docs: update NVD API key setup and troubleshooting guide for 403/404 … - #8
Conversation
There was a problem hiding this comment.
Pull request overview
This PR improves guidance and configuration around OWASP Dependency-Check’s NVD integration (addressing 403/404 auth failures) and also updates dependency management to remediate ZooKeeper CVEs.
Changes:
- Add a detailed troubleshooting guide for NVD 403/404 errors and expand the existing API key setup doc.
- Update
dependency-check-mavenconfiguration to accept an NVD API key via-Dnvd.apiKeyand setnvdValidForHours. - Override the transitive ZooKeeper version to
3.9.3(with log4j-related exclusions) to address known CVEs.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
pom.xml |
Adds ZooKeeper override and updates Dependency-Check plugin configuration for NVD API key usage. |
TROUBLESHOOTING_NVD_403.md |
New end-to-end guide for diagnosing and resolving NVD 403/404 failures. |
NVD_API_KEY_SETUP.md |
Adds a focused troubleshooting section for NVD 403/404 and common misconfigurations. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| And the `pom.xml` includes: | ||
|
|
||
| ```xml | ||
| <nvdApiKey>${nvd.apiKey}</nvdApiKey> | ||
| <nvdApiDelay>6000</nvdApiDelay> | ||
| <nvdMaxRetryCount>10</nvdMaxRetryCount> | ||
| ``` | ||
|
|
||
| This configuration: | ||
| - Reads the secret from GitHub Actions | ||
| - Passes it to Maven as a system property | ||
| - Plugin picks it up and uses it for NVD API calls | ||
| - Waits 6 seconds between requests to avoid rate limiting | ||
| - Retries up to 10 times if NVD returns temporary errors | ||
|
|
There was a problem hiding this comment.
This section says the pom.xml includes <nvdApiDelay> and <nvdMaxRetryCount> and explains 6s delays/10 retries, but the current pom.xml configuration in this PR only adds <nvdApiKey> and <nvdValidForHours>. Either add the referenced settings to pom.xml or adjust this troubleshooting guide to match the actual configuration so readers aren’t misled.
…errors