mirror of
https://github.com/corda/corda.git
synced 2024-12-19 04:57:58 +00:00
c205a10ec0
OWASP Dependency Checker has been updated so that it can be configured to automatically fail a build when a vulnerable dependency is detected. This option is exposed through gradle settings, so that a build can be configured in TeamCity to pass/fail. This change is backward-compatible - i.e. it does not affect a build by default unless configured to do so. Ability to fail a build is exposed by the new owasp.failBuildOnCVSS gradle property By default this is set to '11.0' which will always pass a build even if a vulnerability is found (so will not affect anything by default) Reduce the CVSS level between 0-10 to indicate what level to fail a build on Example usage to catch Medium severity (and above) issues: Configure gradle with the option -Powasp.failBuildOnCVSS=4
6 lines
160 B
INI
6 lines
160 B
INI
kotlin.incremental=true
|
|
org.gradle.jvmargs=-XX:+UseG1GC -Xmx1g -Dfile.encoding=UTF-8
|
|
org.gradle.caching=true
|
|
owasp.failOnError=false
|
|
owasp.failBuildOnCVSS=11.0
|