{"id":78840,"date":"2026-10-03T05:40:15","date_gmt":"2026-10-03T05:40:15","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=78840"},"modified":"2026-10-03T05:40:21","modified_gmt":"2026-10-03T05:40:21","slug":"owasp-dependency-check-hands-on-lab-manual","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/owasp-dependency-check-hands-on-lab-manual\/","title":{"rendered":"OWASP Dependency-Check\u00a0– Hands-On Lab Manual"},"content":{"rendered":"\n

OWASP Dependency-Check 13.0.0<\/h1>\n\n\n\n

Basic-to-Essentials Hands-On Lab Manual<\/h2>\n\n\n\n

Audience:<\/strong> Beginners and engineers with basic DevOps\/DevSecOps knowledge
Tutorial verified\/researched on:<\/strong> 2026-10-03
OWASP Dependency-Check version:<\/strong> 13.0.0
Minimum Java supported by Dependency-Check:<\/strong> Java 11
Recommended lab Java runtime:<\/strong> Java 17 LTS or newer supported LTS
Recommended lab OS:<\/strong> Ubuntu 24.04 LTS (macOS notes included)
Sample repository:<\/strong> OWASP\/NodeGoat
Repository commit:<\/strong> 9336e34<\/code> (fix: sync lockfile<\/code>)
Sample application:<\/strong> Node.js \/ npm
Recommended Node runtime for the lab host:<\/strong> Node.js 24 LTS with npm available<\/p>\n\n\n\n

\n

Version note:<\/strong> This manual is deliberately pinned to Dependency-Check 13.0.0 and an immutable NodeGoat commit. Vulnerability databases continue to change, so the number<\/em> of findings and exact severity metadata can change even when the code does not.<\/p>\n<\/blockquote>\n\n\n\n

\n\n\n\n

1. Tutorial Overview<\/h1>\n\n\n\n

OWASP Dependency-Check is a Software Composition Analysis (SCA) tool that attempts to identify publicly disclosed vulnerabilities in third-party dependencies. It analyzes dependency evidence, identifies software components, maps them to identifiers such as CPEs, and associates known CVEs with the identified component.<\/p>\n\n\n\n

This lab takes you from installation to a practical scan of a real OWASP training application. You will generate reports, investigate a finding, work with suppression safely, test a CVSS-based gate, and see basic Maven, Gradle, and GitHub Actions integrations.<\/p>\n\n\n\n

What this lab is – and is not<\/h2>\n\n\n\n

This lab covers basic to essential operational use<\/strong>. It does not try to teach enterprise database mirroring, centralized Dependency-Check services, custom analyzers, advanced hints, air-gapped architecture, or large-scale scanner administration.<\/p>\n\n\n\n

Current-version facts that matter<\/h2>\n\n\n\n
    \n
  • Latest stable Dependency-Check release at the research cut-off:\u00a013.0.0<\/strong>, released 2026-08-03.<\/li>\n\n\n\n
  • Java\u00a011 or newer<\/strong>\u00a0is required for Dependency-Check 11.0.0+.<\/li>\n\n\n\n
  • Dependency-Check moved from the NVD legacy data-feed model to the\u00a0NVD API<\/strong>\u00a0in 9.0.0+.<\/li>\n\n\n\n
  • Dependency-Check\u00a012.1.0+ is mandatory<\/strong>\u00a0because of NVD API compatibility changes; this lab uses 13.0.0.<\/li>\n\n\n\n
  • An NVD API key is\u00a0strongly recommended<\/strong>. Without one, initial\/update operations are much slower and rate limits are easier to hit.<\/li>\n\n\n\n
  • Current CLI report formats are:\u00a0HTML, XML, CSV, JSON, JUNIT, SARIF, JENKINS, GITLAB, ALL<\/strong>.<\/li>\n\n\n\n
  • The active source repository is\u00a0dependency-check\/DependencyCheck<\/code>; the old\u00a0jeremylong\/DependencyCheck<\/code>\u00a0repository is archived\/moved.<\/li>\n<\/ul>\n\n\n\n
    \n\n\n\n

    2. Learning Objectives<\/h1>\n\n\n\n

    By the end of the lab, you should be able to:<\/p>\n\n\n\n

      \n
    • Explain what OWASP Dependency-Check is and where it fits in SCA.<\/li>\n\n\n\n
    • Explain why dependency vulnerability analysis is part of DevSecOps.<\/li>\n\n\n\n
    • Install Dependency-Check CLI 13.0.0.<\/li>\n\n\n\n
    • Verify Java and Dependency-Check versions.<\/li>\n\n\n\n
    • Explain the basic evidence -> component -> CPE\/CVE workflow.<\/li>\n\n\n\n
    • Configure the minimum settings needed for a useful scan.<\/li>\n\n\n\n
    • Use an NVD API key without committing it to source control.<\/li>\n\n\n\n
    • Clone and pin a real GitHub application for a reproducible lab.<\/li>\n\n\n\n
    • Identify direct dependencies in\u00a0package.json<\/code>\u00a0and resolved dependencies in\u00a0package-lock.json<\/code>.<\/li>\n\n\n\n
    • Run Dependency-Check against the codebase.<\/li>\n\n\n\n
    • Locate and open the generated HTML report.<\/li>\n\n\n\n
    • Interpret dependency, component, CPE, evidence, CVE, CVSS, severity, references, and affected-version information.<\/li>\n\n\n\n
    • Explain why a detected vulnerability is not automatically proof of exploitability.<\/li>\n\n\n\n
    • Generate multiple report formats.<\/li>\n\n\n\n
    • Use important CLI options without memorizing the full CLI.<\/li>\n\n\n\n
    • Create and validate a suppression in a controlled exercise.<\/li>\n\n\n\n
    • Configure a CVSS threshold that returns a failing exit code.<\/li>\n\n\n\n
    • Understand the basics of Maven and Gradle integration.<\/li>\n\n\n\n
    • Understand a current GitHub Actions integration pattern.<\/li>\n\n\n\n
    • Troubleshoot common update, Java, network, path, and report problems.<\/li>\n<\/ul>\n\n\n\n
      \n\n\n\n

