Fork me on GitHub
JProfiler Java Profiler developed using IntelliJ

Tasks

Task Description
dependencyCheckAnalyze Runs dependency-check against the project and generates a report.
dependencyCheckAggregate Runs dependency-check against a multi-project build and generates a report.
dependencyCheckUpdate Updates the local cache of the NVD data from NIST.
dependencyCheckPurge Deletes the local copy of the NVD. This is used to force a refresh of the data.

Configuration

buildscript {
    repositories {
        mavenCentral()
    }
    dependencies {
        classpath 'org.owasp:dependency-check-gradle:${project.version}'
    }
}
apply plugin: 'org.owasp.dependencycheck'

check.dependsOn dependencyCheckUpdate
Property Description Default Value
cveValidForHours Sets the number of hours to wait before checking for new updates from the NVD. 4
failOnError Fails the build if an error occurs during the dependency-check analysis. true

Example

dependencyCheck {
    cveValidForHours=1
}

Proxy Configuration

Config Group Property Description Default Value
proxy server The proxy server; see the proxy configuration page for more information.  
proxy port The proxy port.  
proxy username Defines the proxy user name.  
proxy password Defines the proxy password.  
proxy nonProxyHosts The list of hosts that do not use a proxy.  

Example

dependencyCheck {
    proxy {
        server=some.proxy.server
        port=8989
    }
}

Advanced Configuration

The following properties can be configured in the dependencyCheck task. However, they are less frequently changed. One exception may be the cvedUrl properties, which can be used to host a mirror of the NVD within an enterprise environment. Note, if ANY of the cve configuration group are set - they should all be set to ensure things work as expected.

Config Group Property Description Default Value
cve urlModified URL for the modified CVE JSON data feed. https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-modified.json.gz
cve urlBase Base URL for each year's CVE JSON data feed, the %d will be replaced with the year. https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-%d.json.gz
cve waitTime The time in milliseconds to wait between downloads from the NVD. 4000
cve startYear The first year of NVD CVE data to download from the NVD. 2002
data directory Sets the data directory to hold SQL CVEs contents. This should generally not be changed.  
data driver The name of the database driver. Example: org.h2.Driver.  
data driverPath The path to the database driver JAR file; only used if the driver is not in the class path.  
data connectionString The connection string used to connect to the database. See using a database server.  
data username The username used when connecting to the database.  
data password The password used when connecting to the database.  

Example

dependencyCheck {
    data {
        directory='d:/nvd'
    }
}