The sbt-dependency-check plugin allows projects to monitor dependent libraries for known, published vulnerabilities (e.g. CVEs). The plugin achieves this by using the awesome OWASP DependencyCheck library which already offers several integrations with other build and continuous integration systems. For more information on how OWASP DependencyCheck works and how to read the reports check the project's documentation.

• Getting started
• Usage
  • Tasks
  • Configuration
    • Analyzer Configuration
    • Advanced Configuration
  • Multi-Project setup
  • Changing Log Level
  • Global Plugin Configuration
  • Running behind a proxy
• Development
  • Release
• License

sbt-dependency-check is an AutoPlugin. Simply add the plugin to project/plugins.sbt file.

addSbtPlugin("net.vonbuchholtz" % "sbt-dependency-check" % "5.1.0")

Use sbt-dependency-check v2.0.0 or higher as previous versions aren't compatible with NVD feeds anymore. Starting with sbt-dependency-check v3.0.0 sbt v0.13.x is no longer supported.

The reports will be written to the default location crossTarget.value. This can be overwritten by setting dependencyCheckOutputDirectory. See Configuration for details.

Note: The first run might take a while as the full data from the National Vulnerability Database (NVD) hosted by NIST: https://nvd.nist.gov has to be downloaded and imported into the database. Later runs will only download change sets unless the last update was more than 7 days ago. It is recommended to set up a mirror of the NVD feed in your local network to reduce the risk of rate limiting. See https://github.com/stevespringett/nist-data-mirror for instructions.

sbt-dependency-check uses the default configuration of OWASP DependencyCheck. You can override them in your build.sbt files. Use the task dependencyCheckListSettings to print all available settings and their values to sbt console.

The following properties are used to configure the various file type analyzers. These properties can be used to turn off specific analyzers if it is not needed. Note, that specific analyzers will automatically disable themselves if no file types that they support are detected - so specifically disabling them may not be needed. For more information about the individual analyzers see the DependencyCheck Analyzer documentation.

The following properties can be configured in the plugin. However, they are less frequently changed. One exception may be the cvedUrl properties, which can be used to host a mirror of the NVD within an enterprise environment.

Use either Global or ThisBuild scope if you want to define a setting for all projects. Define on the project level if you want to diverge from the default or Global/ThisBuild setting for a specific project.

build.sbt

Global / dependencyCheckFormats := Seq("HTML", "JSON")

lazy val root = (project in file("."))
  .aggregate(core)
  .settings(
	libraryDependencies += "com.github.t3hnar" %% "scala-bcrypt" % "2.6" % "test",
	dependencyCheckSkipTestScope := false
  )

lazy val util = (project in file("util"))
  .settings(
    libraryDependencies += "commons-beanutils" % "commons-beanutils" % "1.9.1"
  )

lazy val core = project.dependsOn(util)
  .settings(
    libraryDependencies += "org.apache.commons" % "commons-collections4" % "4.1" % "runtime",
    dependencyCheckSkip := true
  )

Almost all settings are only evaluated for the project you are executing the task on, not for each individual sub-project. The exemption that are supported to work for aggregate() and dependsOn() projects, are the scope skipping settings:

• dependencyCheckSkip
• dependencyCheckSkipTestScope
• dependencyCheckSkipRuntimeScope
• dependencyCheckSkipProvidedScope
• dependencyCheckSkipOptionalScope

You should set these individually for each project if necessary.

Add the following to your build.sbt file to increase the log level from default info to e.g. debug.

logLevel in dependencyCheck := Level.Debug

and add -Dlog4j2.level=debug when running a check:

sbt -Dlog4j2.level=debug dependencyCheck

Replace dependencyCheck with the right task name that you use for your project.

If you want to apply some default configuration for all your SBT projects you can add them as Global Settings:

1. Add the plugin to ~/.sbt/1.0/plugins/sbt-dependency-check.sbt

   addSbtPlugin("net.vonbuchholtz" % "sbt-dependency-check" % "5.1.0")

2. Add settings at ~/.sbt/1.0/global.sbt using their fully qualified name (including package and nested object structure). E.g.

   net.vonbuchholtz.sbt.dependencycheck.DependencyCheckPlugin.autoImport.dependencyCheckFormat := "All"

For further information about global settings and plugins check the sbt documentation: https://www.scala-sbt.org/1.x/docs/Global-Settings.html

SBT and sbt-dependency-check both honor the standard http and https proxy settings for the JVM.

sbt -Dhttp.proxyHost=proxy.example.com \
    -Dhttp.proxyPort=3218 \
    -Dhttp.proxyUser=username \
    -Dhttp.proxyPassword=password \
    -DnoProxyHosts="localhost|http://www.google.com" \
    dependencyCheck

• Default h2 DB user and password can be found at dependencycheck.properties.
• To update ODC DB Schema for sbt scripted test case purgeDeletesDatabase run query Update PUBLIC.PROPERTIES t SET t."VALUE"= '<NEW_VERSION_NUMBER>' WHERE t.ID = 'version'

Run release task and follow instructions. Verify that release reached Maven Central. It takes up to two additional hours to be indexed for https://search.maven.org.

Copyright (c) 2016-2022 Alexander Baron v. Buchholtz

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

https://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.