Test child-dependencies in pom.xml would not be ignored since 0.55.0 #7466

menzbua · 2024-09-09T13:44:03Z

menzbua
Sep 9, 2024

Description

Hi,

since Trivy version 0.55.0 potentially we see an issue with the new "--include-dev-deps" feature. The test deps would not be ignored for child test deps. Here is a simple pom.xml file to illustrate the problem:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <artifactId>test</artifactId>

    <properties>
        <java.version>21</java.version>
    </properties>

    <dependencies>
        <dependency>
            <groupId>com.google.code.gson</groupId>
            <artifactId>gson</artifactId>
            <version>2.11.0</version>
        </dependency>
    </dependencies>
</project>

When you run trivy filesystem --debug --scanners vuln,misconfig --exit-code 0 pom.xml with version 0.55.0 you see an error that a repository cannot be found:

2024-09-09T13:27:07Z	DEBUG	[pom] Repository error	err="com.google.guava:guava-tests:33.0.0-jre was not found in local/remote repositories"

There are so many additional dependencies that would be downloaded with 0.55.0

2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.code.gson" artifact_id="gson" version="2.11.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.code.gson:gson-parent:2.11.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.code.gson:gson-parent:2.11.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.errorprone" artifact_id="error_prone_annotations" version="2.27.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.errorprone:error_prone_parent:2.27.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.errorprone:error_prone_parent:2.27.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="junit" artifact_id="junit" version="4.13.2"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.truth" artifact_id="truth" version="1.4.2"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.truth:truth-parent:1.4.2"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.truth:truth-parent:1.4.2"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.guava" artifact_id="guava-testlib" version="33.1.0-jre"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.guava:guava-parent:33.1.0-jre"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.guava:guava-parent:33.1.0-jre"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="org.hamcrest" artifact_id="hamcrest-core" version="1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.hamcrest:hamcrest-parent:1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.hamcrest:hamcrest-parent:1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="org.hamcrest" artifact_id="hamcrest-library" version="1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.hamcrest:hamcrest-parent:1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.hamcrest:hamcrest-parent:1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.guava" artifact_id="guava" version="33.0.0-android"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.guava:guava-parent:33.0.0-android"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.guava:guava-parent:33.0.0-android"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="org.checkerframework" artifact_id="checker-qual" version="3.42.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.gwt" artifact_id="gwt-user" version="2.10.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.gwt:gwt:2.10.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.sonatype.oss:oss-parent:4"
2024-09-09T13:37:14Z	DEBUG	[pom] Adding repository	id="sonatype-nexus-snapshots" url="https://oss.sonatype.org/content/repositories/snapshots"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.sonatype.oss:oss-parent:4"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.gwt:gwt:2.10.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.auto.value" artifact_id="auto-value-annotations" version="1.10.4"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.auto.value:auto-value-parent:1.10.4"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.auto.value:auto-value-parent:1.10.4"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.guava" artifact_id="guava-gwt" version="33.0.0-jre"
2024-09-09T13:37:14Z	DEBUG	[pom] Adding repository	id="sonatype-google-snapshots" url="https://oss.sonatype.org/content/repositories/google-snapshots/"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.guava:guava-parent:33.0.0-jre"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.guava:guava-parent:33.0.0-jre"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="org.ow2.asm" artifact_id="asm" version="9.6"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.ow2:ow2:1.5.1"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.ow2:ow2:1.5.1"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.code.findbugs" artifact_id="jsr305" version="3.0.2"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.sonatype.oss:oss-parent:7"
2024-09-09T13:37:14Z	DEBUG	[pom] Adding repository	id="sonatype-nexus-snapshots" url="https://oss.sonatype.org/content/repositories/snapshots"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.sonatype.oss:oss-parent:7"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.j2objc" artifact_id="j2objc-annotations" version="3.0.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.guava" artifact_id="failureaccess" version="1.0.2"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.guava:guava-parent:26.0-android"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.sonatype.oss:oss-parent:9"
2024-09-09T13:37:14Z	DEBUG	[pom] Adding repository	id="sonatype-nexus-snapshots" url="https://oss.sonatype.org/content/repositories/snapshots"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.sonatype.oss:oss-parent:9"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.guava:guava-parent:26.0-android"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.guava" artifact_id="listenablefuture" version="9999.0-empty-to-avoid-conflict-with-guava"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.guava:guava-parent:26.0-android"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.guava:guava-parent:26.0-android"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.guava" artifact_id="guava-tests" version="33.0.0-jre"
2024-09-09T13:37:14Z	DEBUG	[pom] Failed to fetch	url="https://repo.maven.apache.org/maven2/com/google/guava/guava-tests/33.0.0-jre/guava-tests-33.0.0-jre.pom"
2024-09-09T13:37:14Z	DEBUG	[pom] Repository error	err="com.google.guava:guava-tests:33.0.0-jre was not found in local/remote repositories"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="org.gwtproject" artifact_id="gwt-user" version="2.10.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.gwtproject:gwt:2.10.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.sonatype.oss:oss-parent:4"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.sonatype.oss:oss-parent:4"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.gwtproject:gwt:2.10.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="org.gwtproject.web.bindery" artifact_id="requestfactory" version="2.10.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.sonatype.oss:oss-parent:4"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.sonatype.oss:oss-parent:4"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.truth.extensions" artifact_id="truth-java8-extension" version="1.1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.truth.extensions:truth-extensions-parent:1.1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.truth:truth-parent:1.1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.sonatype.oss:oss-parent:7"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.sonatype.oss:oss-parent:7"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.truth:truth-parent:1.1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.truth.extensions:truth-extensions-parent:1.1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.jsinterop" artifact_id="jsinterop-annotations" version="2.0.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="javax.validation" artifact_id="validation-api" version="1.0.0.GA"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="javax.servlet" artifact_id="javax.servlet-api" version="3.1.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="net.java:jvnet-parent:3"
2024-09-09T13:37:14Z	DEBUG	[pom] Adding repository	id="jvnet-nexus-snapshots" url="https://maven.java.net/content/repositories/snapshots"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="net.java:jvnet-parent:3"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="org.w3c.css" artifact_id="sac" version="1.3"

