Issue 6481 - Re-enable dependency checks

.github/workflows/dependency-check-changes.yaml

@@ -4,6 +4,9 @@ on:
     paths:
       - 'code-style/dependency-check-suppressions.xml'
       - 'java/**/pom.xml'
+    paths-ignore:
+      - '.github/workflows/dependency-check.yaml'
+      - '.github/workflows/dependency-check-workflow-changes.yaml'
 
 jobs:
   check:

.github/workflows/dependency-check-workflow-changes.yaml

@@ -9,4 +9,4 @@ jobs:
   check:
     uses: ./.github/workflows/dependency-check.yaml
     with:
-      failOnCacheMiss: true
+      failOnCacheMiss: false

.github/workflows/dependency-check.yaml

@@ -15,42 +15,41 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - run: echo "Disabled dependency checks temporarily, see https://github.com/gchq/sleeper/issues/6481"
-      # - uses: actions/checkout@v3
-      # - uses: actions/setup-java@v3
-      #   with:
-      #     java-version: '17'
-      #     distribution: 'corretto'
-      # - name: Get current date
-      #   id: date
-      #   run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
-      # - name: Restore cache of Maven dependencies & CVEs database
-      #   uses: actions/cache/restore@v5
-      #   id: restore-cache
-      #   with:
-      #     path: ${{ runner.temp }}/.m2/repository
-      #     key: ${{ runner.os }}-dependency-check-${{ steps.date.outputs.date }}
-      #     fail-on-cache-miss: ${{ inputs.failOnCacheMiss }}
-      #     restore-keys: |
-      #       ${{ runner.os }}-dependency-check-
-      # - name: Resolve dependencies
-      #   run: mvn de.qaware.maven:go-offline-maven-plugin:resolve-dependencies -Dmaven.repo.local=${{ runner.temp }}/.m2/repository
-      #   working-directory: ./java
-      # - name: Update CVEs database
-      #   run: mvn --batch-mode dependency-check:update-only -Dmaven.repo.local=${{ runner.temp }}/.m2/repository
-      #   working-directory: ./java
-      # - name: Build with Maven
-      #   run: mvn --batch-mode verify dependency-check:aggregate -Pquick,skipShade -DskipRust -Dmaven.repo.local=${{ runner.temp }}/.m2/repository
-      #   working-directory: ./java
-      # - name: Cache Maven dependencies & CVEs database
-      #   uses: actions/cache/save@v5
-      #   if: ${{ always() && inputs.writeCache }}
-      #   with:
-      #     path: ${{ runner.temp }}/.m2/repository
-      #     key: ${{ steps.restore-cache.outputs.cache-primary-key }}
-      # - name: Upload dependency check report
-      #   if: ${{ always() }}
-      #   uses: actions/upload-artifact@v5
-      #   with:
-      #     name: Dependency check report
-      #     path: java/target/dependency-check-report.html
+      - uses: actions/checkout@v3
+      - uses: actions/setup-java@v3
+        with:
+          java-version: '17'
+          distribution: 'corretto'
+      - name: Get current date
+        id: date
+        run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
+      - name: Restore cache of Maven dependencies & CVEs database
+        uses: actions/cache/restore@v5
+        id: restore-cache
+        with:
+          path: ${{ runner.temp }}/.m2/repository
+          key: ${{ runner.os }}-dependency-check-${{ steps.date.outputs.date }}
+          fail-on-cache-miss: ${{ inputs.failOnCacheMiss }}
+          restore-keys: |
+            ${{ runner.os }}-dependency-check-
+      - name: Resolve dependencies
+        run: mvn de.qaware.maven:go-offline-maven-plugin:resolve-dependencies -Dmaven.repo.local=${{ runner.temp }}/.m2/repository
+        working-directory: ./java
+      - name: Update CVEs database
+        run: mvn --batch-mode dependency-check:update-only -Dmaven.repo.local=${{ runner.temp }}/.m2/repository
+        working-directory: ./java
+      - name: Build with Maven
+        run: mvn --batch-mode verify dependency-check:aggregate -Pquick,skipShade -DskipRust -Dmaven.repo.local=${{ runner.temp }}/.m2/repository
+        working-directory: ./java
+      - name: Cache Maven dependencies & CVEs database
+        uses: actions/cache/save@v5
+        if: ${{ always() && inputs.writeCache }}
+        with:
+          path: ${{ runner.temp }}/.m2/repository
+          key: ${{ steps.restore-cache.outputs.cache-primary-key }}
+      - name: Upload dependency check report
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v5
+        with:
+          name: Dependency check report
+          path: java/target/dependency-check-report.html