      3. Prerequisites<\/h1>\n\n\n
      Prerequisites\n\u251c\u2500\u2500 64<\/span>-bit Ubuntu Linux or macOS\n\u251c\u2500\u2500 Java 11<\/span>+ (Java 17<\/span> LTS recommended for<\/span> this<\/span> lab)\n\u251c\u2500\u2500 Git\n\u251c\u2500\u2500 curl\n\u251c\u2500\u2500 unzip\n\u251c\u2500\u2500 Internet access\n\u251c\u2500\u2500 Node.js 24<\/span> LTS + npm for<\/span> the NodeGoat\/npm analyzers\n\u251c\u2500\u2500 NVD API key (strongly recommended)\n\u2514\u2500\u2500 About 4<\/span> GB free disk space recommended for<\/span> tools, cache, repo and reports\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Prerequisite verification<\/h2>\n\n\n\n
      Run:<\/p>\n\n\n
      java -version\ngit --version\ncurl --version | head -n 1\nunzip -v | head -n 2\nnode --version\nnpm --version\n<\/code><\/span><\/pre>\n\n\n
      Expected result<\/h3>\n\n\n\n
      You should see:<\/p>\n\n\n\n
        \n
      • Java 11 or newer.<\/li>\n\n\n\n
      • A valid Git version.<\/li>\n\n\n\n
      • curl<\/code>\u00a0and\u00a0unzip<\/code>\u00a0available.<\/li>\n\n\n\n
      • Node.js\/npm commands available.<\/li>\n<\/ul>\n\n\n\n
        Exact patch versions are not important to this lab.<\/p>\n\n\n\n
        Important Node.js note<\/h3>\n\n\n\n
        Dependency-Check’s current documentation states that npm\/pnpm\/yarn analysis requires the corresponding package-manager command to be installed because the respective audit capability is used. Node.js 24 is an LTS line as of the research date. You do not<\/strong> need to run the intentionally vulnerable NodeGoat application for this lab.<\/p>\n\n\n\n
        NVD API key<\/h3>\n\n\n\n
        Request an NVD API key from the official NVD developer page:<\/p>\n\n\n\n
        \nhttps:\/\/nvd.nist.gov\/developers\/request-an-api-key\n<\/div><\/figure>\n\n\n\n
        Do not put the key in Git, screenshots, lab handouts, shell scripts checked into repositories, or CI workflow source.<\/p>\n\n\n\n
        For an interactive Bash\/Zsh lab session:<\/p>\n\n\n
        read -rsp \"NVD API key: \"<\/span> NVD_API_KEY; echo\nexport<\/span> NVD_API_KEY\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Verification without printing the secret:<\/p>\n\n\n
        test -n \"$NVD_API_KEY\"<\/span> && echo<\/span> \"NVD_API_KEY is set\"<\/span> || echo<\/span> \"NVD_API_KEY is NOT set\"<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
        \n\n\n\n
        4. Lab Environment<\/h1>\n\n\n\n
        Recommended configuration<\/h2>\n\n\n\n
        Component<\/th>Lab recommendation<\/th>Requirement \/ reason<\/th><\/tr><\/thead>
        OS<\/td>Ubuntu 24.04 LTS<\/td>Stable, common training host<\/td><\/tr>
        macOS<\/td>Supported<\/td>Homebrew alternative included<\/td><\/tr>
        Java<\/td>17 LTS<\/td>Dependency-Check requires Java 11+<\/td><\/tr>
        Git<\/td>Current supported version<\/td>Clone\/pin NodeGoat<\/td><\/tr>
        Node.js<\/td>24 LTS<\/td>Current LTS at research cut-off; provides npm<\/td><\/tr>
        npm<\/td>Bundled\/current with Node LTS<\/td>Required for npm analysis capability<\/td><\/tr>
        RAM<\/td>4 GB minimum; 8 GB comfortable<\/td>Database + Java + project tooling<\/td><\/tr>
        Disk<\/td>4 GB free recommended<\/td>Distribution, NVD data, project, reports<\/td><\/tr>
        Internet<\/td>Required<\/td>GitHub releases, NVD API and analyzer data<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
        Environment variables used in this lab<\/h2>\n\n\n
        export<\/span> DC_VERSION=\"13.0.0\"<\/span>\nexport<\/span> DC_ROOT=\"$HOME\/tools\/owasp-dc-$DC_VERSION\"<\/span>\nexport<\/span> DC_HOME=\"$DC_ROOT\/dependency-check\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        NVD_API_KEY<\/code> is set interactively as shown earlier.<\/p>\n\n\n\n
        \n\n\n\n
        5. What Is OWASP Dependency-Check?<\/h1>\n\n\n\n
        Dependency-Check is an SCA utility. Its main job is to help answer:<\/p>\n\n\n\n
        \n
        “Do any of the third-party components used by this application correspond to software for which publicly disclosed vulnerabilities are known?”<\/p>\n<\/blockquote>\n\n\n\n
        It is not<\/strong> a proof-of-exploitability engine. It is also not a replacement for patch management, threat modeling, SAST, DAST, runtime testing, or human triage.<\/p>\n\n\n\n
        Why SCA matters<\/h2>\n\n\n\n
        Modern applications depend on large dependency trees. A developer may add one package while the build resolves dozens or hundreds of transitive components. SCA creates visibility into that supply chain and helps teams prioritize dependency upgrades and investigation.<\/p>\n\n\n\n
        Where Dependency-Check fits<\/h2>\n\n\n
        Source code \/ dependency manifests\n              |\n              v\n         Build \/ CI\n              |\n              v\n     Dependency-Check (SCA)\n              |\n     +--------+---------+\n     |                  |\n     v                  v\nHuman report       Machine report\nHTML               JSON<\/span>\/XML\/SARIF\/etc.\n     |                  |\n     +--------+---------+\n              v\n          Triage \/ Gate\n              |\n              v\n     Upgrade \/ mitigate \/ suppress\n              |\n              v\n            Deploy\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        \n\n\n\n
