Level: Beginner / Basic DevSecOps
Duration: 60 minutes
Format: Instructor-led hands-on demo
Focus: Install → scan a real project → read findings → understand CVE/CVSS → generate reports → demonstrate a simple security gate

Lab Version

Tutorial verified for: October 2026
OWASP Dependency-Check: 13.0.0
Recommended Java runtime: Java 17 LTS
Minimum Java runtime: Java 11
Sample project: OWASP NodeGoat
Pinned sample commit: 9336e34
Primary report format: HTML
Code language: CSS (css)

Important for a 1-hour class: Pre-populate the Dependency-Check data directory before class. This revised lab also reflects a real NodeGoat execution: install the Node dependencies first, then scan only the Node manifests instead of the whole repository. That keeps the demo focused and avoids unrelated .NET/Yarn analyzer noise.

1. Learning Objectives

By the end of this 60-minute lab, students should be able to:

• Explain what OWASP Dependency-Check does.
• Explain why Software Composition Analysis (SCA) matters.
• Verify a Dependency-Check installation.
• Scan a real GitHub project.
• Generate an HTML vulnerability report.
• Identify the affected dependency, CVE, severity, and CVSS score.
• Understand why a detected vulnerability still needs investigation.
• Generate a machine-readable report.
• Demonstrate a simple CVSS-based security gate.
• Explain where Dependency-Check fits into CI/CD.

2. 60-Minute Agenda

3. What Is OWASP Dependency-Check?

OWASP Dependency-Check is a Software Composition Analysis tool that identifies publicly disclosed vulnerabilities in third-party software components used by an application.

A simplified workflow is:

Application source code
        ↓
Dependency manifests / packages
        ↓
OWASP Dependency-Check
        ↓
Component identification
        ↓
Known vulnerability matching
        ↓
CVE / CVSS information
        ↓
HTML / JSON / XML / SARIF reports
Code language: JavaScript (javascript)

Dependency-Check helps answer questions such as:

What third-party components are we using?
        ↓
Are known vulnerabilities associated with those components?
        ↓
How severe are the findings?
        ↓
Do the findings actually apply to our application?
        ↓
Should we upgrade, mitigate, suppress, or investigate further?
Code language: JavaScript (javascript)

Key lesson: A Dependency-Check finding is a security signal that requires analysis. It is not automatic proof that the application is exploitable.

4. Prerequisites

Student workstation

Recommended environment:

Ubuntu 22.04/24.04+ or current macOS
Java 17
Git
Node.js + npm
curl
unzip
Internet access
OWASP Dependency-Check 13.0.0

Recommended resources:

CPU: 2+ cores
RAM: 4 GB minimum, 8 GB recommended
Disk: 3+ GB free
Code language: HTTP (http)

Verify the key tools:

java -version
git --version
npm --version

Node.js/npm is required in this revised lab because the real scan showed that Dependency-Check’s Node analyzer expects installed dependency metadata for a fuller analysis.

5. Install Dependency-Check

If the instructor has already prepared Dependency-Check, students can skip directly to Installation Verification.

Linux/macOS — CLI distribution

Create a lab tools directory:

mkdir -p ~/odc-lab
cd ~/odc-lab

Download the 13.0.0 CLI distribution:

curl -LO https://github.com/dependency-check/DependencyCheck/releases/download/v13.0.0/dependency-check-13.0.0-release.zip
Code language: JavaScript (javascript)

Extract it:

unzip dependency-check-13.0.0-release.zip
Code language: CSS (css)

The executable is located under:

dependency-check/bin/

Installation Verification

Run:

./dependency-check/bin/dependency-check.sh --version

Expected result:

Dependency-Check Core version 13.0.0
Code language: CSS (css)

On Windows, use dependency-check.bat instead of dependency-check.sh.

6. Instructor Preparation — Do This Before Class

A first-time vulnerability database update can consume much of a 60-minute lab. Pre-populate the data directory.

Create a reusable data directory:

mkdir -p ~/odc-lab/odc-data
Code language: JavaScript (javascript)

If an NVD API key is available:

export NVD_API_KEY="YOUR_NVD_API_KEY"
Code language: JavaScript (javascript)

Populate/update Dependency-Check data:

~/odc-lab/dependency-check/bin/dependency-check.sh \
  --updateonly \
  --data ~/odc-lab/odc-data \
  --nvdApiKey "$NVD_API_KEY"
Code language: JavaScript (javascript)

If no API key is available, the instructor can perform the update without --nvdApiKey, but updates can be considerably slower and are more likely to encounter rate limiting.

