stuartraetaylor/dependency-check-gradle

The dependency-check gradle plugin allows projects to monitor dependent libraries for known, published vulnerabilities.

Dependency-Check-Gradle

The dependency-check gradle plugin allows projects to monitor dependent libraries for known, published vulnerabilities.

Current Release

The latest version is

Usage

Below are the quick start instructions. Please see the documentation site for more detailed information on configuration and usage.

Step 1, Apply dependency check gradle plugin

Install from Maven central repo

buildscript {
    repositories {
        mavenCentral()
    }
    dependencies {
        classpath 'org.owasp:dependency-check-gradle:8.4.1'
    }
}

apply plugin: 'org.owasp.dependencycheck'

Step 2, Run gradle task

Once gradle plugin applied, run following gradle task to check dependencies:

gradle dependencyCheckAnalyze --info

The reports will be generated automatically under build/reports directory.

If your project includes multiple sub-projects, the report will be generated for each sub-project in their own build/reports.

FAQ

Questions List:

• What if my project includes multiple sub-project? How can I use this plugin for each of them including the root project?
• How to customize the report directory?

What if my project includes multiple sub-project? How can I use this plugin for each of them including the root project?

Try put 'apply plugin: "dependency-check"' inside the 'allprojects' or 'subprojects' if you'd like to check all sub-projects only, see below:

(1) For all projects including root project:

buildscript {
  repositories {
    mavenCentral()
  }
  dependencies {
    classpath 'org.owasp:dependency-check-gradle:8.4.1'
  }
}

allprojects {
    apply plugin: 'org.owasp.dependencycheck'
}

(2) For all sub-projects:

buildscript {
  repositories {
    mavenCentral()
  }
  dependencies {
    classpath 'org.owasp:dependency-check-gradle:8.4.1'
  }
}

subprojects {
    apply plugin: 'org.owasp.dependencycheck'
}

In this way, the dependency check will be executed for all projects (including root project) or just sub projects.

How to customize the report directory?

By default, all reports will be placed under build/reports folder, to change the default reporting folder name modify the configuration section like this:

subprojects {
    apply plugin: 'org.owasp.dependencycheck'

    dependencyCheck {
        outputDirectory = "$buildDir/security-report"
    }
}

How do I use the plugin with Gradle Kotlin DSL?

plugins {
    id("org.owasp.dependencycheck") version "8.4.1" apply false 
}

allprojects {
    apply(plugin = "org.owasp.dependencycheck")
}

configure<org.owasp.dependencycheck.gradle.extension.DependencyCheckExtension> {
    format = org.owasp.dependencycheck.reporting.ReportGenerator.Format.ALL.toString()
}