When you run the same command with Trivy 0.54.1, there is no error and the dependency is not tried to download and there are just a few deps:

2024-09-09T13:37:02Z	DEBUG	[pom] Resolving...	group_id="com.google.code.gson" artifact_id="gson" version="2.11.0"
2024-09-09T13:37:02Z	DEBUG	[pom] Start parent	artifact="com.google.code.gson:gson-parent:2.11.0"
2024-09-09T13:37:02Z	DEBUG	[pom] Exit parent	artifact="com.google.code.gson:gson-parent:2.11.0"
2024-09-09T13:37:02Z	DEBUG	[pom] Resolving...	group_id="com.google.errorprone" artifact_id="error_prone_annotations" version="2.27.0"
2024-09-09T13:37:02Z	DEBUG	[pom] Start parent	artifact="com.google.errorprone:error_prone_parent:2.27.0"
2024-09-09T13:37:02Z	DEBUG	[pom] Exit parent	artifact="com.google.errorprone:error_prone_parent:2.27.0"

Our project runs in a timeout because there are so many test dependencies that would be tried to download that are not needed because they are child deps.

Desired Behavior

There should not be downloaded more deps as needed:

2024-09-09T13:37:02Z	DEBUG	[pom] Resolving...	group_id="com.google.code.gson" artifact_id="gson" version="2.11.0"
2024-09-09T13:37:02Z	DEBUG	[pom] Start parent	artifact="com.google.code.gson:gson-parent:2.11.0"
2024-09-09T13:37:02Z	DEBUG	[pom] Exit parent	artifact="com.google.code.gson:gson-parent:2.11.0"
2024-09-09T13:37:02Z	DEBUG	[pom] Resolving...	group_id="com.google.errorprone" artifact_id="error_prone_annotations" version="2.27.0"
2024-09-09T13:37:02Z	DEBUG	[pom] Start parent	artifact="com.google.errorprone:error_prone_parent:2.27.0"
2024-09-09T13:37:02Z	DEBUG	[pom] Exit parent	artifact="com.google.errorprone:error_prone_parent:2.27.0"

