Analyzers, as the name imply, are a way to analyze dependencies or artifacts. DependencyCheck offers an extensive list of analyzers out of the box.

• General Settings
• Artifactory Settings
• .NET Settings
• Elixir Settings
• Golang Settings
• Hints Settings
• Known Exploited Vulnerabilities Settings
• Maven Central Settings
• Nexus Settings
• Node Settings
• Sonatype OSS Index Settings
• PHP Settings
• PNPM Settings
• Python Settings
• RetireJS Settings
• Ruby Settings
• Swift Settings
• Yarn Settings

Analyzer settings are grouped together where they make sense. This is an attempt to make the Setting Keys offered by the plugin a bit more readable and comprehensible.

To learn more see the available File Type Analyzers. Some analyzers may be enabled but marked as experimental, which may not run if experimentalEnabled is disabled. If you don't care about a particular Analyzer, feel free to ignore it, leaving the default values as they are.

Settings are grouped by either analyzer, tool, or language:

Setting	Description	Default
additionalZipExtensions	additional file extensions to be treated like a ZIP files, the contents will be extracted and analyzed.	None
archiveEnabled	whether or not the Archive analyzer is enabled.	true
artifactory	Artifactory Settings.
autoconfEnabled	whether or not the autoconf analyzer should be used.	true
cmakeEnabled	whether or not the CMake analyzer is enabled.	true
cpanFileEnabled	whether or not the Perl CPAN File analyzer is enabled.	true
cpeEnabled	whether or not the CPE analyzer is enabled.	true
cpeSuppressionEnabled	whether or not the CPE Suppression analyzer is enabled.	true
dartEnabled	whether or not the Dart analyzer is enabled.	true
dependencyBundlingEnabled	whether or not the Dependency Bundling analyzer is enabled.	true
dependencyMergingEnabled	whether or not the Dependency Merging analyzer is enabled.	true
dotNet	.NET Settings.
elixir	Elixir Settings
experimentalEnabled	whether or not experimental analyzers are enabled.	false
failOnUnusedSuppressionRule	whether the Unused Suppression Rule analyzer should fail if there are unused rules.	false
falsePositiveEnabled	whether or not the False Positive analyzer is enabled.	true
filenameEnabled	whether or not the Filename analyzer is enabled.	true
fileVersionEnabled	whether or not the File Version analyzer is enabled (reads the PE headers of DLL and EXE files).	true
golang	Golang Settings.
hints	Hints Settings.
jarEnabled	whether or not the JAR analyzer is enabled.	true
knownExploitedVulnerabilities	Known Exploited Vulnerabilities settings.
mavenCentral	Maven Central Settings
mavenInstallEnabled	whether or not the Maven Install analyzer is enabled.	true
nexus	Nexus Settings.
node	Node Settings
nvdCveEnabled	whether or not the NVD CVE analyzer is enabled.	true
openSslEnabled	whether or not the OpenSSL analyzer is enabled.	true
php	PHP Settings.
pnmp	PNPM Settings.
python	Python Settings.
retiredEnabled	whether or not the retired analyzers are enabled.	false
retireJS	RetireJS Settings.
ruby	Ruby Settings.
swift	Swift Settings.
versionFilterEnabled	whether or not the Version Filter analyzer is enabled.	true
vulnerabilitySuppressionEnabled	whether or not the Vulnerability Suppression analyzer is enabled.	true
yarn	Yarn Settings.

Most of the settings here are picked up from either the default dependencycheck.properties, or from source, thus these tables try to gather them as best effort.

Setting	Description	Default
enabled	whether or not Artifactory is enabled	false
url	Artifactory search URL	null
parallelAnalysis	whether or not should use parallel processing	null (true)
apiToken	Artifactory API token	null
username	Artifactory username	null
bearerToken	Artifactory bearer token	null
usesProxy	whether or not the proxy should be used to reach Artifactory	null (true if proxy is enabled, false otherwise)

Setting	Description	Default
assemblyEnabled	whether or not the .NET Assembly analyzer is enabled	true
assemblyPath	The path to dotnet core, if available	null
nuspecEnabled	whether or not the .NET Nuspec analyzer is enabled	true
nugetConfEnabled	whether or not the .NET Nuget packages. config analyzer is enabled	true
libManEnabled	whether or not the Libman analyzer is enabled	true
msBuildProjectEnabled	whether the .NET MSBuild Project analyzer is enabled	true

Setting	Description	Default
mixAuditEnabled	whether or not the Elixir mix audit analyzer is enabled	true
mixAuditPath	The path to mix_audit, if available	null (mix_audit)

Setting	Description	Default
dependencyAnalyzerEnabled	whether the Golang Dep analyzer is enabled	true
moduleAnalyzerEnabled	whether the Golang Mod analyzer is enabled	true
path	The path to go, if available	null (go)

Setting	Description	Default
enabled	whether the Hint analyzer is enabled	true
hintsFile	path to the hints file	null