        6. How Dependency-Check Works<\/h1>\n\n\n\n
        At a beginner level, think of the scan as this pipeline:<\/p>\n\n\n
        Application\n    |\n    v\nDependencies \/ manifests \/ package metadata\n    |\n    v\nAnalyzers collect evidence\n(vendor, product, version and ecosystem metadata)\n    |\n    v\nComponent identification\n    |\n    v\nCPE \/ package identifiers where applicable\n    |\n    v\nVulnerability matching\n    |\n    v\nCVE + CVSS + references + evidence\n    |\n    v\nHTML \/ JSON<\/span> \/ XML \/ CSV \/ SARIF \/ ... reports\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Dependency-Check uses analyzers to collect evidence. Evidence is categorized around vendor, product, and version. Evidence is assigned confidence levels. The tool then attempts to identify the component; for CPE-based matching, associated CVEs can be attached to the dependency.<\/p>\n\n\n\n
        Why false positives can happen<\/h2>\n\n\n\n
        Names are not always globally unique. Two unrelated projects can have similar names or versions, and ecosystem metadata can be incomplete. Therefore, the first report-triage question is:<\/p>\n\n\n\n
        \n
        Is the identified component\/CPE actually the dependency I use?<\/strong><\/p>\n<\/blockquote>\n\n\n\n
        Why false negatives can happen<\/h2>\n\n\n\n
        A dependency may lack enough identifying evidence, a product can be named differently in NVD data, or an ecosystem may not map cleanly to CPE. A clean report therefore does not prove that the application has no vulnerable dependencies.<\/p>\n\n\n\n
        \n\n\n\n
        7. Installation<\/h1>\n\n\n\n
        The main lab uses the official CLI distribution<\/strong>. This makes the CLI behavior visible and keeps the lab independent of a particular build system.<\/p>\n\n\n\n
        Step 1 – Create a user-owned tools directory<\/h2>\n\n\n\n
        Command<\/h3>\n\n\n
        export<\/span> DC_VERSION=\"13.0.0\"<\/span>\nexport<\/span> DC_ROOT=\"$HOME\/tools\/owasp-dc-$DC_VERSION\"<\/span>\nmkdir -p \"$DC_ROOT\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Expected output<\/h3>\n\n\n\n
        No output is expected if the command succeeds.<\/p>\n\n\n\n
        Verification<\/h3>\n\n\n
        test -d \"$DC_ROOT\"<\/span> && echo<\/span> \"Tool directory ready: $DC_ROOT\"<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
        Troubleshooting<\/h3>\n\n\n\n
        Problem:<\/strong> Permission denied.
        Cause:<\/strong> You selected a directory your user cannot write to.
        Solution:<\/strong> Use a user-owned path such as $HOME\/tools<\/code>.
        Verification:<\/strong> test -w \"$DC_ROOT\" && echo writable<\/code>.<\/p>\n\n\n\n
        \n\n\n\n
        Step 2 – Download Dependency-Check 13.0.0<\/h2>\n\n\n\n
        Command<\/h3>\n\n\n
        curl -fL \\\n  \"https:\/\/github.com\/dependency-check\/DependencyCheck\/releases\/download\/v${DC_VERSION}\/dependency-check-${DC_VERSION}-release.zip\"<\/span> \\\n  -o \"\/tmp\/dependency-check-${DC_VERSION}-release.zip\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Expected output<\/h3>\n\n\n\n
        curl<\/code> displays transfer progress and exits with status 0.<\/p>\n\n\n\n
        Verification<\/h3>\n\n\n
        ls -lh \"\/tmp\/dependency-check-${DC_VERSION}-release.zip\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Troubleshooting<\/h3>\n\n\n\n
        Problem:<\/strong> HTTP\/DNS\/connection error.
        Cause:<\/strong> Internet access, proxy, DNS or GitHub access is blocked.
        Solution:<\/strong> Confirm HTTPS access to GitHub or configure the required corporate proxy.
        Verification:<\/strong> Repeat the download and confirm exit code 0.<\/p>\n\n\n\n
        \n
        Integrity option:<\/strong> OWASP publishes a signature file and documents GPG verification. For production distribution workflows, verify the release signature rather than treating an HTTPS download alone as supply-chain validation.<\/p>\n<\/blockquote>\n\n\n\n
        \n\n\n\n
        Step 3 – Extract the release<\/h2>\n\n\n\n
        Command<\/h3>\n\n\n
        unzip -q \"\/tmp\/dependency-check-${DC_VERSION}-release.zip\"<\/span> -d \"$DC_ROOT\"<\/span>\nexport<\/span> DC_HOME=\"$DC_ROOT\/dependency-check\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Expected output<\/h3>\n\n\n\n
        No output is expected from unzip -q<\/code> on success.<\/p>\n\n\n\n
        Verification<\/h3>\n\n\n
        ls \"$DC_HOME\/bin\/dependency-check.sh\"<\/span>\nls \"$DC_HOME\/lib\"<\/span> | head\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Troubleshooting<\/h3>\n\n\n\n
        Problem:<\/strong> cannot find or open<\/code> archive.
        Cause:<\/strong> Download failed or filename differs.
        Solution:<\/strong> Verify the exact file under \/tmp<\/code>.
        Verification:<\/strong> ls -l \/tmp\/dependency-check-13.0.0-release.zip<\/code>.<\/p>\n\n\n\n
        \n\n\n\n
        Step 4 – Verify the CLI<\/h2>\n\n\n\n
        Command<\/h3>\n\n\n
        \"$DC_HOME\/bin\/dependency-check.sh\"<\/span> --version\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Expected output<\/h3>\n\n\n\n
        Output should identify Dependency-Check 13.0.0<\/strong>.<\/p>\n\n\n\n
        Verification<\/h3>\n\n\n
