Won't fix issue will be reported again about dependency-check-sonar-plugin HOT 10 CLOSED

Hi Team, any update?

Thanks
Ivan Geng

from dependency-check-sonar-plugin.

What version of SonarQube? Issues are generated against the project, not a particular source file. Are there any changes to the project in SQ prior to this issue occurring?

from dependency-check-sonar-plugin.

The sonar version is Version 5.6.1.

Issues were not reported on the source files. The issues were reported on JARs. As some of the JARs are already latest or the latest version has known issues, so we marked them as 'Won't Fix'.

A few days later some files were reported again(no change on the jar dependency), but not all of the issues happens again.

Any suggestion? Thanks.

from dependency-check-sonar-plugin.

Hi @stevespringett , any suggestion? Thanks.

from dependency-check-sonar-plugin.

Have you compared the paths of the jars from each of the runs? Are the paths exactly the same? If not, then they would be considered separate issues. I've looked through the plugin code and don't see anything that would cause this issue randomly. You may want to diff the DC XML files.

from dependency-check-sonar-plugin.

Also, can you provide me the exact version of a few jars that you've seen this with?

from dependency-check-sonar-plugin.

@stevespringett , you are right. Actually, the alerts were reported on different type files: in war and individual jar. But the incorrect alert behavior is not consistent, not figure out when it was reported again.

I think the reason should be alerts status had been moved to FIXED, so sonar treat them as new issues.

Please find one sample jar: jackson-mapper-asl-1.9.13.jar.

By the way, any more detail about this?

You may want to diff the DC XML files.

from dependency-check-sonar-plugin.

This still appears to be an issue with version 1.1.2 of this plugin, and version 6.7.6 of SonarQube.

It seems that the "key" of the issue changes with each run, causing the issues to be marked as "isNew" in the JSON report, which in turn ends up falsely marking some builds as introducing "new" issues that have been around for months.

from dependency-check-sonar-plugin.

Hi,
please checkout new version of this plugin.
1.1.4 for Sonarqube 6.7.5 and above
1.2.3 for Sonarqube 7.6 and above

from dependency-check-sonar-plugin.

Should be fixed with actual version of this plugin. This plugin looks for a pom.xml or gradle.build in your project to link issue against this files.

from dependency-check-sonar-plugin.