NIST NVD URL no longer works

Logs:

$ dependency-check --updateonly
[INFO] Checking for updates
[INFO] starting getUpdatesNeeded() ...
[ERROR] IO Exception: HEAD request returned a non-200 status code
[ERROR] IO Exception: HEAD request returned a non-200 status code
[ERROR] IO Exception: HEAD request returned a non-200 status code
[ERROR] IO Exception: HEAD request returned a non-200 status code
[WARN] Unable to download the NVD CVE data; the results may not include the most recent CPE/CVEs from the NVD.
[INFO] If you are behind a proxy you may need to configure dependency-check to use the proxy.
[ERROR] IO Exception: HEAD request returned a non-200 status code
[ERROR] IO Exception: HEAD request returned a non-200 status code

It looks like this URL: https://nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-modified.xml.gz no longer works and has been changed to https://nvd.nist.gov/feeds/xml/cve/2.0/nvdcve-2.0-modified.xml.gz.

We are seeing the same issues from the gradle plugin as well. Let me know if more information is needed.

[zerogvt]

This looks like a permanent change in their URL scheme. The difference seems to be adding xml schema version in the URL (…xml/cve/2.0/… instead of …xml/cve/…). From a quick visual check here all feed links seem to follow the new scheme.

Anyway, seems we can work around this by configuring the new URL. In a gradle build script this looks like:

dependencyCheck {
     cve {
         url20Modified = 'https://nvd.nist.gov/feeds/xml/cve/2.0/nvdcve-2.0-modified.xml.gz'
         url20Base = 'https://nvd.nist.gov/feeds/xml/cve/2.0/nvdcve-2.0-%d.xml.gz'
     }

Documentation: https://jeremylong.github.io/DependencyCheck/dependency-check-gradle/configuration-update.html

[stevespringett]

v3.1.2 was released today which resolves this issue.