        \"$DC_HOME\/bin\/dependency-check.sh\"<\/span> --help | head -n 20<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Troubleshooting<\/h3>\n\n\n\n
        Problem:<\/strong> Java error or unsupported runtime.
        Cause:<\/strong> Java is missing, too old, or JAVA_HOME<\/code>\/PATH<\/code> points to the wrong runtime.
        Solution:<\/strong> Install\/select Java 11+; Java 17 LTS is recommended for this lab.
        Verification:<\/strong> java -version<\/code>, then rerun --version<\/code>.<\/p>\n\n\n\n
        \n\n\n\n
        macOS alternative – Homebrew<\/h2>\n\n\n\n
        Official Dependency-Check documentation also supports Homebrew:<\/p>\n\n\n
        brew update\nbrew install dependency-check\ndependency-check --version\n<\/code><\/span><\/pre>\n\n\n
        For the rest of the lab, macOS Homebrew users can replace:<\/p>\n\n\n
        \"$DC_HOME\/bin\/dependency-check.sh\"<\/span>\n<\/code><\/span>Code language:<\/span> JSON \/ JSON with Comments<\/span> (<\/span>json<\/span>)<\/span><\/small><\/pre>\n\n\n
        with:<\/p>\n\n\n
        dependency-check\n<\/code><\/span><\/pre>\n\n\n
        Windows note<\/h2>\n\n\n\n
        Use the official ZIP distribution and run:<\/p>\n\n\n
        .\\bin<\/span>\\dependency-check<\/span>.bat<\/span> --version<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
        The CLI options taught in this manual are the same; path quoting and shell syntax differ.<\/p>\n\n\n\n
        Alternative delivery methods<\/h2>\n\n\n\n
        Method<\/th>Good for<\/th>Lab status<\/th><\/tr><\/thead>
        CLI ZIP<\/td>Learning the scanner directly<\/td>Main lab<\/strong><\/td><\/tr>
        Homebrew<\/td>macOS convenience<\/td>Supported alternative<\/td><\/tr>
        Docker<\/td>Isolated execution \/ CI<\/td>Briefly introduced<\/td><\/tr>
        Maven plugin<\/td>Maven builds<\/td>Integration section<\/td><\/tr>
        Gradle plugin<\/td>Gradle builds<\/td>Integration section<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
        \n\n\n\n
        8. Installation Verification<\/h1>\n\n\n\n
        Run all of the following:<\/p>\n\n\n
        java -version\n\"$DC_HOME\/bin\/dependency-check.sh\"<\/span> --version\n\"$DC_HOME\/bin\/dependency-check.sh\"<\/span> --help | head -n 30<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        Validation criteria:<\/p>\n\n\n
        [ ]<\/span> Java<\/span> command<\/span> works<\/span>\n[ ]<\/span> Java<\/span> is<\/span> version<\/span> 11 or<\/span> newer<\/span>\n[ ]<\/span> Dependency-Check<\/span> reports<\/span> 13.0<\/span>.0<\/span>\n[ ]<\/span> --help<\/span> displays<\/span> CLI<\/span> usage<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
        Exercise 1 – Install and verify<\/h3>\n\n\n\n
        Task:<\/strong> Install Dependency-Check and prove the installed version.
        Success criteria:<\/strong> A terminal capture or lab note showing Dependency-Check 13.0.0 and Java 11+.<\/p>\n\n\n\n
        \n\n\n\n
        9. NVD \/ Data Update Configuration<\/h1>\n\n\n\n
        Dependency-Check maintains local vulnerability data so it does not need to download the full vulnerability corpus for every scan.<\/p>\n\n\n\n
        What changed from older tutorials?<\/h2>\n\n\n\n
        Older material often refers to downloading NVD JSON feeds or NVD API 1.0. That is no longer the standard current path:<\/p>\n\n\n\n
          \n
        • Dependency-Check has used the\u00a0NVD API<\/strong>\u00a0since 9.0.0+.<\/li>\n\n\n\n
        • NVD 1.0 APIs are retired.<\/li>\n\n\n\n
        • NVD 2.0 APIs are the preferred\/current NVD interface.<\/li>\n\n\n\n
        • Dependency-Check 12.1.0+ is mandatory because of NVD API compatibility changes.<\/li>\n<\/ul>\n\n\n\n
          NVD API key – required or recommended?<\/h2>\n\n\n\n
          For Dependency-Check itself, the key is not strictly required for every local invocation, but the project highly recommends<\/strong> it. Without a key, update calls use a longer default delay and initial population becomes extremely slow.<\/p>\n\n\n\n
          Current CLI defaults include:<\/p>\n\n\n\n
          Setting<\/th>Current CLI behavior<\/th><\/tr><\/thead>
          --nvdApiKey<\/code><\/td>Supplies NVD API key<\/td><\/tr>
          --nvdApiDelay<\/code><\/td>3500 ms with key; 8000 ms without key<\/td><\/tr>
          --nvdApiResultsPerPage<\/code><\/td>2000<\/td><\/tr>
          --nvdValidForHours<\/code><\/td>4 hours<\/td><\/tr>
          --updateonly<\/code><\/td>Update phase only; no scan\/report<\/td><\/tr>
          --noupdate<\/code><\/td>Disable automatic NVD\/hosted-suppression\/RetireJS updates<\/td><\/tr>
          --data<\/code><\/td>Override persistent data directory<\/td><\/tr>
          --purge<\/code><\/td>Delete local NVD copy to force refresh<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
          Step 1 – Perform an explicit data update<\/h2>\n\n\n\n
          Command<\/h3>\n\n\n
          \"$DC_HOME\/bin\/dependency-check.sh\"<\/span> \\\n  --updateonly \\\n  --nvdApiKey \"$NVD_API_KEY\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          Expected output<\/h3>\n\n\n\n
          Expect informational messages indicating that vulnerability data is being retrieved\/processed. The first population is substantially heavier than incremental updates. Exact line counts and timestamps change over time.<\/p>\n\n\n\n