Actual Behavior

2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.code.gson" artifact_id="gson" version="2.11.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.code.gson:gson-parent:2.11.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.code.gson:gson-parent:2.11.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.errorprone" artifact_id="error_prone_annotations" version="2.27.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.errorprone:error_prone_parent:2.27.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.errorprone:error_prone_parent:2.27.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="junit" artifact_id="junit" version="4.13.2"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.truth" artifact_id="truth" version="1.4.2"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.truth:truth-parent:1.4.2"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.truth:truth-parent:1.4.2"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.guava" artifact_id="guava-testlib" version="33.1.0-jre"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.guava:guava-parent:33.1.0-jre"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.guava:guava-parent:33.1.0-jre"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="org.hamcrest" artifact_id="hamcrest-core" version="1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.hamcrest:hamcrest-parent:1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.hamcrest:hamcrest-parent:1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="org.hamcrest" artifact_id="hamcrest-library" version="1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.hamcrest:hamcrest-parent:1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.hamcrest:hamcrest-parent:1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.guava" artifact_id="guava" version="33.0.0-android"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.guava:guava-parent:33.0.0-android"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.guava:guava-parent:33.0.0-android"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="org.checkerframework" artifact_id="checker-qual" version="3.42.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.gwt" artifact_id="gwt-user" version="2.10.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.gwt:gwt:2.10.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.sonatype.oss:oss-parent:4"
2024-09-09T13:37:14Z	DEBUG	[pom] Adding repository	id="sonatype-nexus-snapshots" url="https://oss.sonatype.org/content/repositories/snapshots"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.sonatype.oss:oss-parent:4"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.gwt:gwt:2.10.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.auto.value" artifact_id="auto-value-annotations" version="1.10.4"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.auto.value:auto-value-parent:1.10.4"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.auto.value:auto-value-parent:1.10.4"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.guava" artifact_id="guava-gwt" version="33.0.0-jre"
2024-09-09T13:37:14Z	DEBUG	[pom] Adding repository	id="sonatype-google-snapshots" url="https://oss.sonatype.org/content/repositories/google-snapshots/"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.guava:guava-parent:33.0.0-jre"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.guava:guava-parent:33.0.0-jre"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="org.ow2.asm" artifact_id="asm" version="9.6"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.ow2:ow2:1.5.1"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.ow2:ow2:1.5.1"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.code.findbugs" artifact_id="jsr305" version="3.0.2"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.sonatype.oss:oss-parent:7"
2024-09-09T13:37:14Z	DEBUG	[pom] Adding repository	id="sonatype-nexus-snapshots" url="https://oss.sonatype.org/content/repositories/snapshots"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.sonatype.oss:oss-parent:7"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.j2objc" artifact_id="j2objc-annotations" version="3.0.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.guava" artifact_id="failureaccess" version="1.0.2"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.guava:guava-parent:26.0-android"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.sonatype.oss:oss-parent:9"
2024-09-09T13:37:14Z	DEBUG	[pom] Adding repository	id="sonatype-nexus-snapshots" url="https://oss.sonatype.org/content/repositories/snapshots"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.sonatype.oss:oss-parent:9"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.guava:guava-parent:26.0-android"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.guava" artifact_id="listenablefuture" version="9999.0-empty-to-avoid-conflict-with-guava"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.guava:guava-parent:26.0-android"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.guava:guava-parent:26.0-android"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.guava" artifact_id="guava-tests" version="33.0.0-jre"
2024-09-09T13:37:14Z	DEBUG	[pom] Failed to fetch	url="https://repo.maven.apache.org/maven2/com/google/guava/guava-tests/33.0.0-jre/guava-tests-33.0.0-jre.pom"
2024-09-09T13:37:14Z	DEBUG	[pom] Repository error	err="com.google.guava:guava-tests:33.0.0-jre was not found in local/remote repositories"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="org.gwtproject" artifact_id="gwt-user" version="2.10.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.gwtproject:gwt:2.10.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.sonatype.oss:oss-parent:4"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.sonatype.oss:oss-parent:4"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.gwtproject:gwt:2.10.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="org.gwtproject.web.bindery" artifact_id="requestfactory" version="2.10.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.sonatype.oss:oss-parent:4"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.sonatype.oss:oss-parent:4"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.truth.extensions" artifact_id="truth-java8-extension" version="1.1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.truth.extensions:truth-extensions-parent:1.1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.truth:truth-parent:1.1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.sonatype.oss:oss-parent:7"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.sonatype.oss:oss-parent:7"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.truth:truth-parent:1.1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.truth.extensions:truth-extensions-parent:1.1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.jsinterop" artifact_id="jsinterop-annotations" version="2.0.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="javax.validation" artifact_id="validation-api" version="1.0.0.GA"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="javax.servlet" artifact_id="javax.servlet-api" version="3.1.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="net.java:jvnet-parent:3"
2024-09-09T13:37:14Z	DEBUG	[pom] Adding repository	id="jvnet-nexus-snapshots" url="https://maven.java.net/content/repositories/snapshots"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="net.java:jvnet-parent:3"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="org.w3c.css" artifact_id="sac" version="1.3"

