Fork me on GitHub

dependency-check:aggregate

Note:This goal should be used as a Maven report.

Full name:

org.owasp:dependency-check-maven:1.3.6:aggregate

Description:

Maven Plugin that checks project dependencies and the dependencies of all child modules to see if they have any known published vulnerabilities.

Attributes:

  • Requires a Maven project to be executed.
  • Requires dependency resolution of artifacts in scope: compile+runtime.
  • Binds by default to the lifecycle phase: verify.
  • Requires that Maven runs in online mode.

Required Parameters

Name Type Since Description
dataFileName String - Sets whether or not the external report format should be used.
Default value is: dependency-check.ser.
User property is: metaFileName.
failBuildOnCVSS float - Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11 which means since the CVSS scores are 0-10, by default the build will never fail.
Default value is: 11.
User property is: failBuildOnCVSS.
format String - The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this within the Site plug-in unless the externalReport is set to true. Default is HTML.
Default value is: HTML.
User property is: format.
name String - The name of the report in the site.
Default value is: dependency-check:aggregate.
User property is: name.
outputDirectory File - The output directory. This generally maps to "target".
Default value is: ${project.build.directory}.
reportOutputDirectory File - Specifies the destination directory for the generated Dependency-Check report. This generally maps to "target/site".
User property is: project.reporting.outputDirectory.

Optional Parameters

Name Type Since Description
aggregate Boolean - Deprecated. use the aggregate goal instead
User property is: aggregate.
archiveAnalyzerEnabled Boolean - Whether or not the Archive Analyzer is enabled.
User property is: archiveAnalyzerEnabled.
assemblyAnalyzerEnabled Boolean - Whether or not the .NET Assembly Analyzer is enabled.
User property is: assemblyAnalyzerEnabled.
autoUpdate Boolean - Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to false. Default is true.
User property is: autoUpdate.
autoconfAnalyzerEnabled Boolean - Sets whether or not the autoconf Analyzer should be used.
User property is: autoconfAnalyzerEnabled.
centralAnalyzerEnabled Boolean - Whether or not the Central Analyzer is enabled.
User property is: centralAnalyzerEnabled.
cmakeAnalyzerEnabled Boolean - Sets whether or not the CMake Analyzer should be used.
User property is: cmakeAnalyzerEnabled.
composerAnalyzerEnabled Boolean - Sets whether or not the PHP Composer Lock File Analyzer should be used.
User property is: composerAnalyzerEnabled.
connectionString String - The database connection string.
User property is: connectionString.
connectionTimeout String - The Connection Timeout.
User property is: connectionTimeout.
cveUrl12Base String - Base Data Mirror URL for CVE 1.2.
User property is: cveUrl12Base.
cveUrl12Modified String - Data Mirror URL for CVE 1.2.
User property is: cveUrl12Modified.
cveUrl20Base String - Data Mirror URL for CVE 2.0.
User property is: cveUrl20Base.
cveUrl20Modified String - Data Mirror URL for CVE 2.0.
User property is: cveUrl20Modified.
cveValidForHours Integer - Optionally skip excessive CVE update checks for a designated duration in hours.
User property is: cveValidForHours.
dataDirectory String - The data directory, hold DC SQL DB.
User property is: dataDirectory.
databaseDriverName String - The database driver name. An example would be org.h2.Driver.
User property is: databaseDriverName.
databaseDriverPath String - The path to the database driver if it is not on the class path.
User property is: databaseDriverPath.
databasePassword String - The password to use when connecting to the database.
User property is: databasePassword.
databaseUser String - The database user name.
User property is: databaseUser.
externalReport String - Deprecated. the internal report is no longer supported
User property is: externalReport.
jarAnalyzerEnabled Boolean - Whether or not the Jar Analyzer is enabled.
User property is: jarAnalyzerEnabled.
mavenSettings Settings - The Maven settings.
Default value is: ${settings}.
User property is: mavenSettings.
mavenSettingsProxyId String - The maven settings proxy id.
User property is: mavenSettingsProxyId.
nexusAnalyzerEnabled Boolean - Whether or not the Nexus Analyzer is enabled.
User property is: nexusAnalyzerEnabled.
nexusUrl String - The URL of a Nexus server's REST API end point (http://domain/nexus/service/local).
User property is: nexusUrl.
nexusUsesProxy Boolean - Whether or not the configured proxy is used to connect to Nexus.
User property is: nexusUsesProxy.
nodeAnalyzerEnabled Boolean - Sets whether or not the Node.js Analyzer should be used.
User property is: nodeAnalyzerEnabled.
nuspecAnalyzerEnabled Boolean - Whether or not the .NET Nuspec Analyzer is enabled.
User property is: nuspecAnalyzerEnabled.
opensslAnalyzerEnabled Boolean - Sets whether or not the openssl Analyzer should be used.
User property is: opensslAnalyzerEnabled.
pathToMono String - The path to mono for .NET Assembly analysis on non-windows systems.
User property is: pathToMono.
proxyUrl String - Deprecated. Please use mavenSettings instead
User property is: proxyUrl.
pyDistributionAnalyzerEnabled Boolean - Sets whether the Python Distribution Analyzer will be used.
User property is: pyDistributionAnalyzerEnabled.
pyPackageAnalyzerEnabled Boolean - Sets whether the Python Package Analyzer will be used.
User property is: pyPackageAnalyzerEnabled.
rubygemsAnalyzerEnabled Boolean - Sets whether the Ruby Gemspec Analyzer will be used.
User property is: rubygemsAnalyzerEnabled.
serverId String - The server id in the settings.xml; used to retrieve encrypted passwords from the settings.xml.
User property is: serverId.
showSummary boolean - Flag indicating whether or not to show a summary in the output.
Default value is: true.
User property is: showSummary.
skip boolean - Skip Dependency Check altogether.
Default value is: false.
User property is: dependency-check.skip.
skipProvidedScope boolean - Skip Analysis for Provided Scope Dependencies.
Default value is: false.
User property is: skipProvidedScope.
skipRuntimeScope boolean - Skip Analysis for Runtime Scope Dependencies.
Default value is: false.
User property is: skipRuntimeScope.
skipTestScope boolean - Skip Analysis for Test Scope Dependencies.
Default value is: true.
User property is: skipTestScope.
suppressionFile String - The path to the suppression file.
User property is: suppressionFile.
zipExtensions String - A comma-separated list of file extensions to add to analysis next to jar, zip, ....
User property is: zipExtensions.