          --updateonly<\/code> does not<\/strong> generate a vulnerability report.<\/p>\n\n\n\n
          Verification<\/h3>\n\n\n
          find \"$DC_HOME\/data\"<\/span> -maxdepth 2<\/span> -type f | head\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
          You should see local Dependency-Check data files.<\/p>\n\n\n\n
          Troubleshooting<\/h3>\n\n\n\n
          Problem:<\/strong> 403 or NVD request failures.
          Cause:<\/strong> Invalid\/rate-limited key, too many concurrent jobs sharing a key, network filtering, or NVD service issues.
          Solution:<\/strong> Verify the key, avoid many concurrent jobs using one key, persist\/reuse the data cache, and check NVD availability.
          Verification:<\/strong> Run --updateonly<\/code> again after correcting the cause and confirm it completes successfully.<\/p>\n\n\n\n
          CI warning: do not re-download the NVD corpus in every ephemeral job<\/h2>\n\n\n\n
          The Dependency-Check project explicitly warns that one API key used across many simultaneous CI builds can hit NVD rate limits. Operational CI should use a cache or mirrored data strategy. Enterprise mirroring is outside this beginner lab.<\/p>\n\n\n\n
          \n\n\n\n
          10. Sample GitHub Project<\/h1>\n\n\n\n
          Selected project: OWASP NodeGoat<\/h2>\n\n\n\n
          Repository:<\/p>\n\n\n\n
          \nhttps:\/\/github.com\/OWASP\/NodeGoat\n<\/div><\/figure>\n\n\n\n
          Pinned commit:<\/p>\n\n\n
          9336e34  fix: sync lockfile\n<\/code><\/span><\/pre>\n\n\n
          Why this repository was selected<\/h3>\n\n\n\n
            \n
          • It is an OWASP public training project.<\/li>\n\n\n\n
          • It is intentionally designed for security learning.<\/li>\n\n\n\n
          • It uses a real npm dependency tree.<\/li>\n\n\n\n
          • The pinned commit contains both\u00a0package.json<\/code>\u00a0and\u00a0package-lock.json<\/code>.<\/li>\n\n\n\n
          • It intentionally pins\u00a0marked<\/code>\u00a0version\u00a00.3.5<\/code>, a historically vulnerable version used by the project’s insecure-components lesson.<\/li>\n\n\n\n
          • The immutable commit makes the lab reproducible even if\u00a0master<\/code>\u00a0changes later.<\/li>\n<\/ul>\n\n\n\n
            \n
            Safety note:<\/strong> NodeGoat is intentionally vulnerable. This lab scans its dependency metadata. Do not expose the application to untrusted networks and do not use it as a production service.<\/p>\n<\/blockquote>\n\n\n\n
            Step 1 – Clone NodeGoat<\/h2>\n\n\n
            mkdir -p \"$HOME\/labs\"<\/span>\ncd \"$HOME\/labs\"<\/span>\ngit clone<\/span> https:\/\/github.com\/OWASP\/NodeGoat.git<\/span>\ncd NodeGoat\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
            Expected output<\/h3>\n\n\n\n
            Git reports cloning objects into NodeGoat<\/code>.<\/p>\n\n\n\n
            Verification<\/h3>\n\n\n
            git remote -v\n<\/code><\/span><\/pre>\n\n\n
            \n\n\n\n
            Step 2 – Pin the lab commit<\/h2>\n\n\n
            git checkout 9336e34\n<\/code><\/span><\/pre>\n\n\n
            Expected Git behavior: detached HEAD at the requested historical commit.<\/p>\n\n\n\n
            Verify:<\/p>\n\n\n
            git rev-parse --short HEAD\n<\/code><\/span><\/pre>\n\n\n
            Expected:<\/p>\n\n\n
            9336e34\n<\/code><\/span><\/pre>\n\n\n
            \n\n\n\n
            Step 3 – Inspect the dependency manifests<\/h2>\n\n\n
            ls -l package.json package-lock.json\ngrep '\"marked\"'<\/span> package.json\ngrep -m 1<\/span> -A 3<\/span> '\"marked\"'<\/span> package-lock.json\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
            Expected package.json<\/code> line:<\/p>\n\n\n
            \"marked\"<\/span>: \"0.3.5\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
            Important dependency concepts<\/h3>\n\n\n\n
              \n
            • package.json<\/code>\u00a0expresses the application’s direct dependency declarations.<\/li>\n\n\n\n
            • package-lock.json<\/code>\u00a0records the resolved npm dependency graph.<\/li>\n\n\n\n
            • The lock file contains many more components than the direct dependency list because transitive dependencies are included.<\/li>\n<\/ul>\n\n\n\n
              Exercise 2 – Identify dependencies<\/h3>\n\n\n\n
              Task:<\/strong> Identify five direct dependencies and one exact pinned dependency.
              Validation:<\/strong> Student records marked 0.3.5<\/code> and four other entries from package.json<\/code>.<\/p>\n\n\n\n
              \n\n\n\n
              11. First Dependency-Check Scan<\/h1>\n\n\n\n
              Step 1 – Go to the project<\/h2>\n\n\n
              cd \"$HOME\/labs\/NodeGoat\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
              Verify:<\/p>\n\n\n
              pwd\ngit rev-parse --short HEAD\n<\/code><\/span><\/pre>\n\n\n
              \n\n\n\n
              Step 2 – Create the report directory<\/h2>\n\n\n
              mkdir -p reports\n<\/code><\/span><\/pre>\n\n\n
              \n\n\n\n
              Step 3 – Run the scan<\/h2>\n\n\n
              \"$DC_HOME\/bin\/dependency-check.sh\"<\/span> \\\n  --project \"OWASP NodeGoat - Training Lab\"<\/span> \\\n  --scan \".\"<\/span> \\\n  --out \".\/reports\"<\/span> \\\n  --format \"HTML\"<\/span> \\\n  --nvdApiKey \"$NVD_API_KEY\"<\/span> \\\n  --log \".\/reports\/dependency-check.log\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
