{"id":16829044,"url":"https://github.com/nbaars/owasp-dependency-check-as-one","last_synced_at":"2025-10-30T08:22:12.874Z","repository":{"id":40464913,"uuid":"371102629","full_name":"nbaars/owasp-dependency-check-as-one","owner":"nbaars","description":"OWASP DependencyCheck as one image","archived":false,"fork":false,"pushed_at":"2023-01-31T16:02:12.000Z","size":90,"stargazers_count":5,"open_issues_count":7,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-11T04:03:31.660Z","etag":null,"topics":["all-in-one","dependency-check","docker-image","owasp-dependencycheck","scanner"],"latest_commit_sha":null,"homepage":"https://hub.docker.com/r/nbaars/owasp-dependency-check-as-one","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nbaars.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-05-26T16:34:41.000Z","updated_at":"2024-02-24T03:25:45.000Z","dependencies_parsed_at":"2023-02-16T21:00:40.071Z","dependency_job_id":null,"html_url":"https://github.com/nbaars/owasp-dependency-check-as-one","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nbaars%2Fowasp-dependency-check-as-one","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nbaars%2Fowasp-dependency-check-as-one/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nbaars%2Fowasp-dependency-check-as-one/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nbaars%2Fowasp-dependency-check-as-one/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nbaars","download_url":"https://codeload.github.com/nbaars/owasp-dependency-check-as-one/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248339285,"owners_count":21087215,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["all-in-one","dependency-check","docker-image","owasp-dependencycheck","scanner"],"created_at":"2024-10-13T11:30:00.261Z","updated_at":"2025-10-30T08:22:12.767Z","avatar_url":"https://github.com/nbaars.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"## All in one ready to go Docker-based image for OWASP DependencyCheck\n\nAn all-in-one Docker image for OWASP DependencyCheck fully initialized with the NIST database of the day. You can use this image directly in your pipeline without having to download and wait for an initialized database.\n\n### Introduction\n\nRunning DependencyCheck locally on your machine works fine, run it once it will download/initialize the cache, etc and the next time you run it, it will have the cache ready and it will run pretty fast.\n\nHowever, when you want to use it in a CI environment things become a bit more complicated, you don't want to download the database each and every time. For one it takes time, second, if you do this too often it will result in `HTTP/429 - too many requests`. There are solutions available that include a database but then you still need to set up the central database, a quote from the [website](https://jeremylong.github.io/DependencyCheck/data/database.html):\n\n\u003e WARNING: This discusses an advanced setup and you may run into issues.\n\nIf you are already running in a CI environment running with Docker images you can also create a ready-to-go image that includes the database and includes the scanner.\n\nThis image was created based on a personal itch, setting it up in a pipeline took too much time, and running a Docker image on for example a Kubernetes cluster to which the client connects feels like too much effort to me.\n\n### Benefits\n\n- Easy to use\n- Every day there is a new image waiting to be used in your CI environment\n- No need to mount the directory which contains a copy of the database to run the Docker image it is all available in the image  \n- Scanner runs offline (database is contained in the image)\n- Fast (no need to wait to download the CVEs)\n- No need to set up a database with persistent storage etc to hold the configuration.\n- No need to configure a central database as described [here](https://jeremylong.github.io/DependencyCheck/data/database.html).\n\n### Updates\n\nThe Github actions for this project run every day the images will be tagged by date as follows: `yyyyMMdd` and `latest` will always point to today. This repository contains a trigger that will run each day at 0:00 UTC. \nSo make sure you are fine with running OWASP dependency check with a 1-day old database at max!\n\n### Limitations\n\nThe image is at most 1 day old, if you need to update more often you cannot use this image. Make sure to discuss this upfront with your security team.\n\n## Usage\n\n### Standalone\n\nUse: \n\n```\ndocker pull nbaars/owasp-dependency-check-as-one:latest\n\ndocker run -v ${HOME}/.m2:/home/owasp/.m2 -v ${PWD}/demo-project:/workspace nbaars/owasp-dependency-check-as-one:latest ./mvnw dependency:copy-dependencies \u0026\u0026 dependency-check --data /data --scan /workspace --noupdate\n```\n\nImportant are the two mount points, the first one mounts the local `.m2` directory, this will prevent DependencyCheck from downloading Maven artifacts over and over. When using a CI tool it is recommended to mount the `.m2` cache. The project to be scanned is mapped in `/workspace` which is the working directory set in the Dockerfile.\n\nYou can pass any command-line option you are used to.\n\nIf your project includes a Maven wrapper you can run:\n\n```\ndocker pull nbaars/owasp-dependency-check-as-one:latest\n\ndocker run -v ${HOME}/.m2/:/home/owasp/.m2 -v ${PWD}/demo-project:/workspace nbaars/owasp-dependency-check-as-one:latest ./mvnw org.owasp:dependency-check-maven:6.1.6:aggregate -DautoUpdate=false -DdataDirectory=/data\n```\n\n\n### Gitlab\n\nIn your `.gitlab-ci.yml` add the following job:\n\n```\nOWASP dep check:\n  image: nbaars/owasp-dependency-check-as-one\n  stage: build\n  script:\n    # Download all dependencies so they are available for OWASP Dependency-Check\n    - ./mvnw $MAVEN_CLI_OPTS dependency:copy-dependencies\n    # Run the CLI and pass the current directory (automatically checked out by the Gitlab pipeline) as project to scan\n    # Other options can be passed depending on your project setup (https://jeremylong.github.io/DependencyCheck/dependency-check-cli/arguments.html)\n    - dependency-check --data /data --scan ./ --noupdate --disableBundleAudit --disableRubygems --failOnCVSS 8\n  artifacts:\n    when: always\n    paths:\n      # Make the project available as artifact so you can view it\n      - \"dependency-check-report.html\"\n    expire_in: 1 week\n```\n\nOr with Maven:\n\n```shell\nOWASP maven:\n  image: nbaars/owasp-dependency-check-as-one\n  stage: build\n  script:\n    # Run dependency-check with Maven, other options can be passed see https://jeremylong.github.io/DependencyCheck/dependency-check-maven/configuration.html\n    - ./mvnw $MAVEN_CLI_OPTS org.owasp:dependency-check-maven:6.1.6:aggregate -Dformat=ALL -DautoUpdate=false -DdataDirectory=/data -DfailBuildOnAnyVulnerability=true -DbundleAuditAnalyzerEnabled=false\n  artifacts:\n    when: always\n    paths:\n      # Make the project available as artifact so you can view it\n      - \"target/dependency-check-report.html\"\n    expire_in: 1 week\n```\n\nAn example can be found [here](https://gitlab.com/nbaars/petstore)\n\n### Github actions\n\nIf you want to use this image in Github, use the following:\n\n```\n\n```\n\n### Using this image during Docker build (multistage)\n\nYou can also use this image in your own Docker image you create to for example build your project. Copy the folder `/dependency-check` to your image. Make sure your base image does contain a JVM as Dependency Check needs it.\nYou can check the Dockerfile as this image uses a multistage as well.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnbaars%2Fowasp-dependency-check-as-one","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnbaars%2Fowasp-dependency-check-as-one","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnbaars%2Fowasp-dependency-check-as-one/lists"}