The sbt-dependency-check plugin allows projects to monitor dependent libraries for known, published vulnerabilities (e.g. CVEs). The plugin achieves this by using the awesome OWASP DependencyCheck library which already offers several integrations with other build and continuous integration systems.

For more information on how OWASP DependencyCheck works and how to read the reports check the project's documentation.

This plugin is inspired by the great work of Alexander v. Buchholtz et al. sbt-dependency-check. This plugin seeks to build on top of the previous plugin, keeping some settings and tasks the same, while offering some functionalities on top. The work on this plugin started when we noticed NVD deprecating data-feed, which the previous plugin still relied on. If you're looking to migrate from Buchholtz's plugin, please read the Migration Guide

Add the plugin to your project configuration:

addSbtPlugin("net.nmoncho" % "sbt-dependency-check" % "1.8.5")

The minimum SBT version supported is 1.9.0.

Don't feel deterred by all the configuration settings defined in this plugin. All of them have sensible defaults.

The best way to get started is to install the plugin, set your NVD API Key:

import net.nmoncho.sbt.dependencycheck.settings._

// Alternatively `ThisBuild / dependencyCheckNvdApi := NvdApiSettings(apiKey = "YOUR_NVD_API_KEY")`
dependencyCheckNvdApi := NvdApiSettings(apiKey = "YOUR_NVD_API_KEY")

And then just run:

sbt -Dlog4j2.level=info dependencyCheck

The first time you run these tasks it will take some time, even a couple of minutes. The analysis will write a report to target/{scala-version}/dependency-check-report.html for SBT 1.x, and target/out/jvm/{scala-version}/{project}/dependency-check-report.html for SBT 2.x. The plugin will log where the reports are being written to.

After this, feel free to take a look at the available tasks and settings.