jeremylong / DependencyCheck

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
https://owasp.org/www-project-dependency-check/
Apache License 2.0
6.47k stars 1.29k forks source link

Please add option to disable version-check to CLI #7142

Closed malice00 closed 2 weeks ago

malice00 commented 2 weeks ago

I noticed that DC v11 was running a lot slower (~5x) than v10 on our servers, so I dug into this a little. I figured this was because of our proxy (which is usually the culprit of our issues) and it appears it was. Seeing we already pretty much mirror all input for DC, I was a little confused why/where it would be trying to connect to, but in the logs I then found the culprit: the version check.

I think the issue of it getting very slow was caused by switching to the usage of Apache HTTP-client in Commit b78ab24.

For Maven I then found the Parameter versionCheckEnabled, which made our builds even faster than before! I guess we never noticed/felt that DC took 'long' to run, until the update to v11... So, my request is to add an option to disable the version-check in the CLI as well. We are not using ant and gradle, but I guess it might be useful there too.