A leiningen plugin for detecting vulnerable project dependencies
Switch branches/tags
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
src
.gitignore
LICENSE
README.md
project.clj

README.md

lein-dependency-check

A Leiningen plugin for detecting vulnerable project dependencies. Basic clojure wrapper for OWASP Dependency Check.

Configuration

As a User-Level Plugin:

To run dependency-check without having to add it to every Leiningen project as a project-level plugin, add dependency-check to the :plugins vector of your :user profile. E.g., a ~/.lein/profiles.clj with dependency-check as a plugin -

{:user {:plugins [[com.livingsocial/lein-dependency-check "1.0.4"]]}}

If you are on Leiningen 1.x do lein plugin install lein-dependency-check 1.0.4.

As a Project-Level Plugin:

Add [com.livingsocial/lein-dependency-check "1.0.4"] to the :plugins vector of your project.clj.

Project-level configuration may be provided under a :dependency-check key in your project.clj. Currently supported options are:

  • :log log each vulnerability found to stdout
  • :throw throw an exception after analysis and reporting if vulnerabilities are found, eg. to fail a build

Usage

To generate a dependency-check-report.html report file to the current project's target directory, run:

$ lein dependency-check

To generate the report in XML format, run:

$ lein dependency-check :xml

To write the report to a different directory (e.g., /tmp), run:

$ lein dependency-check :html /tmp

Suppressing False Positives

Support for suppressing false positives can be utilized by creating suppression.xml in your project's root directory.

Suppression snippets can be copied from the HTML report file directly into suppression.xml. Upon rerun of lein-dependency-check, the suppression file will be used and warnings will not be present in report.

For more information about dependency-check suppression system see https://jeremylong.github.io/DependencyCheck/general/suppression.html

License

Copyright © 2016 LivingSocial

Distributed as open source under the terms of the MIT License.