Not able to exclude transitive dependencies from a scan?

Hi,

I am using the ./gradlew dependencyCheckAggregate command to generate the dependency report HTML file for one of my Gradle projects. It works fine and lists both direct and transitive jar dependencies which are vulnerable as per the NVD database. However, I tried multiple ways but failed to figure out a way wherein I want to only list the direct dependencies? Is there any way through which I can list the direct dependencies only? Below is the build.gradle file for reference –

File snippet -

plugins {
    id 'org.owasp.dependencycheck' version '6.5.3'
}
repositories {
    mavenCentral()
}
subprojects {
    apply plugin: 'org.owasp.dependencycheck'

    dependencyCheck {
        outputDirectory = 'security-report'
        failOnError = true
    }
}

Is this some feature that is missing from this plugin? or something else? Please confirm.

[jeremylong]

I won’t disagree that when using the maven or gradle plugin we could do better about indicating where in the dependency tree the vulnerable component is - however, how much one should worry about the transitive dependencies is complicated.

1. One can have Used but undeclared dependencies (see an example dependency-analysis report
2. The risk actually affects your application even if it is only a transitive dependency; which could have happened with the recent log4j event.

Yes, upgrading transitive dependencies can be difficult and sometimes impossible unless you are willing to put in a PR to the direct dependency to help them upgrade. However, just ignoring them is likely not the best option.

[jeremylong]

@aikebah I have been trying to come up with an easier way for Maven and Gradle to display the dependency tree for transitive deps. Something like adding a row above related dependencies that shows the path:

Hierarchy org.junit.jupiter:junit-jupiter-api -> org.apiguardian:apiguardian-api