Skip to content

[feature request] automate CVE detection #15853

Closed
Closed
[feature request] automate CVE detection#15853

Description

@kevinjqliu
kevinjqliu
opened on Apr 1, 2026

For java/gradle. Goal is to catch CVE's proactively

Perhaps we can explore CodeQL for java, https://docs.github.com/en/enterprise-cloud@latest/code-security/how-tos/scan-code-for-vulnerabilities/manage-your-configuration/codeql-code-scanning-for-compiled-languages?learn=code_security_actions

Or use a sandboxed version of trivy thats blessed by asf infra, apache/infrastructure-actions#582

Someone mentioned renovate as well, https://github.com/renovatebot/renovate

Activity

  1. manuzhang commented on Apr 7, 2026

    @manuzhang
    manuzhang
    on Apr 7, 2026
    Member

    Did we have security report by dependabot before?

  2. kevinjqliu commented on Jul 2, 2026

    @kevinjqliu
    kevinjqliu
    on Jul 2, 2026
    ContributorAuthor

    closed by #16291

  3. kevinjqliu
    closed this as completedon Jul 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions