Skip to content

fix: ensure working hostedSuppressions/RetireJS forceUpdate & correct cache validForHours checks #8494

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jeremylong merged 7 commits into from
May 19, 2026
Merged

fix: ensure working hostedSuppressions/RetireJS forceUpdate & correct cache validForHours checks #8494

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
de04ade
fix: restore functionality of hostedSuppressionsForceUpdate; falling …
chadlwilson May 6, 2026
0b55b57
fix: correct stale/shouldUpdate checks for LocalDataSources
chadlwilson May 7, 2026
54c5e63
refactor: simplify readability of RetireJSDataSource update logic, si…
chadlwilson May 7, 2026
e453a0e
refactor: use common logic for determing non-empty files
chadlwilson May 8, 2026
49e9ab8
refactor: refactor RetireJSAnalyzer to reuse RetireJSDataSource logic
chadlwilson May 8, 2026
ff86010
Merge branch 'main' into fix-hosted-suppressions-force-update
chadlwilson May 10, 2026
8af25b6
Merge branch 'main' into fix-hosted-suppressions-force-update
chadlwilson May 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions ant/src/main/java/org/owasp/dependencycheck/taskdefs/Update.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,12 +20,12 @@
import org.apache.tools.ant.BuildException;
import org.apache.tools.ant.Project;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.ant.logging.AntTaskHolder;
import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
import org.owasp.dependencycheck.data.update.exception.UpdateException;
import org.owasp.dependencycheck.utils.Downloader;
import org.owasp.dependencycheck.utils.InvalidSettingException;
import org.owasp.dependencycheck.utils.Settings;
import org.owasp.dependencycheck.ant.logging.AntTaskHolder;

/**
* An Ant task definition to execute dependency-check update. This will download
Expand Down Expand Up @@ -203,7 +203,7 @@ public class Update extends Purge {
*/
private Boolean hostedSuppressionsForceUpdate;
/**
* Whether the hosted suppressions file will be used. Defaults to true.
* Whether the hosted suppressions will be updated from the configured URL. Defaults to true.
*/
private Boolean hostedSuppressionsEnabled;
/**
Expand Down
2 changes: 1 addition & 1 deletion ant/src/site/markdown/config-update.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ The following properties can be configured in the plugin. However, they are less
| connectionString | The connection string used to connect to the database. See using a [database server](../data/database.html). |   |
| databaseUser | The username used when connecting to the database. |   |
| databasePassword | The password used when connecting to the database. |   |
| hostedSuppressionsEnabled | Whether the hosted suppression file will be used. | true |
| hostedSuppressionsEnabled | Whether the hosted suppressions will be updated from the configured URL. | true |
| hostedSuppressionsUrl | The URL to a mirrored copy of the hosted suppressions file for internet-constrained environments | https://dependency-check.github.io/DependencyCheck/suppressions/publishedSuppressions.xml |
| hostedSuppressionsUser | The user for a Basic-auth-protected mirrored copy of the hosted suppressions file for internet-constrained environments |   |
| hostedSuppressionsPassword | The password/token for a Basic-auth-protected mirrored copy of the hosted suppressions file for internet-constrained environments |   |
Expand Down
2 changes: 1 addition & 1 deletion ant/src/site/markdown/configuration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,7 +166,7 @@ The following properties can be configured in the plugin. However, they are less
| connectionString | The connection string used to connect to the database. See using a [database server](../data/database.html). |   |
| databaseUser | The username used when connecting to the database. |   |
| databasePassword | The password used when connecting to the database. |   |
| hostedSuppressionsEnabled | Whether the hosted suppression file will be used. | true |
| hostedSuppressionsEnabled | Whether the hosted suppressions will be updated from the configured URL. | true |
| hostedSuppressionsUrl | The URL to a mirrored copy of the hosted suppressions file for internet-constrained environments | https://dependency-check.github.io/DependencyCheck/suppressions/publishedSuppressions.xml |
| hostedSuppressionsUser | The user for a Basic-auth-protected mirrored copy of the hosted suppressions file for internet-constrained environments |   |
| hostedSuppressionsPassword | The password/token for a Basic-auth-protected mirrored copy of the hosted suppressions file for internet-constrained environments |   |
Expand Down
2 changes: 1 addition & 1 deletion cli/src/main/java/org/owasp/dependencycheck/CliParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -547,7 +547,7 @@ private void addAdvancedOptions(final Options options) {
.addOption(newOption(ARGUMENT.ENABLE_NEXUS, "Enable the Nexus Analyzer."))
.addOption(newOption(ARGUMENT.ARTIFACTORY_ENABLED, "Whether the Artifactory Analyzer should be enabled."))
.addOption(newOption(ARGUMENT.PURGE_NVD, "Purges the local NVD data cache"))
.addOption(newOption(ARGUMENT.DISABLE_HOSTED_SUPPRESSIONS, "Disable the usage of the hosted suppressions file"))
.addOption(newOption(ARGUMENT.DISABLE_HOSTED_SUPPRESSIONS, "Disable retrieval of the hosted suppressions from the configured URL."))
.addOption(newOption(ARGUMENT.HOSTED_SUPPRESSIONS_FORCEUPDATE, "Force the hosted suppressions file to update even"
+ " if autoupdate is disabled"))
.addOption(newOptionWithArg(ARGUMENT.HOSTED_SUPPRESSIONS_VALID_FOR_HOURS, "hours",
Expand Down
2 changes: 1 addition & 1 deletion cli/src/site/markdown/arguments.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,7 +134,7 @@ Advanced Options
| | \-\-dbUser | \<user\> | The username used to connect to the database. | &nbsp; |
| \-d | \-\-data | \<path\> | The location of the data directory used to store persistent data. | /usr/local/var/dependencycheck if installed through brew (→ [formula](https://github.com/Homebrew/homebrew-core/blob/master/Formula/d/dependency-check.rb#L29)). Otherwise, the data directory is created inside the install directory i.e. as a sibling to the `<install-dir>/bin`, `<install-dir>/lib` directories. |
| | \-\-purge | | Delete the local copy of the NVD. This is used to force a refresh of the data. | &nbsp; |
| | \-\-disableHostedSuppressions | | Whether the usage of the hosted suppressions file will be disabled. | false |
| | \-\-disableHostedSuppressions | | Disable retrieval of the hosted suppressions from the configured URL. | false |
| | \-\-hostedSuppressionsForceUpdate | | Whether the hosted suppressions file will update regardless of the `noupdate` argument. | false |
| | \-\-hostedSuppressionsValidForHours | \<hours\> | The number of hours to wait before checking for new updates of the hosted suppressions file | 2 |
| | \-\-hostedSuppressionsUrl | \<url\> | The URL to a mirrored copy of the hosted suppressions file for internet-constrained environments | https://dependency-check.github.io/DependencyCheck/suppressions/publishedSuppressions.xml |
Expand Down
Loading
Loading