              What Dependency-Check is doing<\/h3>\n\n\n\n
                \n
              1. Ensuring vulnerability\/supporting data is current enough.<\/li>\n\n\n\n
              2. Walking the requested scan path.<\/li>\n\n\n\n
              3. Running applicable analyzers.<\/li>\n\n\n\n
              4. Reading npm package metadata\/lock information.<\/li>\n\n\n\n
              5. Collecting identifiers\/evidence.<\/li>\n\n\n\n
              6. Correlating identified components with vulnerability data.<\/li>\n\n\n\n
              7. Creating the requested report.<\/li>\n<\/ol>\n\n\n\n
                Expected output<\/h3>\n\n\n\n
                The console should show normal update\/analysis\/report-generation messages. Exact analyzer messages and vulnerability counts are intentionally not<\/strong> fixed in this manual because online vulnerability\/advisory data evolves.<\/p>\n\n\n\n
                Verification<\/h3>\n\n\n
                find reports -maxdepth 1<\/span> -type f -print<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                You should find an HTML report, normally:<\/p>\n\n\n
                reports\/dependency-check-report.html\n<\/code><\/span><\/pre>\n\n\n
                \n\n\n\n
                Step 4 – Open the report<\/h2>\n\n\n\n
                Linux desktop:<\/p>\n\n\n
                xdg-open reports\/dependency-check-report.html\n<\/code><\/span><\/pre>\n\n\n
                macOS:<\/p>\n\n\n
                open reports\/dependency-check-report.html\n<\/code><\/span><\/pre>\n\n\n
                If you are on a headless training VM, copy the report to your workstation or use a browser-accessible lab artifact location.<\/p>\n\n\n\n
                Exercise 3 – First scan<\/h3>\n\n\n\n
                Task:<\/strong> Run the scan and locate the HTML report.
                Validation:<\/strong> reports\/dependency-check-report.html<\/code> exists and opens.<\/p>\n\n\n\n
                \n\n\n\n
                12. Understanding the Output<\/h1>\n\n\n\n
                The HTML report summarizes dependencies and vulnerable components, then provides per-dependency details.<\/p>\n\n\n\n
                The current OWASP report-reading documentation highlights these top-level fields:<\/p>\n\n\n\n
                Field<\/th>Meaning<\/th><\/tr><\/thead>
                Dependency<\/td>File\/component being analyzed<\/td><\/tr>
                CPE<\/td>Common Platform Enumeration identifier if identified<\/td><\/tr>
                GAV<\/td>Maven Group:Artifact:Version where relevant<\/td><\/tr>
                Highest Severity<\/td>Highest associated vulnerability severity<\/td><\/tr>
                CVE Count<\/td>Number of associated CVEs<\/td><\/tr>
                CPE Confidence<\/td>Confidence in the CPE identification<\/td><\/tr>
                Evidence Count<\/td>Amount of evidence used for identification<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                For npm components, you may also see package ecosystem identifiers rather than Java-oriented GAV information.<\/p>\n\n\n\n
                The most important triage sequence<\/h2>\n\n\n
                Finding appears\n     |\n     v\nIs the dependency\/component identified correctly?\n     |\n     +-- No --> false<\/span>-positive investigation \/ suppression candidate\n     |\n     v Yes\nDoes the vulnerability version range include our version?\n     |\n     +-- No --> investigate data\/matching discrepancy\n     |\n     v Yes\nIs the vulnerable code\/configuration reachable or applicable here?\n     |\n     +-- Unknown --> investigate\n     |\n     +-- No --> document<\/span> compensating facts; suppression only if<\/span> justified\n     |\n     v Yes\nRemediate \/ upgrade \/ mitigate\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                \n\n\n\n
                13. Understanding the HTML Report<\/h1>\n\n\n\n
                Field-by-field workflow<\/h2>\n\n\n\n
                For one finding, work downward through:<\/p>\n\n\n
                Dependency\n    |\n    v\nDetected version \/ package identity\n    |\n    v\nCPE \/ package identifier + confidence\n    |\n    v\nCVE \/ advisory\n    |\n    v\nSeverity + CVSS version\/score\n    |\n    v\nDescription \/ CWE where present\n    |\n    v\nAffected version range\n    |\n    v\nReferences\n    |\n    v\nFixed version \/ remediation source where available\n    |\n    v\nYour application's real usage and exposure\n<\/code><\/span><\/pre>\n\n\n
                Example candidate in this lab: marked 0.3.5<\/code><\/h2>\n\n\n\n
                The pinned NodeGoat manifest explicitly contains:<\/p>\n\n\n
                marked<\/span> 0.3<\/span>.5<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
                One historical advisory associated with that version is CVE-2016-10531<\/strong>, a sanitization-bypass\/XSS issue affecting marked<\/code> 0.3.5 and earlier. A current OSV record lists a CVSS v3 score of 6.1 (Medium) and a fixed version of 0.3.6.<\/p>\n\n\n\n
                Do not hard-code your lab grading to this one CVE.<\/strong> Dependency-Check data sources and matching evolve. If the exact CVE is not in your current report, select another actual finding from the generated report and perform the same analysis.<\/p>\n\n\n\n
