# OWASP Dependency-Check: check a Java dependency for a CVE



Check a Java dependency for a CVE.



## 1. Run the example



[Download the OWASP Dependency-Check example](https://www.security.run/docs/examples/dependency-check.zip). Extract it, install `httpx`, set your API URL and token, then run `python client.py`. The client uploads the included inputs, submits the command, and saves the result under `results/RUN_ID`.



## 2. Check the result



Read report.json for the dependency and vulnerability match from the isolated NVD data source.



Read the native exit code and cleanup status printed by the client. [Read results and save reports](https://www.security.run/docs/visibility.html) explains the returned files.



## 3. Use your own inputs



Edit `example.json` to change the command arguments, requested outputs or deadline. Replace the files under `inputs/` with your own data, keeping the staged paths aligned with the command. The client creates the artifact IDs for you; illustrative IDs shown here must not be copied into a live request.



### Files used by this example



- `deps/log4j-core-2.14.1.jar`



This example selects the isolated `nvd-fixture` target. To use a reachable target of your own, change the target arguments or driver and remove `target_profile`. See [Run a check against a target](https://www.security.run/docs/targets.html) for network setup.



Qualified version: `13.0.0`. Commands: `dependency-check`.



- Supply a prepared vulnerability database or a reachable NVD endpoint/feed. Optional online analyzers require their own endpoints and credentials.



Inspect `GET /v1/tools/dependency-check` for the current installed version and readiness. The published snapshot has 2 functional case(s), plus timeout and cancellation checks. These examples demonstrate the native path; other flags and inputs are supported within the tool’s runtime limits.

## Command submitted by the example

```json
{
  "tool": "dependency-check",
  "timeout_seconds": 90,
  "invocation": {
    "args": [
      "--project",
      "fixture",
      "--scan",
      "deps",
      "--format",
      "JSON",
      "--out",
      "report.json",
      "--data",
      "/tmp/work/database",
      "--nvdApiEndpoint",
      "http://127.0.0.1:8000/rest/json/cves/2.0",
      "--nvdApiDelay",
      "1",
      "--nvdMaxRetryCount",
      "1",
      "--disableRetireJs",
      "--disableOssIndex",
      "--disableKnownExploited",
      "--disableHostedSuppressions",
      "--disableCentral",
      "--disableAssembly",
      "--disableNodeAudit",
      "--disableVersionCheck"
    ],
    "outputs": [
      "report.json"
    ],
    "success_exit_codes": [
      0
    ],
    "executable": "dependency-check",
    "files": [
      {
        "path": "deps/log4j-core-2.14.1.jar",
        "artifact_id": "artifact_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
        "executable": false
      }
    ]
  },
  "target_profile": "nvd-fixture"
}
```