Reproduction Steps

1.
2.
3.
...

Target

Filesystem

Scanner

Vulnerability

Output Format

Table

Mode

Standalone

Debug Output

/src # trivy filesystem --debug --scanners vuln,misconfig --exit-code 0 pom.xml
2024-09-09T13:37:14Z	DEBUG	No plugins loaded
2024-09-09T13:37:14Z	INFO	Loaded	file_path="trivy.yaml"
2024-09-09T13:37:14Z	DEBUG	Cache dir	dir="/root/.cache/trivy"
2024-09-09T13:37:14Z	DEBUG	Cache dir	dir="/root/.cache/trivy"
2024-09-09T13:37:14Z	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-09-09T13:37:14Z	DEBUG	Ignore statuses	statuses=[]
2024-09-09T13:37:14Z	DEBUG	DB update was skipped because the local DB is the latest
2024-09-09T13:37:14Z	DEBUG	DB info	schema=2 updated_at=2024-09-09T12:14:33.25145201Z next_update=2024-09-09T18:14:33.25145163Z downloaded_at=2024-09-09T12:17:24.772474516Z
2024-09-09T13:37:14Z	DEBUG	[pkg] Package types	types=[os library]
2024-09-09T13:37:14Z	DEBUG	[pkg] Package relationships	relationships=[unknown root direct indirect]
2024-09-09T13:37:14Z	INFO	[vuln] Vulnerability scanning is enabled
2024-09-09T13:37:14Z	INFO	[misconfig] Misconfiguration scanning is enabled
2024-09-09T13:37:14Z	DEBUG	[misconfig] Checks successfully loaded from disk
2024-09-09T13:37:14Z	DEBUG	Enabling misconfiguration scanners	scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-09-09T13:37:14Z	DEBUG	Initializing scan cache...	type="memory"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.code.gson" artifact_id="gson" version="2.11.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.code.gson:gson-parent:2.11.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.code.gson:gson-parent:2.11.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.errorprone" artifact_id="error_prone_annotations" version="2.27.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.errorprone:error_prone_parent:2.27.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.errorprone:error_prone_parent:2.27.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="junit" artifact_id="junit" version="4.13.2"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.truth" artifact_id="truth" version="1.4.2"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.truth:truth-parent:1.4.2"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.truth:truth-parent:1.4.2"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.guava" artifact_id="guava-testlib" version="33.1.0-jre"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.guava:guava-parent:33.1.0-jre"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.guava:guava-parent:33.1.0-jre"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="org.hamcrest" artifact_id="hamcrest-core" version="1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.hamcrest:hamcrest-parent:1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.hamcrest:hamcrest-parent:1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="org.hamcrest" artifact_id="hamcrest-library" version="1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.hamcrest:hamcrest-parent:1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.hamcrest:hamcrest-parent:1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.guava" artifact_id="guava" version="33.0.0-android"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.guava:guava-parent:33.0.0-android"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.guava:guava-parent:33.0.0-android"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="org.checkerframework" artifact_id="checker-qual" version="3.42.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.gwt" artifact_id="gwt-user" version="2.10.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.gwt:gwt:2.10.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.sonatype.oss:oss-parent:4"
2024-09-09T13:37:14Z	DEBUG	[pom] Adding repository	id="sonatype-nexus-snapshots" url="https://oss.sonatype.org/content/repositories/snapshots"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.sonatype.oss:oss-parent:4"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.gwt:gwt:2.10.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.auto.value" artifact_id="auto-value-annotations" version="1.10.4"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.auto.value:auto-value-parent:1.10.4"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.auto.value:auto-value-parent:1.10.4"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.guava" artifact_id="guava-gwt" version="33.0.0-jre"