                Finding worksheet<\/h2>\n\n\n\n
                Question<\/th>Student answer<\/th><\/tr><\/thead>
                Dependency<\/td><\/td><\/tr>
                Installed\/resolved version<\/td><\/td><\/tr>
                Identifier\/CPE\/PURL<\/td><\/td><\/tr>
                CPE confidence, if present<\/td><\/td><\/tr>
                CVE<\/td><\/td><\/tr>
                CVSS version<\/td><\/td><\/tr>
                CVSS score<\/td><\/td><\/tr>
                Severity<\/td><\/td><\/tr>
                CWE, if present<\/td><\/td><\/tr>
                Affected range<\/td><\/td><\/tr>
                Fixed version, if authoritative data provides one<\/td><\/td><\/tr>
                Reference used for verification<\/td><\/td><\/tr>
                Is the component identification correct?<\/td><\/td><\/tr>
                Is the vulnerable version actually present?<\/td><\/td><\/tr>
                Is exploitability\/applicability confirmed?<\/td><\/td><\/tr>
                Recommended next action<\/td><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                Exercise 4 – Read one finding<\/h3>\n\n\n\n
                Task:<\/strong> Complete the worksheet for a real finding in your report.
                Validation:<\/strong> Student can explain component identity, CVE, CVSS and why further investigation may still be required.<\/p>\n\n\n\n
                \n\n\n\n
                14. Understanding CVE, CVSS, Severity and Evidence<\/h1>\n\n\n\n
                CVE<\/h2>\n\n\n\n
                A CVE is an identifier for a publicly disclosed vulnerability record. A CVE identifier does not by itself tell you whether the issue is exploitable in your specific application.<\/p>\n\n\n\n
                CVSS<\/h2>\n\n\n\n
                CVSS is a standardized severity-scoring system. Dependency-Check may display scores supplied by vulnerability sources. Always note the CVSS version and source<\/strong> shown in the report; do not compare numbers from different contexts as though they were identical measurements.<\/p>\n\n\n\n
                Typical qualitative bands on the 0-10 scale are:<\/p>\n\n\n\n
                Score<\/th>Qualitative severity<\/th><\/tr><\/thead>
                0.0<\/td>None<\/td><\/tr>
                0.1-3.9<\/td>Low<\/td><\/tr>
                4.0-6.9<\/td>Medium<\/td><\/tr>
                7.0-8.9<\/td>High<\/td><\/tr>
                9.0-10.0<\/td>Critical<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                Severity is not business risk<\/h2>\n\n\n\n
                A high CVSS score does not automatically mean “fix this first” in every environment. Real risk also depends on reachability, exposure, privileges, data sensitivity, compensating controls, known exploitation, asset importance and patch feasibility.<\/p>\n\n\n\n
                Evidence and CPE confidence<\/h2>\n\n\n\n
                Dependency-Check evidence supports its identification decision. Confidence indicates how strongly the collected evidence supported a CPE match. A high-confidence match can still require human validation<\/strong>; confidence is about identity matching, not exploitability.<\/p>\n\n\n\n
                Five useful finding states<\/h2>\n\n\n\n
                State<\/th>Meaning<\/th><\/tr><\/thead>
                Vulnerability detected<\/td>Tool associated a vulnerability with a dependency<\/td><\/tr>
                Vulnerability confirmed<\/td>Team validated identity, affected version and applicability<\/td><\/tr>
                False positive<\/td>Tool associated a vulnerability with the wrong\/non-applicable component<\/td><\/tr>
                False negative<\/td>A real vulnerable component is present but scanner did not report it<\/td><\/tr>
                Needs investigation<\/td>Evidence is not yet sufficient to decide<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                \n\n\n\n
                15. Different Report Formats<\/h1>\n\n\n\n
                Dependency-Check 13.0.0 supports:<\/p>\n\n\n
                HTML, XML, CSV, JSON<\/span>, JUNIT, SARIF, JENKINS, GITLAB, ALL\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                Practical report table<\/h2>\n\n\n\n
                Format<\/th>Purpose<\/th>Typical consumer<\/th><\/tr><\/thead>
                HTML<\/td>Rich human-readable review<\/td>Developer \/ security engineer<\/td><\/tr>
                JSON<\/td>Structured automation<\/td>Scripts \/ data pipelines<\/td><\/tr>
                XML<\/td>Structured tool integration<\/td>CI\/security tooling<\/td><\/tr>
                CSV<\/td>Spreadsheet\/simple tabular analysis<\/td>Analyst \/ reporting<\/td><\/tr>
                JUNIT<\/td>Represent findings in test-style CI output<\/td>CI systems<\/td><\/tr>
                SARIF<\/td>Static-analysis interchange format<\/td>Code\/security platforms<\/td><\/tr>
                JENKINS<\/td>Jenkins-oriented report<\/td>Jenkins workflows<\/td><\/tr>
                GITLAB<\/td>GitLab-oriented report<\/td>GitLab workflows<\/td><\/tr>
                ALL<\/td>Generate all supported formats<\/td>Lab\/testing; usually excessive in routine CI<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                Generate multiple formats<\/h2>\n\n\n
