[DO NOT MERGE] Test: dependency-review gates should fail on GPL + vulnerable deps

[AndreasIgel]

⚠️ DO NOT MERGE — dependency-review gate test

This PR deliberately introduces two bad dependencies in example/pom.xml to prove the dependency-review gates actually fire. It is a draft and must not be merged.

Dependency	Why it should fail
com.mysql:mysql-connector-j:9.1.0	GPL-2.0 licensed → trips the license gate (deny-licenses on main; allow-licenses once #218 merges).
org.apache.logging.log4j:log4j-core:2.14.1	Log4Shell (CVE-2021-44228, critical) → trips the severity gate (fail-on-severity: high).

Expected result

The dependency-review check turns this PR red, reporting the denied license and the critical vulnerability. That is the pass condition for this experiment.

After you've confirmed the check goes red, this PR should be closed (not merged). Fork PRs need a maintainer "Approve and run" click before the check executes.

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ❌ 1 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA deb1f9e.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Vulnerabilities

example/pom.xml

Name	Version	Vulnerability	Severity
org.apache.logging.log4j:log4j-core	2.14.1	Incomplete fix for Apache Log4j vulnerability	critical
		Remote code injection in Log4j	critical
		Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion	high

Only included vulnerabilities with severity high or higher.

License Issues

example/pom.xml

Package	Version	License	Issue Type
com.mysql:mysql-connector-j	9.1.0	GPL-2.0-only WITH Universal-FOSS-exception-1.0 AND LicenseRef-github-OTHER	Incompatible License

Allowed Licenses:

MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, EPL-1.0, EPL-2.0, CDDL-1.0, CDDL-1.1, ISC, Unlicense, CC0-1.0

OpenSSF Scorecard

Package	Version	Score	Details
maven/org.apache.logging.log4j:log4j-core	2.14.1	Unknown	Unknown
maven/com.mysql:mysql-connector-j	9.1.0	🟢 5.5	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Maintained 🟢 10 13 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow ⚠️ -1 no workflows found Security-Policy 🟢 10 security policy file detected Token-Permissions ⚠️ -1 No tokens found CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected SAST ⚠️ 0 no SAST tool detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ -1 no dependencies found License 🟢 9 license file detected Fuzzing 🟢 10 project is fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches

Scanned Files

• example/pom.xml

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[AndreasIgel]

Test succeeded: dependency-review failed as designed (GPL-2.0 license + Log4Shell/CVE-2021-44228 critical vuln both tripped the gates). Closing without merging.