stops working once adding an NVD API key

[mirabilos]

Describe the bug
My employer has recently acquired an NVD API key, and I wanted to use it today.

So I did mvn -DnvdApiKey=… clean install in a test project, to the effect of it now just hanging:

[…]
[INFO] --- dependency-check:9.2.0:aggregate (owasp-check) @ hispring ---
[INFO] Checking for updates

Version of dependency-check used
The problem occurs using version 9.2.0 of the Maven plugin

Log file
There’s no log file under target/

To Reproduce
See above.

Expected behavior
See above.

Additional context
%

[linsomniac]

There are capacity problems with the NVD server requiring many retries (we've had jobs running 6 hours and having to kill them), see #6758 , could that be related? I know in that thread they have recommended upgrading to 10.0.1, which may also be worth trying.

[chadlwilson]

You must use v10. No versions of v9 will work with the current NVD API.

If you run with debug enabled you will see the real errors that are affecting you.

See #6746 or the release notes or the many other duplicate issues.

[mirabilos]

Chad Wilson dixit:

You must use v10. **No versions of v9 will work with the current NVD API.**

Ah, okay. I hadn’t seen there’s a new version yet, and since I checked only last week, I hadn’t thought to check. bye, //mirabilos -- Yes, I hate users and I want them to suffer. -- Marco d'Itri on gmane.linux.debian.devel.general

[mirabilos]

And, while I’ve got this thread open already: can I put the -D… into MAVEN_OPTS? Anything else would require changing the projects themselves, from what I see, which is neither universal nor really workable generically. Extraction via the environment or logs is not a concern in these use cases. (Internal Jenkins or local build.)

[chadlwilson]

That's more of a Maven question than anything to do with ODC or its plugins, but IIRC that's not what MAVEN_OPTS is for. Perhaps you can just test it?

And preferably close this issue to help the project clean up, given it is a duplicate.

[mirabilos]

(FTR, adding to MAVEN_OPTS seems to work, and upgrading to 10.x makes it work again as well, so the failure was unrelated to adding the API key.)