依赖检测

pom.xml

@@ -42,6 +42,11 @@
             <version>${log.version}</version>
         </dependency>
 
+        <dependency>
+            <groupId>org.owasp</groupId>
+            <artifactId>dependency-check-maven</artifactId>
+            <version>6.1.5</version>
+        </dependency>
     </dependencies>
 
     <build>
@@ -63,6 +68,23 @@
                     <target>8</target>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.owasp</groupId>
+                <artifactId>dependency-check-maven</artifactId>
+                <version>6.1.5</version>
+                <executions>
+                    <execution>
+                        <goals>
+                            <goal>check</goal>
+                        </goals>
+                    </execution>
+                </executions>
+                <configuration><!-- Generate all report formats -->
+                    <format>ALL</format><!-- Don't use Nexus Analyzer -->
+                    <centralAnalyzerEnabled>false</centralAnalyzerEnabled>
+                    <versionCheckEnabled>true</versionCheckEnabled>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 

sonar.cmd

@@ -1,3 +1,4 @@
+mvn clean compile dependency-check:check
 mvn sonar:sonar ^
   -Dsonar.projectKey=sydapi-sge-datebase ^
   -Dsonar.host.url=http://172.16.17.236:9000 ^