From 797f2eaa15c8df364037aba863e07e92aade9b00 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 4 Dec 2023 22:43:25 +0000
Subject: [PATCH 1/2] chore(deps): Bump org.owasp.dependencycheck from 8.4.3 to
 9.0.2

Bumps org.owasp.dependencycheck from 8.4.3 to 9.0.2.

---
updated-dependencies:
- dependency-name: org.owasp.dependencycheck
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 build.gradle | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build.gradle b/build.gradle
index 46a55d4b6..433fb9534 100644
--- a/build.gradle
+++ b/build.gradle
@@ -9,7 +9,7 @@ plugins {
     id 'ca.cutterslade.analyze' version '1.9.1'
     id 'io.spring.dependency-management' version '1.1.4' apply false
     id 'org.springframework.boot' version '3.2.0' apply false
-    id 'org.owasp.dependencycheck' version '8.4.3'
+    id 'org.owasp.dependencycheck' version '9.0.2'
     id 'com.diffplug.spotless' version '6.23.3'
     id 'com.bmuschko.docker-spring-boot-application' version '9.4.0' apply false
 }

From e69ff604d8c79fcbd33ea5b5995fda60703346cc Mon Sep 17 00:00:00 2001
From: Timon Back <timonback@users.noreply.github.com>
Date: Fri, 8 Dec 2023 15:42:00 +0100
Subject: [PATCH 2/2] chore: add owasp nvd api key (in gh secrets)

---
 .github/workflows/owasp.yml | 3 ++-
 build.gradle                | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/owasp.yml b/.github/workflows/owasp.yml
index 450ac3ce9..ef866e57b 100644
--- a/.github/workflows/owasp.yml
+++ b/.github/workflows/owasp.yml
@@ -33,8 +33,9 @@ jobs:
 
       - name: Generate DependencyCheck report
         run: ./gradlew dependencyCheckAggregate
+        env:
+          ORG_GRADLE_PROJECT_OWASP_API_KEY: ${{ secrets.ORG_GRADLE_PROJECT_OWASP_API_KEY }}
       - name: upload-sarif-4
         uses: github/codeql-action/upload-sarif@v2
         with:
           sarif_file: ./build/reports/owasp-dependency-check/dependency-check-report.sarif
-
diff --git a/build.gradle b/build.gradle
index 433fb9534..5557d7f7e 100644
--- a/build.gradle
+++ b/build.gradle
@@ -201,6 +201,7 @@ allprojects {
 dependencyCheck {
     outputDirectory = "$buildDir/reports/owasp-dependency-check"
     formats = [ReportGenerator.Format.SARIF.toString()]
+    nvd.apiKey = project.findProperty("OWASP_API_KEY")
 }
 
 def static readEnvFile(path = ".env") {