code-style/dependency-check-suppressions.xml

@@ -159,6 +159,15 @@
         <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.http2/http2-common@.*$</packageUrl>
         <vulnerabilityName>CVE-2025-5115</vulnerabilityName>
     </suppress>
+    <suppress>
+        <notes><![CDATA[
+        This dependency is brought in through Trino, and our Trino plugin is currently experimental. To upgrade Trino
+        we also need to upgrade Java. AWS EMR does not yet support using Apache Spark with versions of Java beyond 17,
+        so we are not currently able to upgrade.
+        ]]>        </notes>
+        <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.http2/http2-client@.*$</packageUrl>
+        <cve>CVE-2025-5115</cve>
+    </suppress>
     <suppress>
         <notes><![CDATA[
         DOMPurify is only used by WireMock, which is only used for tests. We're not able to upgrade to a later version
@@ -177,4 +186,78 @@
         <packageUrl regex="true">^pkg:maven/org\.xmlunit/xmlunit-core@.*$</packageUrl>
         <cve>CVE-2024-9410</cve>
     </suppress>
+    <suppress>
+        <notes><![CDATA[
+         The AWS CDK uses a vulnerable Ruby gem. Once there's a version of the CDK that doesn't, we can use that instead.
+
+        file name: cdk-asset-awscli-v1-2.2.273.jar: asset-awscli-v1@2.2.273.jsii.tgz: asset-awscli-v1@2.2.273.jsii.tar:
+        layer.zip: endpoint-rule-set-1.json.gz
+        ]]>        </notes>
+        <cve>CVE-2020-28267</cve>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+        Vulnerability exists as part of latest version of library. Once a newer version is available, suppression can
+        be removed.
+
+        file name: handlebars-4.5.0.jar: handlebars-v4.7.7.js
+        ]]>        </notes>
+        <packageUrl regex="true">^pkg:javascript/handlebars@.*$</packageUrl>
+        <vulnerabilityName regex="true">CVE-2026-33937|CVE-2026-33938|CVE-2026-33940|CVE-2026-33939|CVE-2026-33916|CVE-2026-33941</vulnerabilityName>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+        Vulnerability exists as part of packages used within spark. Unable to upgrade as need to align with
+        spark version for AWS EMR.
+
+        file name: http2-client-11.0.25.jar
+        file name: http2-http-client-transport-11.0.25.jar
+        file name: http2-server-11.0.25.jar
+        file name: jetty-io-11.0.25.jar
+        ]]>        </notes>
+        <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.http2/http2-.*$|^pkg:maven/org\.eclipse\.jetty/jetty-.*$</packageUrl>
+        <cve>CVE-2025-11143</cve>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+        Vulnerability exists as part of packages used within spark. Unable to upgrade as need to align with
+        spark version for AWS EMR.
+
+        file name: http2-http-client-transport-11.0.25.jar
+        file name: http2-server-11.0.25.jar
+        file name: jetty-io-11.0.25.jar
+        ]]>        </notes>
+        <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.http2/http2-.*$|^pkg:maven/org\.eclipse\.jetty/jetty-.*$</packageUrl>
+        <cve>CVE-2025-5115</cve>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+        Brought in as part of jib-core. Presently on the latest version, so unable to fix presently. Once a newer
+        version is available, suppression could possibly be removed.
+
+        file name: jib-build-plan-0.4.0.jar
+        ]]>        </notes>
+        <packageUrl regex="true">^pkg:maven/com\.google\.cloud\.tools/jib-build-plan@.*$</packageUrl>
+        <cve>CVE-2026-3136</cve>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+        Versions are contained as part of trino so are unable to be upgraded as we need to maintain version
+        compatibility.
+
+        file name: opentelemetry-semconv-1.21.0-alpha.jar
+        ]]>        </notes>
+        <packageUrl regex="true">^pkg:maven/io\.opentelemetry\.semconv/opentelemetry-semconv@.*$</packageUrl>
+        <vulnerabilityName regex="true">CVE-2026-39883|CVE-2026-39882</vulnerabilityName>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+        This dependency is only used by WireMock, which is only used for tests.
+
+        file name: wiremock-3.13.2.jar: swagger-ui-bundle.js
+        file name: wiremock-3.13.2.jar: swagger-ui-es-bundle.js
+        ]]>        </notes>
+        <packageUrl regex="true">^pkg:javascript/DOMPurify@.*$</packageUrl>
+        <vulnerabilityName regex="true">CVE-2026-0540|CVE-2025-15599</vulnerabilityName>
+    </suppress>
 </suppressions>