For the live class, reuse the same data directory:

~/odc-lab/odc-data
Code language: JavaScript (javascript)

7. Clone the Real Sample Application

For this quick demo we use OWASP NodeGoat, a deliberately vulnerable application maintained for security training.

Step 1 — Clone NodeGoat

cd ~/odc-lab
git clone https://github.com/OWASP/NodeGoat.git
cd NodeGoat
Code language: PHP (php)

Step 2 — Pin the lab revision

git checkout 9336e34

Expected output is similar to:

HEAD is now at 9336e34 ...

Step 3 — Confirm dependency files

ls package.json package-lock.json
Code language: CSS (css)

Expected:

package-lock.json
package.json
Code language: CSS (css)

Why pin the commit?

Using an immutable Git commit keeps the training project stable even if the NodeGoat default branch changes later.

8. Prepare and Inspect the Project Before Scanning

Step 1 — Install dependency metadata

A real scan performed before installing dependencies produced this warning:

Analyzing package-lock.json - however, the node_modules directory does not exist.
Please run npm install prior to running dependency-check
Code language: CSS (css)

Prepare the dependency tree:

npm install --ignore-scripts --no-audit --no-fund

Why these flags?

Verify:

test -d node_modules && echo "node_modules is ready"
Code language: PHP (php)

Expected:

node_modules is ready

NodeGoat intentionally contains old packages. Deprecation warnings during installation are expected. We are not trying to run the application.

Step 2 — Inspect the manifest

head -40 package.json
Code language: CSS (css)

Optional:

grep -n '"marked"' package.json package-lock.json | head
Code language: JavaScript (javascript)

The goal is to connect:

Application
    ↓
Dependency manifest
    ↓
Package + version
    ↓
SCA analysis

Why we do not scan the entire repository in this 1-hour demo

After npm install, scanning . caused Dependency-Check to encounter unrelated files inside node_modules, including binaries that triggered the .NET Assembly Analyzer. The same run also attempted the Yarn Audit Analyzer even though Yarn was not part of this npm-based lab.

For this quick demo, scan only:

package.json
package-lock.json
Code language: CSS (css)

Dependency-Check supports multiple --scan arguments.

We also disable analyzers that are irrelevant to this specific classroom exercise:

--disableAssembly
--disableYarnAudit
--disableOssIndex

This produces a cleaner, easier-to-teach result.

9. Run the First Dependency-Check Scan

Create a report directory:

mkdir -p ~/odc-lab/reports
Code language: JavaScript (javascript)

From the NodeGoat directory, run the focused scan:

~/odc-lab/dependency-check/bin/dependency-check.sh \
  --project "OWASP NodeGoat Quick Lab" \
  --scan package.json \
  --scan package-lock.json \
  --data ~/odc-lab/odc-data \
  --noupdate \
  --format HTML \
  --out ~/odc-lab/reports \
  --disableAssembly \
  --disableYarnAudit \
  --disableOssIndex
Code language: JavaScript (javascript)

Why --noupdate?

The instructor has already prepared ~/odc-lab/odc-data. During the live hour we want to demonstrate analysis, not spend time refreshing vulnerability feeds.

If the data directory has not been pre-populated, remove --noupdate and perform the normal update process.

What Dependency-Check is doing

Read dependency manifests
        ↓
Identify Node packages
        ↓
Collect component evidence
        ↓
Match against vulnerability intelligence
        ↓
Associate possible CVEs
        ↓
Generate the report

Expected output should include messages similar to:

[INFO] Analysis Started
[INFO] Finished Node Package Analyzer
[INFO] Finished NVD CVE Analyzer
[INFO] Analysis Complete
[INFO] Writing HTML report to: .../dependency-check-report.html

Do not expect the exact number of vulnerabilities to remain identical forever. Vulnerability intelligence can change independently of the pinned source code.

10. Locate the HTML Report

List the output directory:

ls -lh ~/odc-lab/reports
Code language: JavaScript (javascript)

You should see:

dependency-check-report.html
Code language: CSS (css)

Open the report

macOS

open ~/odc-lab/reports/dependency-check-report.html
Code language: JavaScript (javascript)

Linux desktop

xdg-open ~/odc-lab/reports/dependency-check-report.html
Code language: JavaScript (javascript)

If a graphical browser is not available, copy the report to a workstation with a browser.

11. Read the HTML Report

Spend several minutes examining one vulnerable dependency.

