Workflow failed: OWASP dependency check (daily) (#748)

[github-actions]

See OWASP dependency check (daily) #748.

[trask]

An NVD API Key was not provided - it is highly recommended to use an NVD API key as the update can take a VERY long time without an API Key

oh, I forgot to pass NVD_API_KEY to the gradle dependencyCheck task, will fix... (#7126)

[github-actions]

See OWASP dependency check (daily) #749.

[trask]

I'm not sure why security scanning tools like to look into the META-INF maven pom files...

One or more dependencies were identified with known vulnerabilities in custom-checks:

dataflow-errorprone-3.41.0-eisop1.jar/META-INF/maven/com.google.guava/guava/pom.xml (pkg:maven/com.google.guava/guava@30.1.1-jre, cpe:2.3:a:google:guava:30.1.1:::::::*) : CVE-2023-2976, CVE-2020-8908

[jack-berg]

See #7128

[trask]

I'm not sure why security scanning tools like to look into the META-INF maven pom files...

in this case at least it was legitimate as guava is shaded inside of dataflow-errorprone-3.41.0-eisop1.jar