Dependency Check Fails with DatabaseException after Upgrading to Version 11.0.0 #7092
Labels
Comments
sfc-gh-nvadlamudi
changed the title
|
We also ran into this problem today, building with JDK 21 on Windows. The underlying exception is: caused by SQLException: No suitable driver found for jdbc:h2:file:C:\Users<user>.m2\repository\org\owasp\dependency-check-data\11.0\odc;AUTOCOMMIT=ON;CACHE_SIZE=65536;RETENTION_TIME=1000;MAX_COMPACT_TIME=10000; |
|
Same here with JDK 21 on Linux. We have multiple projects and it seems to work on the first one and then fail on the second one with the exception. I also noticed the following log messages, no idea if this is related to the problem though. full log: |
|
I run dependency checks on several projects and for some reason on one project I'm also affected with driver issue since version 11.0... with version 10.0.4 the affected project was running fine. |
|
This does indeed seem to be related to having multiple projects. In our case, I fixed it by only running OWASP on the top-level-project since the lower-level projects are transitively scanned anyway. Obviously not an option if you have multiple top-level-projects though. |
|
We also use a multi-module maven project. |
|
If you are running into this problem - to help us debug. Can you run just an update and then run the aggregate with no-update enabled? |
|
@jeremylong It still fails with same error |
|
Hi @jeremylong
Running |
|
does anyone have a sample project that replicates this behavior? I've setup both a gradle multi-project build (using conventions) and a multi-module maven project and both have worked for me under java 17. |
|
We are using the This combination causes the error: When disabling the I created a reproducer: https://github.com/daspilker/owasp-dependency-check-reproducer |
|
We suspect a side effect of combining other Maven plugins in multi-module projects as well. We don't have a reproducer yet but we have several projects on our side: None of them are incorporating the Update: For Quarkus projects it appears to us to be related to have JDBC dependencies on the classpath. Every project including some SQL database connection fails, no matter if it is a multi-module project or not. If it helps, latest LTS version of Quarkus is using H2 version: 2.3.230 |
|
@daspilker I love dependency conflicts! Using your reproducer - all I did was add the H2 driver and now liquibase fails: |
|
@jeremylong ah, the database needs a few seconds to start. If it's not ready there is a I added a |
|
I think you are on the right track. We use also use Quarkus and its "quarkus-jdbc-h2" module in the test scope for our unit-tests. Adding |
|
We were able to resolve the issue by fiddling around with a local build of the This is just a mean to help pin down the issue, we haven't understood what this line does, yet. But it might speed up the debugging process. |
|
Setting the |
|
That workaround... works for us! |
|
Adding |
|
A pity that there are apparently plugins that are breaking Java's SPI-based automatic discovery of database drivers forcing us back to the legacy days of explicit driver loading by classname. |
|
I noticed that the liquibase maven plugin does use |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
After upgrading to version 11.0.0, the dependency check is failing with the following error. I am using Java 11 and have executed
mvn org.owasp:dependency-check-maven:9.0.0:purgeas suggestedhere
The text was updated successfully, but these errors were encountered: