From 505d9783bcb9b29f4f75514153eb9697985f7b25 Mon Sep 17 00:00:00 2001
From: Colton Capps <cjcapps@ksu.edu>
Date: Wed, 19 Aug 2026 14:01:17 -0500
Subject: [PATCH 1/2] Standardize OWASP dependency-check aggregate execution

Bind dependency-check:aggregate to the verify phase so the scan runs as part
of the build, and align configuration across repos: nvdApiKey and
ossIndexServerId are now set everywhere. failBuildOnCVSS is left commented
out except where it was already enabled.
---
 pom.xml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/pom.xml b/pom.xml
index c2ce737..b40ca20 100644
--- a/pom.xml
+++ b/pom.xml
@@ -12,6 +12,7 @@
 
   <properties>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+    <version.dependency-check-maven>12.2.2</version.dependency-check-maven>
   </properties>
   <modules>
     <module>duo-client</module>
@@ -20,4 +21,29 @@
 
   <repositories>
   </repositories>
+
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.owasp</groupId>
+        <artifactId>dependency-check-maven</artifactId>
+        <version>${version.dependency-check-maven}</version>
+        <configuration>
+          <!-- <failBuildOnCVSS>8</failBuildOnCVSS> -->
+          <nvdApiKey>${nvd.api.key}</nvdApiKey>
+          <ossIndexServerId>ossindex</ossIndexServerId>
+        </configuration>
+        <inherited>false</inherited>
+        <executions>
+          <execution>
+            <id>aggregate-check</id>
+            <phase>verify</phase>
+            <goals>
+              <goal>aggregate</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
+    </plugins>
+  </build>
 </project>

From 9db4c64fc5b3cb87360f6fec61ae866f9a0d5584 Mon Sep 17 00:00:00 2001
From: Colton Capps <cjcapps@ksu.edu>
Date: Thu, 20 Aug 2026 15:10:55 -0500
Subject: [PATCH 2/2] Run dependency-check during compile

Bind the aggregate execution to the compile phase instead of verify so
vulnerable dependencies surface before the rest of the build runs. Turn
plugin scanning off and NVD auto-update on across every project.
---
 pom.xml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index b40ca20..bf977ea 100644
--- a/pom.xml
+++ b/pom.xml
@@ -32,12 +32,14 @@
           <!-- <failBuildOnCVSS>8</failBuildOnCVSS> -->
           <nvdApiKey>${nvd.api.key}</nvdApiKey>
           <ossIndexServerId>ossindex</ossIndexServerId>
+          <scanPlugins>false</scanPlugins>
+          <autoUpdate>true</autoUpdate>
         </configuration>
         <inherited>false</inherited>
         <executions>
           <execution>
             <id>aggregate-check</id>
-            <phase>verify</phase>
+            <phase>compile</phase>
             <goals>
               <goal>aggregate</goal>
             </goals>