[Jordanh1996]

https://jfrog-int.atlassian.net/browse/XRAY-167150

Background

Maven projects that take dependency versions from an imported BOM (<scope>import</scope>) were scanned with unknown versions by jf audit --static-sca and Frogbot V3, so CVEs in those dependencies were missed.

Description

Bump the default Xspecter (xray-scan-lib) version to 1.9.0, which resolves imported BOMs from the local Maven repository. Since 1.8.0, Xspecter runs Gradle only when told to (XRAY-161571), so we now send allowBuildExecution: true (jf audit and Frogbot scan the user's own project; without it, Gradle projects without a lockfile lose their transitive dependencies).

Tests

Local e2e against a real Xray, 1.6.0 vs 1.9.0: a multi-module Maven project with an external parent and an imported BOM now reports commons-text:1.9 and CVE-2022-42889. Gradle, npm, yarn, pip, poetry, go, maven and nuget test projects produce the same SBOM as before.

• The pull request is targeting the dev branch.
• All static analysis checks passed.
• All tests have passed. If this feature is not already covered by the tests, new tests have been added.
• Updated the Contributing page / ReadMe page / CI Workflow files if needed.

---

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization, Workspace
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 20f83dc9-8d47-4906-9a09-1bbfb67e3807

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

[github-actions]

👍 Frogbot scanned this pull request and did not find any new security issues.

---

🐸 JFrog Frogbot