraz76 (via GitHub)" <gi...@apache.org>.
Pankraz76 commented on PR #20364:
URL: https://github.com/apache/kafka/pull/20364#issuecomment-3216289195
i can confirm no one cares about the code quality at all, facing the masses of unused declaration and flaws around. Good luck.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add and update `org.owasp.dependencycheck` to prevent any CVE [kafka]
Posted by "Pankraz76 (via GitHub)" <gi...@apache.org>.
Pankraz76 closed pull request #20364: Add and update `org.owasp.dependencycheck` to prevent any CVE
URL: https://github.com/apache/kafka/pull/20364
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org