From 768a42e9da81cb871036719bc1d8310060e92043 Mon Sep 17 00:00:00 2001 From: Eric Pugh Date: Tue, 11 Aug 2026 16:53:13 -0400 Subject: [PATCH 1/3] Wire up NVD API key for the owasp Gradle task The ./gradlew owasp task fails with an error from NvdApiDataSource because NVD heavily rate-limits its CVE data feed for unauthenticated requests. Wire the plugin's nvd.apiKey through a -PnvdApiKey property or NVD_API_KEY env var, and document the requirement. Co-Authored-By: Claude Sonnet 5 --- dev-docs/FAQ.adoc | 3 +++ dev-docs/gradle-help/workflow.txt | 1 + gradle/validation/owasp-dependency-check.gradle | 5 +++++ 3 files changed, 9 insertions(+) diff --git a/dev-docs/FAQ.adoc b/dev-docs/FAQ.adoc index 0690f557e5c2..a4b026947054 100644 --- a/dev-docs/FAQ.adoc +++ b/dev-docs/FAQ.adoc @@ -76,6 +76,9 @@ Run via: `./gradlew owasp` +This task downloads the NVD CVE database, which is heavily rate-limited for unauthenticated requests and will fail with an error from `NvdApiDataSource` without an API key. +Request a free key at https://nvd.nist.gov/developers/request-an-api-key and pass it via `-PnvdApiKey=` or the `NVD_API_KEY` environment variable. + There are a number of other tasks that get run to validate the source code, and you can find them in the ./gradle/validation source tree. === Generated files diff --git a/dev-docs/gradle-help/workflow.txt b/dev-docs/gradle-help/workflow.txt index 47cde864f536..0c5c2d1142be 100644 --- a/dev-docs/gradle-help/workflow.txt +++ b/dev-docs/gradle-help/workflow.txt @@ -53,6 +53,7 @@ Other validation and checks Generate a report of dependencies with known OWASP vulnerabilities: gradlew :dependencyCheckAnalyze open ./build/reports/dependency-check-report.html +(requires an NVD API key, see dev-docs/FAQ.adoc) Additional General Options ========================== diff --git a/gradle/validation/owasp-dependency-check.gradle b/gradle/validation/owasp-dependency-check.gradle index b319dd48a359..cbeec4958301 100644 --- a/gradle/validation/owasp-dependency-check.gradle +++ b/gradle/validation/owasp-dependency-check.gradle @@ -31,6 +31,11 @@ configure(rootProject) { analyzers { assemblyEnabled = false } + nvd { + // NVD heavily rate-limits the CVE data feed for unauthenticated requests. + // Get a free key from https://nvd.nist.gov/developers/request-an-api-key + apiKey = project.findProperty("nvdApiKey") ?: System.getenv("NVD_API_KEY") + } } task owasp() { From 1728d5b2c889875aa64852ed1099f7838cd720d4 Mon Sep 17 00:00:00 2001 From: Eric Pugh Date: Tue, 11 Aug 2026 17:16:44 -0400 Subject: [PATCH 2/3] update to the latest version, and document how to run it --- dev-docs/FAQ.adoc | 4 +++- gradle/libs.versions.toml | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/dev-docs/FAQ.adoc b/dev-docs/FAQ.adoc index a4b026947054..f4e98b90cc9a 100644 --- a/dev-docs/FAQ.adoc +++ b/dev-docs/FAQ.adoc @@ -74,11 +74,13 @@ Learn more about using Forbidden APIs via `./gradlew :helpForbiddenApis`. To run a check for dependencies of Solr that have security vulnerabilities using the https://plugins.gradle.org/plugin/org.owasp.dependencycheck[OWASP] Gradle plugin. Run via: -`./gradlew owasp` +`./gradlew owasp --no-parallel` This task downloads the NVD CVE database, which is heavily rate-limited for unauthenticated requests and will fail with an error from `NvdApiDataSource` without an API key. Request a free key at https://nvd.nist.gov/developers/request-an-api-key and pass it via `-PnvdApiKey=` or the `NVD_API_KEY` environment variable. +The `--no-parallel` flag is required because of an unresolved upstream bug where `dependencyCheckAggregate` resolves other projects' configurations unsafely under Gradle's parallel project execution: https://github.com/dependency-check/dependency-check-gradle/issues/462 + There are a number of other tasks that get run to validate the source code, and you can find them in the ./gradle/validation source tree. === Generated files diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 0c06757df4b9..7f82ce16a6cb 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -182,7 +182,7 @@ opentelemetry-runtime-telemetry = "2.27.0-alpha" oshai-logging = "8.0.4" # @keep for version alignment ow2-asm = "9.10.1" -owasp-dependencycheck = "12.2.2" +owasp-dependencycheck = "13.0.0" # @keep for version alignment perfmark = "0.27.0" prometheus-metrics = "1.8.0" From 5a38b72545ca972385728fedb6b40bc030ddbf38 Mon Sep 17 00:00:00 2001 From: Eric Pugh Date: Tue, 11 Aug 2026 17:20:23 -0400 Subject: [PATCH 3/3] changelog --- changelog/unreleased/owasp-nvd-apikey.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 changelog/unreleased/owasp-nvd-apikey.yml diff --git a/changelog/unreleased/owasp-nvd-apikey.yml b/changelog/unreleased/owasp-nvd-apikey.yml new file mode 100644 index 000000000000..2892a3d37084 --- /dev/null +++ b/changelog/unreleased/owasp-nvd-apikey.yml @@ -0,0 +1,11 @@ +title: > + The `./gradlew owasp` dependency vulnerability check now supports an NVD API key + (via `-PnvdApiKey` or `NVD_API_KEY`), and requires `--no-parallel` due to an upstream + Gradle plugin issue. See dev-docs/FAQ.adoc for details. +type: other +authors: + - name: Eric Pugh +links: + - name: PR#4725 + url: https://github.com/apache/solr/pull/4725 +