                rm -rf reports\/multi\nmkdir -p reports\/multi\n\n\"$DC_HOME\/bin\/dependency-check.sh\"<\/span> \\\n  --project \"OWASP NodeGoat - Multi-format\"<\/span> \\\n  --scan \".\"<\/span> \\\n  --out \".\/reports\/multi\"<\/span> \\\n  --format \"HTML\"<\/span> \\\n  --format \"JSON\"<\/span> \\\n  --format \"XML\"<\/span> \\\n  --format \"CSV\"<\/span> \\\n  --format \"SARIF\"<\/span> \\\n  --prettyPrint \\\n  --nvdApiKey \"$NVD_API_KEY\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                Verify:<\/p>\n\n\n
                find reports\/multi -maxdepth 1<\/span> -type f -print<\/span> | sort\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                Exercise 5 – Machine-readable output<\/h3>\n\n\n\n
                Task:<\/strong> Generate JSON and SARIF in addition to HTML.
                Validation:<\/strong> Corresponding files are present and non-empty.<\/p>\n\n\n
                test -s reports\/multi\/dependency-check-report.json && echo<\/span> \"JSON OK\"<\/span>\ntest -s reports\/multi\/dependency-check-report.sarif && echo<\/span> \"SARIF OK\"<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
                \n\n\n\n
                16. Important CLI Options<\/h1>\n\n\n\n
                This table intentionally covers commonly useful options rather than dumping every advanced switch.<\/p>\n\n\n\n
                Option<\/th>Purpose<\/th>Example<\/th><\/tr><\/thead>
                --project<\/code><\/td>Name displayed in report<\/td>--project \"My Service\"<\/code><\/td><\/tr>
                --scan<\/code><\/td>Path\/pattern to scan; repeatable<\/td>--scan \".\"<\/code><\/td><\/tr>
                --exclude<\/code><\/td>Exclude Ant-style path pattern<\/td>--exclude \"**\/test-fixtures\/**\"<\/code><\/td><\/tr>
                --out<\/code><\/td>Output directory\/file<\/td>--out .\/reports<\/code><\/td><\/tr>
                --format<\/code><\/td>Report format; repeatable<\/td>--format HTML --format SARIF<\/code><\/td><\/tr>
                --prettyPrint<\/code><\/td>Pretty-print JSON\/XML<\/td>--prettyPrint<\/code><\/td><\/tr>
                --log<\/code><\/td>Write verbose log file<\/td>--log .\/reports\/dc.log<\/code><\/td><\/tr>
                --suppression<\/code><\/td>Apply suppression XML; repeatable<\/td>--suppression .\/dependency-check-suppressions.xml<\/code><\/td><\/tr>
                --failOnCVSS<\/code><\/td>Non-zero exit if score >= threshold<\/td>--failOnCVSS 8.0<\/code><\/td><\/tr>
                --nvdApiKey<\/code><\/td>NVD API key<\/td>--nvdApiKey \"$NVD_API_KEY\"<\/code><\/td><\/tr>
                --updateonly<\/code><\/td>Update data without scanning<\/td>--updateonly<\/code><\/td><\/tr>
                --noupdate<\/code><\/td>Do not update data<\/td>--noupdate<\/code><\/td><\/tr>
                --data<\/code> \/ -d<\/code><\/td>Override persistent data directory<\/td>--data \"$HOME\/.cache\/dependency-check\"<\/code><\/td><\/tr>
                --purge<\/code><\/td>Delete local NVD copy to force refresh<\/td>--purge<\/code><\/td><\/tr>
                --propertyfile<\/code> \/ -P<\/code><\/td>Load Dependency-Check properties<\/td>-P .\/dependencycheck.properties<\/code><\/td><\/tr>
                --help<\/code><\/td>Basic help<\/td>--help<\/code><\/td><\/tr>
                --advancedHelp<\/code><\/td>Advanced help<\/td>--advancedHelp<\/code><\/td><\/tr>
                --version<\/code><\/td>Print version<\/td>--version<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                Ant-style path caution<\/h2>\n\n\n\n
                The official CLI documentation recommends quoting Ant-style paths so your shell does not expand them before Dependency-Check receives the pattern.<\/p>\n\n\n\n
                Example:<\/p>\n\n\n
                \"$DC_HOME\/bin\/dependency-check.sh\"<\/span> \\\n  --scan '.\/lib\/**\/*.jar'<\/span> \\\n  --out .\/reports\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
                Exercise 6 – Exclusion<\/h3>\n\n\n\n
                Task:<\/strong> Run a scan with an exclusion that targets a known non-production test-fixture directory if your own project has one.
                Validation:<\/strong> Report\/log shows the excluded path was not analyzed.
                Rule:<\/strong> Do not exclude a path merely because it contains inconvenient vulnerabilities.<\/p>\n\n\n\n
                \n\n\n\n
                17. Configuration<\/h1>\n\n\n\n
                Required \/ strongly recommended for this lab<\/h2>\n\n\n\n
                Setting<\/th>Status<\/th>Reason<\/th><\/tr><\/thead>
                Java 11+<\/td>Required<\/td>Tool runtime requirement<\/td><\/tr>
                --scan<\/code><\/td>Required for scanning<\/td>Defines target<\/td><\/tr>
                Internet access<\/td>Required for normal update\/analyzer operation<\/td>External vulnerability\/supporting data<\/td><\/tr>
                npm on PATH<\/td>Required for current npm audit analysis<\/td>Node\/npm project<\/td><\/tr>
                NVD API key<\/td>Strongly recommended<\/td>Faster\/more reliable NVD update behavior<\/td><\/tr>
                Persistent data directory<\/td>Recommended<\/td>Avoid full repopulation per execution<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                Optional, commonly useful<\/h2>\n\n\n\n