2024-09-09T13:37:14Z	DEBUG	[pom] Adding repository	id="sonatype-google-snapshots" url="https://oss.sonatype.org/content/repositories/google-snapshots/"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.guava:guava-parent:33.0.0-jre"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.guava:guava-parent:33.0.0-jre"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="org.ow2.asm" artifact_id="asm" version="9.6"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.ow2:ow2:1.5.1"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.ow2:ow2:1.5.1"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.code.findbugs" artifact_id="jsr305" version="3.0.2"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.sonatype.oss:oss-parent:7"
2024-09-09T13:37:14Z	DEBUG	[pom] Adding repository	id="sonatype-nexus-snapshots" url="https://oss.sonatype.org/content/repositories/snapshots"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.sonatype.oss:oss-parent:7"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.j2objc" artifact_id="j2objc-annotations" version="3.0.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.guava" artifact_id="failureaccess" version="1.0.2"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.guava:guava-parent:26.0-android"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.sonatype.oss:oss-parent:9"
2024-09-09T13:37:14Z	DEBUG	[pom] Adding repository	id="sonatype-nexus-snapshots" url="https://oss.sonatype.org/content/repositories/snapshots"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.sonatype.oss:oss-parent:9"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.guava:guava-parent:26.0-android"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.guava" artifact_id="listenablefuture" version="9999.0-empty-to-avoid-conflict-with-guava"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.guava:guava-parent:26.0-android"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.guava:guava-parent:26.0-android"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.guava" artifact_id="guava-tests" version="33.0.0-jre"
2024-09-09T13:37:14Z	DEBUG	[pom] Failed to fetch	url="https://repo.maven.apache.org/maven2/com/google/guava/guava-tests/33.0.0-jre/guava-tests-33.0.0-jre.pom"
2024-09-09T13:37:14Z	DEBUG	[pom] Repository error	err="com.google.guava:guava-tests:33.0.0-jre was not found in local/remote repositories"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="org.gwtproject" artifact_id="gwt-user" version="2.10.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.gwtproject:gwt:2.10.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.sonatype.oss:oss-parent:4"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.sonatype.oss:oss-parent:4"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.gwtproject:gwt:2.10.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="org.gwtproject.web.bindery" artifact_id="requestfactory" version="2.10.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.sonatype.oss:oss-parent:4"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.sonatype.oss:oss-parent:4"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.truth.extensions" artifact_id="truth-java8-extension" version="1.1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.truth.extensions:truth-extensions-parent:1.1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="com.google.truth:truth-parent:1.1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="org.sonatype.oss:oss-parent:7"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="org.sonatype.oss:oss-parent:7"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.truth:truth-parent:1.1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="com.google.truth.extensions:truth-extensions-parent:1.1.3"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="com.google.jsinterop" artifact_id="jsinterop-annotations" version="2.0.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="javax.validation" artifact_id="validation-api" version="1.0.0.GA"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="javax.servlet" artifact_id="javax.servlet-api" version="3.1.0"
2024-09-09T13:37:14Z	DEBUG	[pom] Start parent	artifact="net.java:jvnet-parent:3"
2024-09-09T13:37:14Z	DEBUG	[pom] Adding repository	id="jvnet-nexus-snapshots" url="https://maven.java.net/content/repositories/snapshots"
2024-09-09T13:37:14Z	DEBUG	[pom] Exit parent	artifact="net.java:jvnet-parent:3"
2024-09-09T13:37:14Z	DEBUG	[pom] Resolving...	group_id="org.w3c.css" artifact_id="sac" version="1.3"
2024-09-09T13:37:14Z	DEBUG	OS is not detected.
2024-09-09T13:37:14Z	INFO	Suppressing dependencies for development and testing. To display them, try the '--include-dev-deps' flag.
2024-09-09T13:37:14Z	DEBUG	Detected OS: unknown
2024-09-09T13:37:14Z	INFO	Number of language-specific files	num=1
2024-09-09T13:37:14Z	INFO	[pom] Detecting vulnerabilities...
2024-09-09T13:37:14Z	DEBUG	[pom] Scanning packages for vulnerabilities	file_path="pom.xml"
2024-09-09T13:37:14Z	INFO	Detected config files	num=0
2024-09-09T13:37:14Z	DEBUG	Found an ignore file	file_path=".trivyignore"
2024-09-09T13:37:14Z	DEBUG	[vex] VEX filtering is disabled

