OWASP depedency scan via Azure devops pipeline taking longer time as expected

[Naveenjalli99]

Hi Team,
We are getting below error when executing OWASP depedency scan via Azure devops pipeline. Downloading Dependency Check 12.1.3 installer from GitHub.. Cannot read properties of undefined (reading 'find') ##[error]Cannot read properties of undefined (reading 'find') After some troubleshooting i tried to apply fix indicated at :-https://blogs.blackmarble.co.uk/rfennell/ado-cache-issue-stopping-dependancy-check/ But, unfortunately the pipeline Task consuming a very long time. I am running the pipeline on azure agent pools which are ephimeral. I believe there two issues here. 1. Might be some Bug in v6.3.0 of this extension and 2. Does NVD key reduce scan time ? If yes then despite using NVD key in pipeline the scan taking very long time or my understanding is not correct ? One possible work around , i can think of is to run the OWASP scan task alone on a dedicated agent which will have the dependencies cached and subsequent scans will be faster So let me know the possible ways to fix this issue.

[chadlwilson]

Note that this project does not support the ADO extension, and does not support 12.1.3. You should be using 12.2.2 or 13.0.0.

See #8633 for discussion on recent NVD API problems.

Maybe look at https://github.com/dependency-check/azuredevops/issues?q=is%3Aissue%20state%3Aopen%20cache to see what people do for caching.

See https://dependency-check.github.io/DependencyCheck/data/cacheh2.html and https://dependency-check.github.io/DependencyCheck/data/mirrornvd.html for options to reduce dependency on NVD at runtime.

No idea which approaches ADO supports, but if there is no easy way to cache the data dir/database, I'd be using the nvdDataFeed option with ODC's own cache.