Test package deny list 9

.github/dependency-review-config.yml

@@ -65,9 +65,9 @@ deny_packages:
   - 'pkg:maven/org.apache.logging.log4j/[email protected]'
   - 'pkg:maven/org.apache.logging.log4j/[email protected]'
 # Any number of groups (namespaces in purl format) to block in a PR.
-deny_groups:
+#deny_groups:
   # All log4j v1
-  - 'pkg:maven/log4j'
+  #- 'pkg:maven/log4j'
 # Enable or disable retrying the action every 10 seconds while waiting for dependency submission actions to complete.
 # This will have no effect on GHES until the Dependency Submission API is available.
 retry_on_snapshot_warnings: true
@@ -78,4 +78,4 @@ warn_only: true
 # We are not going to run license checks for now.
 # We will look into running them later.
 # This check doesn't run on GHES anyway due to limitations in the API, so enabling it would only change things in github.com
-license_check: false
+license_check: false

.github/workflows/DependencyReview.yml

@@ -14,12 +14,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v3
+        uses: actions/dependency-review-action@v4
         with:
           # This argument supplies the configuration file in this repo to your action.
           config-file: './.github/dependency-review-config.yml'
           # You only need this if the repo containing the config file is not publicly accessible.
           # This currently includes all GHES repos.
-          #external-repo-token: ${{ secrets.GITHUB_TOKEN }} # or a personal access token
+          #external-repo-token: ${{ secrets.GITHUB_TOKEN }} # or a personal access token

my-app/pom.xml

@@ -19,6 +19,12 @@
   </properties>
 
   <dependencies>
+    <!-- https://mvnrepository.com/artifact/log4j/log4j -->
+    <dependency>
+        <groupId>log4j</groupId>
+        <artifactId>log4j</artifactId>
+        <version>1.2.17</version>
+    </dependency>
     <dependency>
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>