OSS Index now Requires Credentials
## Issue
[Version 12.1.5 of DependencyCheck has responded to the fact that OSS Index now requires credentials](https://github.com/dependency-check/DependencyCheck/blob/main/CHANGELOG.md#version-1215-2025-09-20).
Scanning without these credentials set will fail with:
```
2025-09-20 22:09:20,302 ERROR Engine - Exception occurred initializing Sonatype OSS Index Analyzer.
...
Execution error (ExceptionCollection) at org.owasp.dependencycheck.Engine/analyzeDependencies (Engine.java:690).
One or more exceptions occurred during analysis:
InitializationException: Error initializing OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required
```
## Thoughts
Clj-watson's design of passing through env vars could make this a documentation change only.
```
CLJ_WATSON_ANALYZER_OSSINDEX_USER=<my oss index username>
CLJ_WATSON_ANALYZER_OSSINDEX_PASSWORD=<my oss index password>
```
Another alternative would be to disable usage of ossindex.
But since it is [enabled by default](https://github.com/dependency-check/DependencyCheck/blob/ebee56eaa8763b41857243a4e1e44256f0a37930/core/src/main/resources/dependencycheck.properties#L86), maybe not such a good idea.
## Next Steps
I can take a peek, if that's helpful.
10 条评论