maven: add OWASP dependency-check to build
It's really slow, so off always for now.
To run manually: `mvn -f projects verify -Ddependency-check.skip=false`
<!-- The versions of Apache Maven plugins used. Please keep alphabetical.-->
<antlr4-maven-plugin.version>4.7.2</antlr4-maven-plugin.version>
+ <dependency-check-plugin.version>5.3.2</dependency-check-plugin.version>
<maven-checkstyle-plugin.version>3.1.0</maven-checkstyle-plugin.version>
<maven-compiler-plugin.version>3.6.1</maven-compiler-plugin.version>
<maven-dependency-plugin.version>3.0.1</maven-dependency-plugin.version>
<artifactId>jacoco-maven-plugin</artifactId>
<version>${maven-jacoco-plugin.version}</version>
</plugin>
+
+ <plugin>
+ <groupId>org.owasp</groupId>
+ <artifactId>dependency-check-maven</artifactId>
+ <version>${dependency-check-plugin.version}</version>
+ <configuration>
+ <skip>true</skip>
+ <failBuildOnCVSS>8</failBuildOnCVSS>
+ </configuration>
+ </plugin>
</plugins>
</pluginManagement>
</execution>
</executions>
</plugin>
+
+ <plugin>
+ <groupId>org.owasp</groupId>
+ <artifactId>dependency-check-maven</artifactId>
+ <executions>
+ <execution>
+ <goals>
+ <goal>check</goal>
+ </goals>
+ </execution>
+ </executions>
+ </plugin>
</plugins>
</build>
