Cannot invoke "org.eclipse.aether.artifact.Artifact.getClassifier()" because the return value of "org.eclipse.aether.graph.DependencyNode.getArtifact()" is null

Hi,

I just bumped dependency-check-maven from 6.3.1 to 6.3.2 but I am getting the following error when executing:

mvn dependency-check:check

[ERROR] Failed to execute goal org.owasp:dependency-check-maven:6.3.2:check (default-cli) on project mn-aut: Execution default-cli of goal org.owasp:dependency-check-maven:6.3.2:check failed: Cannot invoke “org.eclipse.aether.artifact.Artifact.getClassifier()” because the return value of “org.eclipse.aether.graph.DependencyNode.getArtifact()” is null -> [Help 1]

My config looks like this:

<plugin>
    <groupId>org.owasp</groupId>
    <artifactId>dependency-check-maven</artifactId>
    <version>${owasp-check-plugin.version}</version>
    <configuration>
    <formats>XML,HTML</formats>
    <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
    <failBuildOnAnyVulnerability>true</failBuildOnAnyVulnerability>
    <suppressionFiles>
        <suppressionFile>${owasp.suppression.file}</suppressionFile>
    </suppressionFiles>
    </configuration>
    <executions>
    <execution>
        <goals>
        <goal>check</goal>
        </goals>
    </execution>
    </executions>
</plugin>

Am I missing some configuration here?

Running on OpenJDK 17 with target and source 14.

[aikebah]

@sanderino666 Must be your nick… when I now retrieve the component report for xstream 1.4.17 all the listed vulnerabilities contain an externalReference, nevertheless we’re better of by ensuring that even on the absence of external references we can still successfully parse the report.

[aikebah]

On second thought… I think @mprins is correct and your message is just the new improved NullPointerException feature that I’m not yet used to as I still have to code in Java 8 during my day-job.