fix(hexagonal-spring-rules): align dependency-check config with sibling projects - #71
Merged
Arc-E-Tect merged 2 commits intoAug 21, 2026
Merged
Conversation
…ng projects hexagonal-spring-rules was missing format = 'HTML' in the dependencyCheck block, so the report was written to build/reports/dependency-check-report.html instead of the build/reports/dependency-check/dependency-check-report.html path the security-scan workflow uploads, silently dropping the vulnerability report artifact. It also had configuration-cache enabled unlike the other three projects, which crashes because resolveVersion() shells out to gh release list at configuration time and the OWASP dependency-check plugin doesn't support the configuration cache either.
spring-context-iff was pinned at 6.2.8 since the module was created and never bumped, unlike the example projects which already track 7.0.8. 6.2.0-6.2.18 are affected by CVE-2026-41855 (and ~20 other CVEs disclosed in the same batch), which is what tripped the CVSS gate in dependencyCheckAnalyze. 6.2.19 is the fixed OSS release.
Arc-E-Tect
deleted the
fix/hexagonal-spring-rules-dependency-check-report
branch
August 21, 2026 17:19
Arc-E-Tect
added a commit
that referenced
this pull request
Aug 21, 2026
## [1.0.1](hexagonal-spring-rules-v1.0.0...hexagonal-spring-rules-v1.0.1) (2026-08-21) ### 🐛 Bug Fixes * **hexagonal-spring-rules:** align dependency-check config with sibling projects ([#71](#71)) ([769f76a](769f76a)), closes [#71](#71) * **sedr-library:** give module its own semantic-release tag namespace ([#68](#68)) ([ff2eb0d](ff2eb0d)), closes [#68](#68) [#67](#67) * **api-detector-core:** update swagger-parser dependency and document OpenAPI v3 support ([#70](#70)) ([352b03e](352b03e)), closes [#70](#70) ### 📝 Documentation * **hexagonal-spring-rules:** update README version to 1.0.0 [skip ci] ([140934e](140934e)) * **api-detector-core:** update README version to 1.2.1 [skip ci] ([b4230b2](b4230b2)) ### 🔧 Misc * dependency updates for Library projects ([#69](#69)) ([d46b898](d46b898)), closes [#69](#69)
Owner
Author
|
🎉 This PR is included in version 1.0.1 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Arc-E-Tect
added a commit
that referenced
this pull request
Aug 21, 2026
# [1.0.0](sedr-library-v0.5.2...sedr-library-v1.0.0) (2026-08-21) ### ✨ New and updated features * **api-detector-core:** add ContractProgressTableWriter for shared Progress Over Time reporting ([#59](#59)) ([dd4d36a](dd4d36a)), closes [#59](#59) * add geo-tracker-lens-pack library with independent release pipeline ([#60](#60)) ([1730931](1730931)), closes [#60](#60) * **api-detector-core:** add PathTemplates.stripBasePath and OpenApiEndpointCollector.firstServerBasePath ([#66](#66)) ([865e711](865e711)), closes [#66](#66) * **api-detector-core:** add published shared library for the SEDR API detector plugins ([#52](#52)) ([059ee4d](059ee4d)), closes [#52](#52) * **api-detector-core:** add ScanProgressReporter for visible long-scan progress ([#56](#56)) ([9357bc9](9357bc9)), closes [#56](#56) * **api-detector-core:** add shared contract-lifecycle progress history framework ([#53](#53)) ([0bb104e](0bb104e)), closes [#53](#53) * **api-detector-core:** separate real implementation evidence from stub evidence in contract history ([#64](#64)) ([0775933](0775933)), closes [#64](#64) * **api-detector-core:** write and tolerate a schema-version marker ([#65](#65)) ([e27d53f](e27d53f)), closes [#65](#65) ### 🐛 Bug Fixes * **hexagonal-spring-rules:** align dependency-check config with sibling projects ([#71](#71)) ([769f76a](769f76a)), closes [#71](#71) * **ci:** detect first semantic release version in calculate workflow ([#61](#61)) ([3a80fe1](3a80fe1)), closes [#61](#61) * **workflow:** fix tag checking for project-specific tag formats ([#54](#54)) ([ce8f57e](ce8f57e)), closes [#54](#54) * **hexagonal-spring-rules:** give module its own semantic-release tag namespace ([#67](#67)) ([613a69a](613a69a)), closes [#67](#67) * **sedr-library:** give module its own semantic-release tag namespace ([#68](#68)) ([ff2eb0d](ff2eb0d)), closes [#68](#68) [#67](#67) * tag checking for project-specific tag formats in workflow ([#55](#55)) ([9e9255e](9e9255e)), closes [#55](#55) * **api-detector-core:** update swagger-parser dependency and document OpenAPI v3 