Running dependency-check on multi module build

Maven version: 3.6.1 Dependency check version: 5.2.1

Hi,

I have a multi module maven build and am trying to determine the correct configuration for running dependency check from the top level and generating a collated report of all sub modules. Please can you help?

I have the following config in my parent pom:

<pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.owasp</groupId>
                    <artifactId>dependency-check-maven</artifactId>
                    <version>${owasp-maven-plugin.version}</version>
                    <executions>
                        <execution>
                            <phase>none</phase>
                            <goals>
                                <goal>check</goal>
                            </goals>
                        </execution>
                    </executions>
                    <configuration>
                        <format>html</format>
                        <outputDirectory>${project.basedir}/target</outputDirectory>
                        <failBuildOnCVSS>0</failBuildOnCVSS>
                        <cveValidForHours>168</cveValidForHours>
                        <centralAnalyzerEnabled>false</centralAnalyzerEnabled>
                        <nexusAnalyzerEnabled>false</nexusAnalyzerEnabled>
                        <pyDistributionAnalyzerEnabled>false</pyDistributionAnalyzerEnabled>
                        <pyPackageAnalyzerEnabled>false</pyPackageAnalyzerEnabled>
                        <rubygemsAnalyzerEnabled>false</rubygemsAnalyzerEnabled>
                        <cmakeAnalyzerEnabled>false</cmakeAnalyzerEnabled>
                        <autoconfAnalyzerEnabled>false</autoconfAnalyzerEnabled>
                        <composerAnalyzerEnabled>false</composerAnalyzerEnabled>
                        <nodeAnalyzerEnabled>false</nodeAnalyzerEnabled>
                        <nuspecAnalyzerEnabled>false</nuspecAnalyzerEnabled>
                        <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
                        <retireJsAnalyzerEnabled>false</retireJsAnalyzerEnabled>
                    </configuration>
                </plugin>
           </plugins>
</pluginManagement>

I have 9 sub modules, each with the following config:

<plugins>
            <plugin>
                <groupId>org.owasp</groupId>
                <artifactId>dependency-check-maven</artifactId>
                <configuration>
                    <suppressionFile>${project.parent.basedir}/owasp-suppressions.xml</suppressionFile>
                </configuration>
            </plugin>
</plugins>

I am running mvn dependency-check:check from the top level, but the report appears to only show information from the top-level (parent) project.

[mprins]

Also, only a report for the top-level project appears to be generated

this is why it is called an aggregate, it shows all of your project in 1 aggregate, if it just scanned the paren - which should have no dependencies - your report would be empty

[jeremylong]

At the moment - there is no way to skip specific children in an aggregate report. Also, without putting inherited=false in the parent you will receive an aggregate report generated for the parent that will contain everything AND an aggregate report for each child (aggregating itself and any of its child poms).

One option to explore would be to setup a profile that excluded the children you don’t want to include and run dependency-check under that profile.