Hi everyone, I’m seeing an issue with the GitHub Actions OWASP Dependency-Check on my PR.
The check is failing because mysql-connector-j:9.7.0 is being reported with several CVEs having CVSS scores ≥ 6.2.
I also checked the dependency tree on master, and mysql-connector-j:9.7.0 is present there as well. I’m not sure if this is a current issue with the Dependency-Check workflow/vulnerability data or if I’m missing something.
Has anyone else seen the same failure recently?
Hi @waghmaretejas , this is a known issue — it’s not something you’re missing. mysql-connector-j:9.7.0 currently has 7 CVEs (CVSS 6.5–8.5) flagged by NVD, and it’s present on master too, so your PR isn’t the cause.
Per @dkayiwa’s analysis on a related PR (openmrs-core#5950), 3 of those 7 CVEs are actually Connector/Net false positives that leak in via the shared oracle:mysql_connectors CPE — so suppressing all 7 isn’t a durable fix. The recommended path is upgrading to mysql-connector-j 26.7.0 (available on Central), which sits outside the affected version range, rather than relaxing the CVSS threshold or adding suppressions. That upgrade is being tracked as its own separate ticket rather than bundled into unrelated PRs.
For now, you likely can’t unblock your own PR — worth flagging to a maintainer if it’s blocking merge.
Thanks a lot for the detailed explanation, @josephkagimu1 . This makes the situation much clearer, especially that the Dependency-Check failure is a known issue on master and isn’t caused by my PR. I’ll flag it to a maintainer and avoid making unrelated changes to TRUNK-6764 just to get the check to pass.