JChen131640 (Community Member) asked a question.
Does SCA srcclr support Spring Boot 3.4.X? Following command works for Spring Boot 3.3.X and below:
srcclr scan /agent/_work/1/s/{codeLocation} --allow-dirty --debug --scm-uri https://{SCAProfile} --scm-rev=10 --scm-ref=master
but fails for Spring Boot 3.4.X with maven dependency error below:
com.sourceclear.engine.common.CollectionException: Maven dependency tree process failed
Can Veracode provide srcclr command WORKING with Spring Boot 3.4.2?
Following is scrclr, java, maven and git version used:
Veracode SCA CLI Version: 3.8.92
****************************** System Info ******************************
*
* Java version=17.0.6 Vendor=Azul Systems, Inc.
* Git version=2.25.1 Path=/usr/bin/git
* Maven version=3.9.7 Path=/opt/maven/bin/mvn
*
*
**************************************************************************
.png){kind=logo}
Hi @JChen131640 (Community Member) - We think that it's likely not a srcclr command issue. You should try running
mvn dependency:tree on the project to make sure that works first. We suspect it's a maven versioning issue, but you can at least try that first.
Thanks @SamHouston (Veracode) . We will try mvn dependency:tree. What's puzzling is that same srcclr command (with same maven/Java version works for Spring Boot 3.3.X and below, and same Spring Boot 3.4.2 builds fine with mvn clean-install. We do notice srcclr internally still uses Java 17 even though the default Java version is set to 21 in the VM. Do you know how to instruct srcclr to use Java 21 instead?