Setting	Description	Default
enabled	whether the Known Exploited Vulnerabilities analyzer is enabled	true
url	the URL to retrieve the Known Exploited Vulnerabilities	https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
username	the known exploited vulnerabilities username. For use when known exploited vulnerabilities are mirrored locally on a site requiring HTTP-Basic-authentication	null
password	the known exploited vulnerabilities password. For use when known exploited vulnerabilities are mirrored locally on a site requiring HTTP-Basic-authentication	null
bearerToken	the known exploited vulnerabilities bearer token. For use when known exploited vulnerabilities are mirrored locally on a site requiring HTTP-Bearer-authentication	null
validForHours	controls the skipping of the check for Known Exploited Vulnerabilities updates.	24

Setting	Description	Default
enabled	whether the Maven Central analyzer is enabled	true
url	the Maven Central search URL	https://search.maven.org/solrsearch/select
query	the Maven Central search query	%s?q=1:%s&wt=xml
usesCache	whether Maven Central search results will be cached	true
retryCount	the Maven Central analyzer request retry count	7
parallelAnalysis	whether the Maven Central analyzer should use parallel processing	false
username	the Username to obtain content from Maven Central. For use when the central content URL is reconfigured to a site requiring HTTP-Basic-authentication	null
password	the Password to obtain content from Maven Central. For use when the central content URL is reconfigured to a site requiring HTTP-Basic-authentication	null
bearerToken	the token to obtain content from Maven Central from an HTTP-Bearer-auth protected location. For use when the central content URL is reconfigured to a site requiring HTTP-Bearer-authentication	null

Setting	Description	Default
enabled	whether the Nexus analyzer is enabled	false
url	the Nexus search URL	https://repository.sonatype.org/service/local/
username	the Nexus search credentials username	null
password	the Nexus search credentials password	null
usesProxy	whether to use the proxy to reach Nexus	true

Setting	Description	Default
auditEnabled	whether the Node Audit analyzer is enabled	true
auditUrl	the URL to the Node Audit API	https://registry.npmjs.org/-/npm/v1/security/audits
auditSkipDevDependencies	whether the Node Audit analyzer should skip devDependencies	null (false)
auditUsesCache	whether node audit analyzer results will be cached	true
packageEnabled	whether the Node Package analyzer is enabled	true
packageSkipDevDependencies	whether the Node Package analyzer should skip devDependencies	null (false)
npmCpeEnabled	where the NPM CPE analyzer is enabled	true

Setting	Description	Default
enabled	whether the Sonatype OSS Index analyzer is enabled	true
url	the Sonatype OSS Index URL	https://ossindex.sonatype.org
batchSize	the Sonatype OSS batch-size	null (128)
requestDelay	the Sonatype OSS Request Delay. Amount of time in seconds to wait before executing a request against the Sonatype OSS Rest API	null (0)
useCache	whether the Sonatype OSS Index should use a local cache	true
warnOnlyOnRemoteErrors	only warning about Sonatype OSS Index remote errors instead of failing the request	null (false)
username	the Sonatype OSS Index user	null
password	the Sonatype OSS Index password	null

Setting	Description	Default
composerLockEnabled	whether the PHP composer lock file analyzer is enabled	true
composerLockSkipDevDependencies	whether the PHP composer lock file analyzer should skip dev packages	null (false)

Setting	Description	Default
enabled	whether the pnpm analyzer is enabled	true
path	the path to pnpm if available	null (pnpm)

Setting	Description	Default
pipEnabled	whether the pip analyzer is enabled	true
pipFileEnabled	whether the pipfile analyzer is enabled	true
distributionEnabled	whether the Python Distribution analyzer is enabled	true
packageEnabled	whether the Python Package analyzer is enabled	true
poetryEnabled	whether the Poetry analyzer is enabled	true

Setting	Description	Default
enabled	whether the RetireJS analyzer is enabled	true
forceUpdate	whether the RetireJS repository will be updated regardless of the autoupdate settings	null (false)
filters	whether the RetireJS analyzer file content filters	null ()
filterNonVulnerable	whether the RetireJS analyzer should filter out non-vulnerable dependencies	false
url	the URL to the RetireJS repository	https://raw.githubusercontent.com/Retirejs/retire.js/master/repository/jsrepository.json
username	the RetireJS Repository username. For use when the RetireJS Repository is mirrored on a site requiring HTTP-Basic-authentication	null
password	the RetireJS Repository password. For use when the RetireJS Repository is mirrored on a site requiring HTTP-Basic-authentication	null
bearerToken	the token to download the RetireJS JSON data from an HTTP-Bearer-auth protected location. For use when the RetireJS Repository is mirrored on a site requiring HTTP-Bearer-authentication.	null
validForHours	to control the skipping of the check for CVE updates	24

Setting	Description	Default
gemSpecEnabled	whether the Ruby Gemspec Analyzer is enabled	true
bundleAuditEnabled	whether the Ruby Bundler Audit analyzer is enabled	true
bundleAuditPath	The path to bundle-audit, if available	null (bundle-audit)
bundleAuditWorkingDirectory	bundle-audit working directory	null (where bundle-audit is contained, may be pwd)

Setting	Description	Default
packageManagerEnabled	whether the SWIFT package manager analyzer is enabled	true
packageResolvedEnabled	whether the SWIFT package resolved analyzer is enabled	true
carthageEnabled	whether the carthage analyzer is enabled	true
cocoapodsEnabled	whether the cocoapods analyzer is enabled	true

Setting	Description	Default
enabled	whether the Yarn analyzer is enabled	true
path	the path to Yarn if available	null (yarn)