Skip to main content

Resolving Missing Translation Module Errors During OWASP Maven Dependency Checks in Bloomreach brXM

Updated

Issue

When running the OWASP Dependency Check on a Bloomreach Experience Manager (brXM) project (versions 16.2.0 through 16.4.0), users may encounter multiple errors indicating that translation modules (specifically, l10n JARs) cannot be found. This error typically appears when executing the following Maven command:

bash mvn verify org.owasp:dependency-check-maven:check 

Symptom

The error output contains lines similar to:

[ERROR] DependencyNotFoundException: Expected dependency not found in resolved artifacts for dependency org.onehippo.cms7:hippo-plugin-gallerypicker-l10n:jar:nl:16.2.0:compile 

This affects several translation modules across multiple brXM plugins and addons.

 

Root Cause

The observed errors are caused by Maven's inability to resolve certain language translation JARs (-l10n:jar:nl) for plugins and components used in the project. The issue is reproducible with the mvn verify org.owasp:dependency-check-maven:check command but may not occur under other command invocations or plugin configurations.

 

Workarounds & Solutions

1. Confirm Plugin Command Usage and Project Configuration

  • The command mvn verify org.owasp:dependency-check-maven:check fails due to the way Maven handles build phases and plugin goal bindings.
  • Running the command as:
    mvn org.owasp:dependency-check-maven:check (without verify) often completes successfully and provides the expected results. The discrepancy arises from how Maven resolves artifact lifecycles and plugin executions—particularly when the hippo-cms-l10n-maven-plugin is used with the package phase.

2. Plugin Configuration Recommendations

  • If you must configure the Dependency Check plugin in your pom.xml, place it in a separate Maven <profile> for clear scope and control.

Example plugin configuration for reference:
 

<properties>
   <maven.plugin.owasp-dependency-check.version>12.1.1</maven.plugin.owasp-dependency-check.version>
 </properties>
 
<profile>
     <id>dependency-check</id>
     <build>
       <plugins>
         <plugin>
           <groupId>org.owasp</groupId>
           <artifactId>dependency-check-maven</artifactId>
           <version>${maven.plugin.owasp-dependency-check.version}</version>
           <inherited>false</inherited>
           <executions>
             <execution>
               <goals>
                 <goal>aggregate</goal>
               </goals>
               <phase>validate</phase>
             </execution>
           </executions>
           <configuration>
             <nvdApiKey>**{Enter your key}**</nvdApiKey>
             <nodeAuditAnalyzerEnabled>true</nodeAuditAnalyzerEnabled>
             <nodeAnalyzerEnabled>false</nodeAnalyzerEnabled>
             <skipProvidedScope>true</skipProvidedScope>
             <skipRuntimeScope>true</skipRuntimeScope>
             <skipSystemScope>true</skipSystemScope>
             <skipTestScope>true</skipTestScope>
             <nodeAuditSkipDevDependencies>true</nodeAuditSkipDevDependencies>
             <suppressionFiles>
               <suppressionFile>project-suppression.xml</suppressionFile>
             </suppressionFiles>
             <formats>
               <format>HTML</format>
               <format>JUNIT</format>
               <format>JSON</format>
             </formats>
             <failOnError>false</failOnError>
           </configuration>
         </plugin>
       </plugins>
     </build>
   </profile>

Please adjust the plugin and lifecycle as needed for your build.

 

For more assistance or if you encounter further difficulties, please raise a support ticket with the details of your configuration and error output.

 

Related articles