For one finding, identify these fields:

Dependency / component
        ↓
Detected version
        ↓
Evidence / identifiers
        ↓
CVE
        ↓
Severity
        ↓
CVSS score
        ↓
Vulnerability description
        ↓
References
        ↓
Affected-version information

What the fields mean

12. CVE and CVSS — 5-Minute Explanation

CVE

CVE means Common Vulnerabilities and Exposures.

Example pattern:

CVE-YYYY-NNNNN

A CVE identifies a publicly disclosed vulnerability. It does not by itself tell you whether your application is exploitable.

CVSS

CVSS means Common Vulnerability Scoring System.

Typical interpretation:

The score helps prioritize investigation, but it must be combined with application context.

13. Detection Is Not the Same as Confirmation

Teach students this workflow:

Dependency-Check finding
        ↓
Is the dependency really present?
        ↓
Is the detected version correct?
        ↓
Does the CVE apply to that version?
        ↓
Does our application use the vulnerable functionality?
        ↓
Is the component reachable/exploitable in our deployment?
        ↓
Upgrade / mitigate / investigate / suppress with justification
Code language: JavaScript (javascript)

Useful terms

Detected vulnerability

Dependency-Check found a relationship between a component and vulnerability intelligence.

Confirmed vulnerability

Engineering/security analysis confirms that the vulnerable component/version and relevant conditions apply.

False positive

The tool associated a vulnerability with the dependency incorrectly or the identification is not applicable.

Needs investigation

The tool has provided enough evidence to justify review, but the team has not yet confirmed applicability or exploitability.

Never teach teams to suppress a finding simply because they do not want the pipeline to fail.

14. Generate a JSON Report

Machine-readable output is useful for CI/CD and security tooling.

Run:

~/odc-lab/dependency-check/bin/dependency-check.sh \
  --project "OWASP NodeGoat Quick Lab" \
  --scan package.json \
  --scan package-lock.json \
  --data ~/odc-lab/odc-data \
  --noupdate \
  --format JSON \
  --out ~/odc-lab/reports \
  --disableAssembly \
  --disableYarnAudit \
  --disableOssIndex
Code language: JavaScript (javascript)

Check the directory:

ls -lh ~/odc-lab/reports
Code language: JavaScript (javascript)

You should now see a JSON report in addition to the HTML report.

Typical uses:

HTML  → Human review
JSON  → Automation / parsing / CI tools
XML   → Integrations
SARIF → Security/code-scanning platforms that consume SARIF
Code language: JavaScript (javascript)

15. Quick Security-Gate Demo

Dependency-Check can return a failing exit status when findings meet or exceed a configured CVSS threshold.

For a demonstration threshold of 7.0:

~/odc-lab/dependency-check/bin/dependency-check.sh \
  --project "OWASP NodeGoat Gate Demo" \
  --scan package.json \
  --scan package-lock.json \
  --data ~/odc-lab/odc-data \
  --noupdate \
  --format HTML \
  --out ~/odc-lab/reports \
  --disableAssembly \
  --disableYarnAudit \
  --disableOssIndex \
  --failOnCVSS 7
Code language: JavaScript (javascript)

Immediately inspect the shell exit code:

echo $?
Code language: PHP (php)

Conceptually:

Scan
 ↓
Find vulnerabilities
 ↓
Evaluate CVSS scores
 ↓
Compare with threshold
 ↓
Return pass/fail status
Code language: JavaScript (javascript)

Important distinction

Report generation ≠ vulnerability remediation

Security gate ≠ vulnerability proof

Build failure ≠ application compromise

A production threshold should be set by an organization’s risk policy, not copied blindly from this training example.

16. Where Dependency-Check Fits in CI/CD

A simple pipeline placement is:

Developer
   ↓
Git push / Pull request
   ↓
CI pipeline
   ↓
Restore/install dependencies
   ↓
OWASP Dependency-Check
   ↓
Publish security report
   ↓
Security gate
   ↓
Build / Test / Deploy

Typical automation pattern:

1. Cache or centrally maintain Dependency-Check vulnerability data.
2. Scan the application during CI.
3. Save HTML/JSON/SARIF as artifacts.
4. Apply an agreed policy threshold.
5. Investigate findings.
6. Upgrade or mitigate vulnerable components.
7. Use documented suppressions only for justified false positives/not-applicable findings.
Code language: JavaScript (javascript)

17. Essential CLI Options for This Lab

For a quick lab, students do not need the full CLI option catalogue.

18. Three Student Tasks

Task 1 — Verify and Scan

Run:

~/odc-lab/dependency-check/bin/dependency-check.sh --version
Code language: JavaScript (javascript)

Then complete an HTML scan of NodeGoat.

Validation

Student can show:

Dependency-Check 13.0.0
and
dependency-check-report.html
Code language: CSS (css)

Task 2 — Investigate One Finding

Choose one dependency from the HTML report and record:

Dependency:
Version:
CVE:
CVSS:
Severity:
What evidence identified the component?
What should be investigated before calling it exploitable?

Validation

Student can explain why:

"CVE detected" does not automatically mean "application exploitable."
Code language: JavaScript (javascript)

Task 3 — Demonstrate a Gate

Run the scan with:

--failOnCVSS 7

Then inspect:

echo $?
Code language: PHP (php)

Validation

Student can explain that the exit status can be consumed by a CI system as a security gate.

19. Quick Troubleshooting

Problem — Java command not found

Cause: Java is not installed or is not on PATH.

Check:

java -version

Solution: Install a supported Java runtime. Java 17 is recommended for this lab.

Problem — dependency-check.sh permission denied

Check permissions:

ls -l ~/odc-lab/dependency-check/bin/dependency-check.sh
Code language: JavaScript (javascript)

If required:

chmod +x ~/odc-lab/dependency-check/bin/dependency-check.sh
Code language: JavaScript (javascript)

Verify:

~/odc-lab/dependency-check/bin/dependency-check.sh --version
Code language: JavaScript (javascript)

Problem — First scan is extremely slow

Likely cause: Vulnerability data is being downloaded for the first time.

Best lab solution: Pre-populate and reuse the --data directory before class.

Problem — NVD update errors or rate limiting

Likely causes:

• No NVD API key.
• API rate limiting.
• Proxy/firewall restrictions.
• Temporary network issues.

Lab solution: Use the instructor-prepared Dependency-Check data directory rather than spending class time rebuilding it.

Problem — No report appears

Confirm the requested output directory:

ls -lah ~/odc-lab/reports
Code language: JavaScript (javascript)

Then confirm the scan path exists:

pwd
ls package.json package-lock.json
Code language: CSS (css)

Problem — Many findings appear

That can be expected for a deliberately vulnerable training application.

Do not try to fix every finding during the 1-hour demo. Pick one finding and teach the investigation process.

Problem — node_modules is missing

Symptom:

the node_modules directory does not exist
Please run npm install prior to running dependency-check

Solution:

npm install --ignore-scripts --no-audit --no-fund

Problem — .NET Assembly Analyzer asks for dotnet

Cause: A broad --scan . discovered .exe/.dll files inside installed dependencies.

Quick-lab solution: Scan only package.json and package-lock.json and add:

--disableAssembly

Do not install the .NET SDK just to satisfy an analyzer that this Node.js lesson does not need.

Problem — Yarn executable not found

Cause: Yarn Audit Analyzer was initialized even though the project demonstration uses npm.

Solution:

--disableYarnAudit

Problem — OSS Index credentials warning

Cause: Dependency-Check 13’s OSS Index integration requires authentication.

Quick-lab solution:

--disableOssIndex

Use authenticated OSS Index intentionally in a production configuration; it is outside this 1-hour demo.

20. Lab Validation Checklist

At the end of the session, students should be able to check:

[ ] Java works
[ ] Git works
[ ] npm works
[ ] Dependency-Check 13.0.0 is available
[ ] NodeGoat is cloned
[ ] Commit 9336e34 is checked out
[ ] node_modules is prepared
[ ] Dependency-Check data is available
[ ] HTML scan completed
[ ] HTML report opened
[ ] One dependency was investigated
[ ] One CVE was identified
[ ] CVSS/severity were interpreted
[ ] JSON output was demonstrated
[ ] failOnCVSS security gate was demonstrated
[ ] CI/CD placement is understood
Code language: JavaScript (javascript)

21. Five-Minute Knowledge Check

1. What problem does Dependency-Check help solve?

Answer: It helps identify known vulnerabilities associated with third-party software components used by an application.

2. Does a reported CVE automatically prove the application is exploitable?

Answer: No. The finding must be validated in the context of the actual dependency, version, use, and deployment.

3. Why can the first Dependency-Check run take much longer?

Answer: Dependency-Check may need to download and build/update its local vulnerability data.

4. Which report is easiest for a person to review?

Answer: HTML.

5. Why generate JSON or SARIF?

Answer: They are machine-readable formats suitable for automation and security/tool integrations.

6. What does --failOnCVSS 7 demonstrate?

Answer: A CI/security gate that returns a failing status when a finding reaches the configured CVSS threshold.

7. Should suppression be used to make an uncomfortable finding disappear?

Answer: No. Suppression should be documented and justified for false positives or findings determined not to apply.

22. Key Takeaways

1. Dependency-Check is an SCA tool.

2. It analyzes application dependencies and matches them with known vulnerability intelligence.

3. A finding is the beginning of investigation—not the end.

4. CVE identifies the vulnerability; CVSS helps communicate severity.

5. HTML is useful for people; JSON/XML/SARIF are useful for automation and integrations.

6. Dependency-Check can participate in a CI/CD security gate using failOnCVSS.

7. Pre-populating the vulnerability database is essential for a smooth 1-hour classroom demo.
Code language: JavaScript (javascript)

23. Trainer Quick-Run Commands

Use these commands for the live demo after the Dependency-Check data directory has been prepared.

<em># 1. Verify Dependency-Check</em>
~/odc-lab/dependency-check/bin/dependency-check.sh --version

<em># 2. Clone and pin NodeGoat</em>
cd ~/odc-lab
git clone https://github.com/OWASP/NodeGoat.git
cd NodeGoat
git checkout 9336e34

<em># 3. Prepare Node dependencies safely for analysis</em>
npm install --ignore-scripts --no-audit --no-fund

<em># 4. Create report directory</em>
mkdir -p ~/odc-lab/reports

<em># 5. Focused HTML scan</em>
~/odc-lab/dependency-check/bin/dependency-check.sh \
  --project "OWASP NodeGoat Quick Lab" \
  --scan package.json \
  --scan package-lock.json \
  --data ~/odc-lab/odc-data \
  --noupdate \
  --format HTML \
  --out ~/odc-lab/reports \
  --disableAssembly \
  --disableYarnAudit \
  --disableOssIndex

<em># 6. Open the HTML report on macOS</em>
open ~/odc-lab/reports/dependency-check-report.html

<em># Linux desktop:</em>
<em># xdg-open ~/odc-lab/reports/dependency-check-report.html</em>

<em># 7. JSON report</em>
~/odc-lab/dependency-check/bin/dependency-check.sh \
  --project "OWASP NodeGoat Quick Lab" \
  --scan package.json \
  --scan package-lock.json \
  --data ~/odc-lab/odc-data \
  --noupdate \
  --format JSON \
  --out ~/odc-lab/reports \
  --disableAssembly \
  --disableYarnAudit \
  --disableOssIndex

<em># 8. Security-gate demo</em>
~/odc-lab/dependency-check/bin/dependency-check.sh \
  --project "OWASP NodeGoat Gate Demo" \
  --scan package.json \
  --scan package-lock.json \
  --data ~/odc-lab/odc-data \
  --noupdate \
  --format HTML \
  --out ~/odc-lab/reports \
  --disableAssembly \
  --disableYarnAudit \
  --disableOssIndex \
  --failOnCVSS 7

echo $?
Code language: HTML, XML (xml)

24. Trainer Notes

For a successful one-hour delivery:

• Prepare the Dependency-Check vulnerability data before students arrive.
• Prepare/test node_modules before class if network speed is uncertain.
• Use the focused manifest scan; do not use --scan . for this beginner Node.js demo.
• Do not spend classroom time troubleshooting NVD downloads unless update troubleshooting is the lesson.
• Demonstrate only one or two findings in depth.
• Emphasize evidence and investigation rather than vulnerability counts.
• Avoid turning the session into a complete SCA governance course.
• Use the CVSS threshold only to explain how a gate works; do not present 7.0 as a universal production policy.
• End by showing where the scan would run in CI/CD rather than configuring a full pipeline during the hour.

25. Official References

Use these source categories when expanding the lab:

• OWASP Dependency-Check documentation
• Dependency-Check official GitHub repository and releases
• NVD API documentation
• OWASP NodeGoat repository
• Official CI platform documentation when implementing pipeline integration

For instructor-led delivery, verify the Dependency-Check release and upstream documentation again before reusing this lab in a future semester or training cycle.

Rajesh Kumar

I’m Rajesh Kumar, a DevOps, SRE, DevSecOps, Cloud, and Platform Engineering expert passionate about sharing practical knowledge, real-world experiences, and industry best practices. I have worked at Cotocus and regularly write about technology, travel, investing, health, product reviews, and digital marketing through my various platforms.

I publish technical articles at DevOps School, travel stories at Holiday Landmark, stock market insights at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at TrueReviewNow, and SEO and digital marketing strategies at Wizbrand.