Parameter Details

aggregate:

Deprecated. use the aggregate goal instead
Generate aggregate reports in multi-module projects.
  • Type: java.lang.Boolean
  • Required: No
  • User Property: aggregate

archiveAnalyzerEnabled:

Whether or not the Archive Analyzer is enabled.
  • Type: java.lang.Boolean
  • Required: No
  • User Property: archiveAnalyzerEnabled

assemblyAnalyzerEnabled:

Whether or not the .NET Assembly Analyzer is enabled.
  • Type: java.lang.Boolean
  • Required: No
  • User Property: assemblyAnalyzerEnabled

autoUpdate:

Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to false. Default is true.
  • Type: java.lang.Boolean
  • Required: No
  • User Property: autoUpdate

autoconfAnalyzerEnabled:

Sets whether or not the autoconf Analyzer should be used.
  • Type: java.lang.Boolean
  • Required: No
  • User Property: autoconfAnalyzerEnabled

centralAnalyzerEnabled:

Whether or not the Central Analyzer is enabled.
  • Type: java.lang.Boolean
  • Required: No
  • User Property: centralAnalyzerEnabled

cmakeAnalyzerEnabled:

Sets whether or not the CMake Analyzer should be used.
  • Type: java.lang.Boolean
  • Required: No
  • User Property: cmakeAnalyzerEnabled

composerAnalyzerEnabled:

Sets whether or not the PHP Composer Lock File Analyzer should be used.
  • Type: java.lang.Boolean
  • Required: No
  • User Property: composerAnalyzerEnabled

connectionString:

The database connection string.
  • Type: java.lang.String
  • Required: No
  • User Property: connectionString

connectionTimeout:

The Connection Timeout.
  • Type: java.lang.String
  • Required: No
  • User Property: connectionTimeout

cveUrl12Base:

Base Data Mirror URL for CVE 1.2.
  • Type: java.lang.String
  • Required: No
  • User Property: cveUrl12Base

cveUrl12Modified:

Data Mirror URL for CVE 1.2.
  • Type: java.lang.String
  • Required: No
  • User Property: cveUrl12Modified

cveUrl20Base:

Data Mirror URL for CVE 2.0.
  • Type: java.lang.String
  • Required: No
  • User Property: cveUrl20Base

cveUrl20Modified:

Data Mirror URL for CVE 2.0.
  • Type: java.lang.String
  • Required: No
  • User Property: cveUrl20Modified

cveValidForHours:

Optionally skip excessive CVE update checks for a designated duration in hours.
  • Type: java.lang.Integer
  • Required: No
  • User Property: cveValidForHours

dataDirectory:

The data directory, hold DC SQL DB.
  • Type: java.lang.String
  • Required: No
  • User Property: dataDirectory

dataFileName:

Sets whether or not the external report format should be used.
  • Type: java.lang.String
  • Required: Yes
  • User Property: metaFileName
  • Default: dependency-check.ser

databaseDriverName:

The database driver name. An example would be org.h2.Driver.
  • Type: java.lang.String
  • Required: No
  • User Property: databaseDriverName

databaseDriverPath:

The path to the database driver if it is not on the class path.
  • Type: java.lang.String
  • Required: No
  • User Property: databaseDriverPath

databasePassword:

The password to use when connecting to the database.
  • Type: java.lang.String
  • Required: No
  • User Property: databasePassword

databaseUser:

The database user name.
  • Type: java.lang.String
  • Required: No
  • User Property: databaseUser

externalReport:

Deprecated. the internal report is no longer supported
Sets whether or not the external report format should be used.
  • Type: java.lang.String
  • Required: No
  • User Property: externalReport

failBuildOnCVSS:

Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11 which means since the CVSS scores are 0-10, by default the build will never fail.
  • Type: float
  • Required: Yes
  • User Property: failBuildOnCVSS
  • Default: 11

format:

The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this within the Site plug-in unless the externalReport is set to true. Default is HTML.
  • Type: java.lang.String
  • Required: Yes
  • User Property: format
  • Default: HTML

jarAnalyzerEnabled:

Whether or not the Jar Analyzer is enabled.
  • Type: java.lang.Boolean
  • Required: No
  • User Property: jarAnalyzerEnabled

mavenSettings:

The Maven settings.
  • Type: org.apache.maven.settings.Settings
  • Required: No
  • User Property: mavenSettings
  • Default: ${settings}

mavenSettingsProxyId:

The maven settings proxy id.
  • Type: java.lang.String
  • Required: No
  • User Property: mavenSettingsProxyId

name:

The name of the report in the site.
  • Type: java.lang.String
  • Required: Yes
  • User Property: name
  • Default: dependency-check:aggregate

nexusAnalyzerEnabled:

Whether or not the Nexus Analyzer is enabled.
  • Type: java.lang.Boolean
  • Required: No
  • User Property: nexusAnalyzerEnabled

nexusUrl:

The URL of a Nexus server's REST API end point (http://domain/nexus/service/local).
  • Type: java.lang.String
  • Required: No
  • User Property: nexusUrl

nexusUsesProxy:

Whether or not the configured proxy is used to connect to Nexus.
  • Type: java.lang.Boolean
  • Required: No
  • User Property: nexusUsesProxy

nodeAnalyzerEnabled:

Sets whether or not the Node.js Analyzer should be used.
  • Type: java.lang.Boolean
  • Required: No
  • User Property: nodeAnalyzerEnabled

nuspecAnalyzerEnabled:

Whether or not the .NET Nuspec Analyzer is enabled.
  • Type: java.lang.Boolean
  • Required: No
  • User Property: nuspecAnalyzerEnabled

opensslAnalyzerEnabled:

Sets whether or not the openssl Analyzer should be used.
  • Type: java.lang.Boolean
  • Required: No
  • User Property: opensslAnalyzerEnabled

outputDirectory:

The output directory. This generally maps to "target".
  • Type: java.io.File
  • Required: Yes
  • Default: ${project.build.directory}

pathToMono:

The path to mono for .NET Assembly analysis on non-windows systems.
  • Type: java.lang.String
  • Required: No
  • User Property: pathToMono

proxyUrl:

Deprecated. Please use mavenSettings instead
The Proxy URL.
  • Type: java.lang.String
  • Required: No
  • User Property: proxyUrl

pyDistributionAnalyzerEnabled:

Sets whether the Python Distribution Analyzer will be used.
  • Type: java.lang.Boolean
  • Required: No
  • User Property: pyDistributionAnalyzerEnabled

pyPackageAnalyzerEnabled:

Sets whether the Python Package Analyzer will be used.
  • Type: java.lang.Boolean
  • Required: No
  • User Property: pyPackageAnalyzerEnabled

reportOutputDirectory:

Specifies the destination directory for the generated Dependency-Check report. This generally maps to "target/site".
  • Type: java.io.File
  • Required: Yes
  • User Property: project.reporting.outputDirectory

rubygemsAnalyzerEnabled:

Sets whether the Ruby Gemspec Analyzer will be used.
  • Type: java.lang.Boolean
  • Required: No
  • User Property: rubygemsAnalyzerEnabled

serverId:

The server id in the settings.xml; used to retrieve encrypted passwords from the settings.xml.
  • Type: java.lang.String
  • Required: No
  • User Property: serverId

showSummary:

Flag indicating whether or not to show a summary in the output.
  • Type: boolean
  • Required: No
  • User Property: showSummary
  • Default: true

skip:

Skip Dependency Check altogether.
  • Type: boolean
  • Required: No
  • User Property: dependency-check.skip
  • Default: false

skipProvidedScope:

Skip Analysis for Provided Scope Dependencies.
  • Type: boolean
  • Required: No
  • User Property: skipProvidedScope
  • Default: false

skipRuntimeScope:

Skip Analysis for Runtime Scope Dependencies.
  • Type: boolean
  • Required: No
  • User Property: skipRuntimeScope
  • Default: false

skipTestScope:

Skip Analysis for Test Scope Dependencies.
  • Type: boolean
  • Required: No
  • User Property: skipTestScope
  • Default: true

suppressionFile:

The path to the suppression file.
  • Type: java.lang.String
  • Required: No
  • User Property: suppressionFile

zipExtensions:

A comma-separated list of file extensions to add to analysis next to jar, zip, ....
  • Type: java.lang.String
  • Required: No
  • User Property: zipExtensions