Add version of https://nvd.nist.gov/ to report

[dependency-check]

Add version of https://nvd.nist.gov/ to report

[jeremylong]

If you look at the sample report, at the top you'll see a Scan Information (show more) section. Click the show more link and it will expand to include a line that states:

NVD CVE Modified: 09/10/2016 06:04:43

While there are other NVD CVE dates listed - the only one that matters is the modified date. Basically, dependency-check downloads all of the CVE data from the NVD Data Feeds - the first time it runs it downloads everything. After the first run, if you update at least once every 7 days only the modified file is downloaded as that contains all of the changes to any of the other files.

[emartynov]

Found it! Thank you!

[jeremylong]

I don't believe that is the exact date as displayed by the NVD - however, it is the date when the data was downloaded.

[emartynov]

Should I reopen ticket?

[jeremylong]

It is working as *I* intended; dependency-check is not actually using the last modified dates from the NVD XML Meta data. Instead, it is using the last modified HTTP Header. I don't believe this needs to be changed. I was more posting my above comment to add clarity as to why the dates may not match exactly. For files other then the modified XML, the dates may not actually change over time as we are not pulling those files - we are only pulling the last modified and updating the necessary data. So the data for the given years is up-to-date, but the XML files for that year may not have been downloaded for quite some time.

…

On Tue, Dec 13, 2016 at 6:27 AM, Eugen Martynov ***@***.***> wrote: Should I reopen ticket? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#28 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA0qwkwk7w4qHfHbxlJp5o1UfqP5s7T_ks5rHoElgaJpZM4LKcS1> .

[emartynov]

Do you think it is valueable to see dates for updates, not for dates for download time?

[jeremylong]

I think it is fine the way it working.

…

On Tue, Dec 13, 2016 at 7:15 AM, Eugen Martynov ***@***.***> wrote: Do you think it is valueable to see dates for updates, not for dates for download time? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#28 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA0qwpdHeFX7KbpmDX5EaEWorJQ-TTu9ks5rHoxpgaJpZM4LKcS1> .

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.