)]}'
{
  "commit": "df0e91de65cf9428f0f735065eba580e37183030",
  "tree": "bbf9e86f98954fb4ec6697ccdc62247b28287c95",
  "parents": [
    "b553aeeb05897df2b88a1094f7ab03b8f36b0466"
  ],
  "author": {
    "name": "Grainier",
    "email": "grainier@wso2.com",
    "time": "Mon Oct 07 23:05:57 2019 -0700"
  },
  "committer": {
    "name": "hchen9",
    "email": "hchen9@ebay.com",
    "time": "Mon Oct 07 23:05:57 2019 -0700"
  },
  "message": "[EAGLE-1102] Integrate CVE maven plugin\n\n\u003c!--\n{% comment %}\nLicensed to the Apache Software Foundation (ASF) under one or more\ncontributor license agreements.  See the NOTICE file distributed with\nthis work for additional information regarding copyright ownership.\nThe ASF licenses this file to you under the Apache License, Version 2.0\n(the \"License\"); you may not use this file except in compliance with\nthe License.  You may obtain a copy of the License at\n\nhttp://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n{% endcomment %}\n--\u003e\n\n## Purpose\nPurpose of this pull request is to integrate the CVE maven plugin for eagle to check security vulnerabilities in dependencies during build time. This will help to detect publicly disclosed vulnerabilities contained within eagle\u0027s dependencies (and the dependencies of all child modules).\n\n## Usage\n\nThis plugin configuration is attached to the `mvn verify` phase. Therefore, this will run automatically when we perform a `mvn clean verify`. Once the `mvn` process is completed, the plugin will create a `dependency-check-report.html` report in `target/` dir with the detect vulnerabilities.\n\nIn case if you need to skip this plugin, use `owasp.check.skip\u003dtrue` property (i.e `mvn clean verify -Dowasp.check.skip\u003dtrue`).\n\n## Remarks\n- Fixes https://issues.apache.org/jira/browse/EAGLE-1102\n- https://issues.apache.org/jira/browse/EAGLE-1100\n- https://github.com/jeremylong/DependencyCheck\n- https://jeremylong.github.io/DependencyCheck/dependency-check-maven/aggregate-mojo.html\n- https://jeremylong.github.io/DependencyCheck/general/suppression.html\n---\n\nBe sure to do all of the following to help us incorporate your contribution\nquickly and easily:\n\n - [x] Make sure the PR title is formatted like:\n   `[EAGLE-\u003cJira issue #\u003e] Description of pull request`\n - [x] Make sure tests pass via `mvn clean verify`. (Even better, enable\n       Travis-CI on your fork and ensure the whole test matrix passes).\n - [x] Replace `\u003cJira issue #\u003e` in the title with the actual Jira issue\n       number, if there is one.\n - [ ] If this contribution is large, please file an Apache\n       [Individual Contributor License Agreement](https://www.apache.org/licenses/icla.txt).\n\n---\n\nAuthor: Grainier \u003cgrainier@wso2.com\u003e\n\nCloses #1005 from grainier/EAGLE-1102.\n",
  "tree_diff": [
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "6121f997d144fa0b4658da63b5de8d3890c2f0d1",
      "new_mode": 33188,
      "new_path": "eagle-dev/owasp-dependency-check-suppression.xml"
    },
    {
      "type": "modify",
      "old_id": "7d479c3ed8f5462a5cb9cf5b57f37abb8d278826",
      "old_mode": 33261,
      "old_path": "pom.xml",
      "new_id": "00962ffa3730cd261f4de0adfcc1b86ce9c93daf",
      "new_mode": 33261,
      "new_path": "pom.xml"
    }
  ]
}