No Maven dependencies found in pipe bitbucket-dependency-scanner

[Niels van Nieuwenburg]

Hello,

We're integrating the bitbucket-dependency-scanner pipe into our pipeline in Bitbucket Cloud. It's a Java EE Maven project.

The pipe does detect a vulnerability in a .js file in ./WebContent/scripts/. However, it does not detect a vulnerability in our pom.xml. When running the OWASP dependency scanner Maven plugin, it does (only) detect the vulnerability in our pom.xml.

In the logs I can see our pom.xml being detected, just like our Maven Wrapper.

We're running the pipe in the following way:

- step: &dependency-scan
    name: 'Dependency scan'
    services:
      - docker
    caches:
      - docker
    script:
      - pipe: atlassian/bitbucket-dependency-scanner:0.8.0
        variables:
          NVD_API_KEY: $NVD_API_KEY
          EXTRA_ARGS:
            - "--failOnCVSS=7"
            - "--ossIndexUsername=$OSS_INDEX_USERNAME"
            - "--ossIndexPassword=$OSS_INDEX_PASSWORD"
          DEBUG: "true"
    artifacts:
      - dependency-check-report-*.log

[Niels van Nieuwenburg · Accepted solution]

I ended up solving it myself. With Maven, you need to build the project before running the dependency scanner. The scanner only analyzes the downloaded JAR files, not the pom.xml directly.

So the correct sequence is: first build, then run the scanner.

Good to know!