Operating System

Ubuntu 22.04

Version

/src # trivy version
2024-09-09T13:41:53Z	INFO	Loaded	file_path="trivy.yaml"
Version: 0.55.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-09-09 12:14:33.25145201 +0000 UTC
  NextUpdate: 2024-09-09 18:14:33.25145163 +0000 UTC
  DownloadedAt: 2024-09-09 12:17:24.772474516 +0000 UTC
Check Bundle:
  Digest: sha256:ef2d9ad4fce0f933b20a662004d7e55bf200987c180e7f2cd531af631f408bb3
  DownloadedAt: 2024-09-09 08:51:13.524831152 +0000 UTC
/src #

Checklist

Run trivy clean --all
Read the troubleshooting

DmitriyLewen · 2024-09-10T04:44:52Z

DmitriyLewen
Sep 10, 2024
Maintainer

Hello @menzbua
Thanks for your report!

We detect all dependencies first and don't include dev dependencies in report without --include-dev-deps flag later.
This is not a problem for other supported lock files. But it does look like a problem for pom.xml files because a project may contain many dependencies and we check each dependency in local/remote repository.

only fs mode supports --include-dev-deps flag. This means we use memory cache.
So we can update our logic to include/exclude dev dependencies in analyzers.
@knqyf263 wdyt?

1 reply

knqyf263 Sep 10, 2024
Maintainer

only fs mode supports --include-dev-deps flag. This means we use memory cache.

That's a good point. If we store them in the cache, we need to invalidate the cache depending on the --include-dev-deps flag. However, as you pointed out, this is not the case.

So we can update our logic to include/exclude dev dependencies in analyzers.

In short, this idea sounds good.

DmitriyLewen · 2024-09-10T06:21:49Z

DmitriyLewen
Sep 10, 2024
Maintainer

Created #7476 for this task

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Test child-dependencies in pom.xml would not be ignored since 0.55.0 #7466

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments 1 reply

{{title}}

{{title}}

{{title}}

Select a reply

Test child-dependencies in pom.xml would not be ignored since 0.55.0 #7466

menzbua Sep 9, 2024

Description

Desired Behavior

Actual Behavior

Reproduction Steps

Target

Scanner

Output Format

Mode

Debug Output

Operating System

Version

Checklist

Replies: 2 comments · 1 reply

DmitriyLewen Sep 10, 2024 Maintainer

knqyf263 Sep 10, 2024 Maintainer

DmitriyLewen Sep 10, 2024 Maintainer

menzbua
Sep 9, 2024

Replies: 2 comments 1 reply

DmitriyLewen
Sep 10, 2024
Maintainer

knqyf263 Sep 10, 2024
Maintainer

DmitriyLewen
Sep 10, 2024
Maintainer