diff --git a/config/tests/pom.xml b/config/tests/pom.xml
index 71be0b006..98f5862e8 100644
--- a/config/tests/pom.xml
+++ b/config/tests/pom.xml
@@ -35,6 +35,7 @@
true
true
true
+ true
diff --git a/etc/copyright-exclude.txt b/etc/copyright-exclude.txt
index d5e2acea2..de21e6d18 100644
--- a/etc/copyright-exclude.txt
+++ b/etc/copyright-exclude.txt
@@ -46,3 +46,4 @@ archetype-resources/pom.xml
src/main/java/org/jboss/weld/bean/proxy/ProxyFactory.java
etc/THIRD_PARTY_LICENSES.xml
etc/HELIDON_THIRD_PARTY_LICENSES.xml
+etc/dependency-check-suppression.xml
diff --git a/etc/dependency-check-suppression.xml b/etc/dependency-check-suppression.xml
new file mode 100644
index 000000000..1bdf3c643
--- /dev/null
+++ b/etc/dependency-check-suppression.xml
@@ -0,0 +1,138 @@
+
+
+
+
+
+
+ ^pkg:maven/io\.helidon\.microprofile\.server/helidon\-microprofile\-server@.*$
+ cpe:/a:oracle:http_server
+
+
+
+
+
+ ^pkg:maven/org\.glassfish/jsonp\-jaxrs@.*$
+ cpe:/a:processing:processing
+
+
+
+ ^pkg:maven/jakarta\.json/jakarta\.json\-api@.*$
+ cpe:/a:processing:processing
+
+
+
+
+
+ ^pkg:maven/org\.yaml/snakeyaml@.*$
+ CVE-2017-18640
+
+
+
+
+
+ ^pkg:javascript/bootstrap@.*$
+ CVE-2015-9251
+
+
+
+ ^pkg:javascript/bootstrap@.*$
+ CVE-2018-14040
+
+
+
+ ^pkg:javascript/bootstrap@.*$
+ CVE-2018-14041
+
+
+
+ ^pkg:javascript/bootstrap@.*$
+ CVE-2018-14042
+
+
+
+ ^pkg:javascript/bootstrap@.*$
+ CVE-2019-11358
+
+
+
+ ^pkg:javascript/bootstrap@.*$
+ CVE-2019-8331
+
+
+
+ ^pkg:javascript/bootstrap@.*$
+ CVE-2020-11022
+
+
+
+ ^pkg:javascript/bootstrap@.*$
+ CVE-2020-11023
+
+
+
+ ^pkg:javascript/bootstrap@.*$
+ reDOS - regular expression denial of service
+
+
+
+
+
+
+ ^pkg:maven/org\.mousio/etcd4j@.*$
+ cpe:/a:etcd:etcd
+
+
+
+
+
+ ^pkg:maven/jakarta\.websocket/jakarta\.websocket\-api@.*$
+ cpe:/a:java-websocket_project:java-websocket
+
+
+
+ ^pkg:maven/javax\.websocket/javax\.websocket\-api@.*$
+ cpe:/a:java-websocket_project:java-websocket
+
+
+
diff --git a/etc/scripts/owasp-dependency-check.sh b/etc/scripts/owasp-dependency-check.sh
new file mode 100755
index 000000000..59c54499f
--- /dev/null
+++ b/etc/scripts/owasp-dependency-check.sh
@@ -0,0 +1,52 @@
+#!/bin/bash -e
+#
+# Copyright (c) 2020 Oracle and/or its affiliates.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+set -o pipefail || true # trace ERR through pipes
+set -o errtrace || true # trace ERR through commands and functions
+set -o errexit || true # exit the script if any statement returns a non-true return value
+
+on_error(){
+ CODE="${?}" && \
+ set +x && \
+ printf "[ERROR] Error(code=%s) occurred at %s:%s command: %s\n" \
+ "${CODE}" "${BASH_SOURCE}" "${LINENO}" "${BASH_COMMAND}"
+}
+trap on_error ERR
+
+# Path to this script
+if [ -h "${0}" ] ; then
+ readonly SCRIPT_PATH="$(readlink "${0}")"
+else
+ readonly SCRIPT_PATH="${0}"
+fi
+
+# Path to the root of the workspace
+readonly WS_DIR=$(cd $(dirname -- "${SCRIPT_PATH}") ; cd ../.. ; pwd -P)
+
+readonly RESULT_FILE=$(mktemp -t XXXdependency-check-result)
+
+source ${WS_DIR}/etc/scripts/pipeline-env.sh
+
+die(){ cat ${RESULT_FILE} ; echo "Dependency report in ${WS_DIR}/target" ; echo "${1}" ; exit 1 ;}
+
+mvn ${MAVEN_ARGS} -Dorg.slf4j.simpleLogger.defaultLogLevel=WARN org.owasp:dependency-check-maven:aggregate \
+ -f ${WS_DIR}/pom.xml \
+ -Dtop.parent.basedir="${WS_DIR}" \
+ > ${RESULT_FILE} || die "Error running the Maven command"
+
+grep -i "One or more dependencies were identified with known vulnerabilities" ${RESULT_FILE} \
+ && die "CVE SCAN ERROR" || echo "CVE SCAN OK"
diff --git a/examples/pom.xml b/examples/pom.xml
index 4d99e3d3f..6956b328d 100644
--- a/examples/pom.xml
+++ b/examples/pom.xml
@@ -35,6 +35,7 @@
true
true
true
+ true
diff --git a/microprofile/tests/pom.xml b/microprofile/tests/pom.xml
index 34d4a17f1..5afed1b01 100644
--- a/microprofile/tests/pom.xml
+++ b/microprofile/tests/pom.xml
@@ -36,6 +36,7 @@
true
true
true
+ true
diff --git a/pom.xml b/pom.xml
index 7c801a4e5..bd950db35 100644
--- a/pom.xml
+++ b/pom.xml
@@ -45,6 +45,7 @@
false
Medium
+ false
false
+ io.helidon.tracing:helidon-tracing-tests
+ io.helidon.config.tests*
+ io.helidon.test*
+ io.helidon.examples*
+ io.helidon.microprofile.tests*
+
+ org.testng:testng
+
+
+ HTML
+ CSV
+
+
+
+ ${top.parent.basedir}/etc/dependency-check-suppression.xml
+
+
+
org.xolstice.maven.plugins
protobuf-maven-plugin
${version.plugin.protobuf}
+
com.google.protobuf:protoc:3.5.1-1:exe:${os.detected.classifier}
grpc-java
+
io.grpc:protoc-gen-grpc-java:${version.lib.grpc}:exe:${os.detected.classifier}
@@ -1146,6 +1179,24 @@ helidon-parent,helidon-dependencies,helidon-bom,helidon-se,helidon-mp,io.grpc,he
+
+ dependency-check
+
+
+
+ org.owasp
+ dependency-check-maven
+
+
+
+ check
+
+
+
+
+
+
+
checkstyle
diff --git a/tests/pom.xml b/tests/pom.xml
index dd4b20903..f9e87e5b3 100644
--- a/tests/pom.xml
+++ b/tests/pom.xml
@@ -38,6 +38,7 @@
true
true
true
+ true
diff --git a/tracing/tests/pom.xml b/tracing/tests/pom.xml
index a4704c941..954a7fae9 100644
--- a/tracing/tests/pom.xml
+++ b/tracing/tests/pom.xml
@@ -37,5 +37,6 @@
true
true
true
+ true