support ([#70](#70)) ([352b03e](352b03e)), closes [#70](#70) * **geo-tracker-lens-pack:** use https scm connection for Maven Central metadata ([#63](#63)) ([5bb98c0](5bb98c0)), closes [#63](#63) ### 📝 Documentation * **api-detector-core:** update README version to 0.1.0 [skip ci] ([14c5f16](14c5f16)) * **api-detector-core:** update README version to 0.2.0 [skip ci] ([2f68414](2f68414)) * **api-detector-core:** update README version to 0.3.0 [skip ci] ([9c63eac](9c63eac)) * **sedr-library:** update README version to 0.5.2 [skip ci] ([8320bb8](8320bb8)) * **api-detector-core:** update README version to 1.0.0 [skip ci] ([ebb1c5f](ebb1c5f)) * **geo-tracker-lens-pack:** update README version to 1.0.0 [skip ci] ([ab46583](ab46583)) * **hexagonal-spring-rules:** update README version to 1.0.0 [skip ci] ([140934e](140934e)) * **geo-tracker-lens-pack:** update README version to 1.0.1 [skip ci] ([1ac70e4](1ac70e4)) * **hexagonal-spring-rules:** update README version to 1.0.1 [skip ci] ([0c115a7](0c115a7)) * **api-detector-core:** update README version to 1.1.0 [skip ci] ([1680e7b](1680e7b)) * **api-detector-core:** update README version to 1.2.0 [skip ci] ([6656c7f](6656c7f)) * **api-detector-core:** update README version to 1.2.1 [skip ci] ([b4230b2](b4230b2)) ### 🔧 Misc * dependency updates for Library projects ([#58](#58)) ([83dff89](83dff89)), closes [#58](#58) * dependency updates for Library projects ([#69](#69)) ([d46b898](d46b898)), closes [#69](#69) * dependency updates for Library projects ([#72](#72)) ([2f7c387](2f7c387)), closes [#72](#72) * Make workflow triggers more specific and add progress reporter ([#57](#57)) ([10c64dc](10c64dc)), closes [#57](#57) * **ci:** remove redundant Monday NVD cache refresh schedule ([#51](#51)) ([ffd937f](ffd937f)), closes [#51](#51) * **geo-tracker-lens-pack:** trigger release pipeline after CI fix ([b2440cc](b2440cc)) ### BREAKING CHANGE * **api-detector-core:** contractHistoryFile written by a previous version of this library (9 fields, no stubbedAt) is no longer readable by ContractHistoryStore.load() - it now throws LegacyContractHistoryFormatException instead of loading it under the old, now-ambiguous implementedAt semantics. Consumers must migrate existing history files (mirage-api-detector's new migrateContractHistory task) or start a fresh history file before upgrading.
Owner
Author
|
🎉 This PR is included in version 1.0.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Arc-E-Tect
added a commit
that referenced
this pull request
Aug 22, 2026
# [1.3.0](api-detector-core-v1.2.1...api-detector-core-v1.3.0) (2026-08-22) ### ✨ New and updated features * **api-detector-core:** add shared exclusion rule engine ([#73](#73)) ([bb77af8](bb77af8)), closes [#73](#73) ### 🐛 Bug Fixes * **hexagonal-spring-rules:** align dependency-check config with sibling projects ([#71](#71)) ([769f76a](769f76a)), closes [#71](#71) ### 📝 Documentation * **sedr-library:** update README version to 1.0.0 [skip ci] ([2838a47](2838a47)) * **hexagonal-spring-rules:** update README version to 1.0.1 [skip ci] ([0c115a7](0c115a7)) * **api-detector-core:** update README version to 1.2.1 [skip ci] ([b4230b2](b4230b2)) ### 🔧 Misc * dependency updates for Library projects ([#72](#72)) ([2f7c387](2f7c387)), closes [#72](#72)
Owner
Author
|
🎉 This PR is included in version 1.3.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
format = 'HTML'to thedependencyCheck {}block so the report lands atbuild/reports/dependency-check/dependency-check-report.html, matching the path thesecurity-scan.ymlworkflow uploads. Without it the report was written tobuild/reports/dependency-check-report.htmland the upload step silently found nothing (confirmed against run 32458191991, which found CVE-2026-41855 and correctly failed the CVSS gate, but never uploaded the report).org.gradle.configuration-cacheingradle.properties, matchingapi-detector-core,sedr-library, andgeo-tracker-lens-pack.resolveVersion()shells out togh release listat configuration time, and the OWASP dependency-check plugin invokesTask.projectat execution time — both are incompatible with the configuration cache. CI already passes--no-configuration-cachefor the dependency-check tasks, but a bare./gradlew dependencyCheckAnalyze(as run locally) picked up the properties-file default and crashed.