Can't see CVEs (vulnerabilities) on Sonar UI under Project>Issues. Used to see them in the past. Has anything changed? about dependency-check-sonar-plugin HOT 7 CLOSED

Which version of SonarQube are you using? I have two categories and the issues are displayed in both. I am currently using the latest SonarQube LTS version.

from dependency-check-sonar-plugin.

@mansing2 Could it be that this was your first time using DependencyCheck 8.x for your analysis on Jenkins? (The Jenkins plugin is a wrapper that can run different version of DependencyCheck CLI) See #748

from dependency-check-sonar-plugin.

I'm having the same problem, after upgrading the maven dep-check plugin from 7.1.1 to 8.4.0, the vulnerabilities disappered from project issue section in sonarQube.

We run the report generation with this line:

mvn org.owasp:dependency-check-maven:8.4.0:check -Dformats=xml,html,json

After this, the reports can be found under target/ folder, but comparing the 8.4 and 7.1.1 version shows some diffs in the xml formats

This is our SonarQube version.
Community EditionVersion 8.9.10 (build 61524)

We updated the SonarQube plugin from version 3.0.1 to 3.1.0 but it doesnt' work.

from dependency-check-sonar-plugin.

@gusriobr That would then be something for an issue at https://github.com/dependency-check/dependency-check-sonar-plugin/issues

DependencyCheck's responsibility stops at the creation of the report files. How the information in those reports (which indeed changed a bit in format is put into the SonarQube issue registration is decided upon in the SonarQube plugin project (and may potentially be constrained by internal changes within SonarQube). The issue linked before indicates that the plugin has been updated to support the new format with their MR 758, but maybe there have been other changes too.

from dependency-check-sonar-plugin.

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 14 days.

from dependency-check-sonar-plugin.

This issue was closed because it has been stalled for 14 days with no activity.

from dependency-check-sonar-plugin.

8.9.10

I have also the same problem but solved it upgrading dependency-check-sonar-plugin to version 3.1.0.
#748 (comment)

from dependency-check-sonar-plugin.