How does Kevlar-CheckDeps differ from OWASP Dependency-Check in Java?

OWASP Dependency-Check requires a heavy Java JRE runtime, downloads gigabytes of local NVD databases, and requires NVD API keys. Kevlar-CheckDeps is a lightweight Python CLI batch querying Google OSV DB in seconds without JRE dependencies.

Do I need Maven or Gradle installed to audit Java projects?

No. Kevlar-CheckDeps parses pom.xml XML files and gradle.lockfile files directly using Python stdlib without invoking mvn or gradle wrappers.

Can Kevlar-CheckDeps break CI/CD builds for vulnerable Java dependencies?

Yes. Kevlar-CheckDeps supports --fail-on-vulns to break GitHub Actions or Jenkins pipelines upon detecting critical or high severity vulnerabilities.

⚡ Java Ecosystem SCA CLI

Java Dependency Audit CLI: Fast, Zero-Dependency SCA for Maven & Gradle

Audit direct and transitive Java dependencies, detect vulnerabilities in the Google OSV database, and validate pom.xml & gradle.lockfile integrity—without heavy JRE downloads or API keys.

$ python kevlar.py --tech java --path ./my-java-app --all --vuls

Maven (`pom.xml`) Gradle (`gradle.lockfile`) Gradle Kotlin (`build.gradle.kts`)

bash - kevlar-checkdeps (java)

user@devsecops ~/my-java-app

$ python kevlar.py --tech java --path . --all --vuls

[INFO] Detected Ecosystem: Java (Maven / Gradle)

[INFO] Parsing pom.xml & gradle.lockfile...

[INFO] Checking 142 Java artifacts against Google OSV DB...

[INFO] Validating sha1 checksums...

[ALERT] Checked: 142 packages in 1.25s.

Vulnerabilities: 4 (2 Critical, 2 High).

Status: ❌ FAIL (Threshold Breach)

The Problem with Traditional Java SCA Scanners

Why do legacy tools like OWASP Dependency-Check or enterprise SaaS agents slow down Java pipelines?

Traditional Tools

(OWASP Dependency-Check)

Limitations

Gigabyte NVD Downloads & JRE Dependency

Requires installing Java JRE and downloading gigabytes of NVD vulnerability databases on every build.

Kevlar-CheckDeps

(Java Audit)

Solution

Zero JRE Installation & Lightweight Batch Scans

Executes standalone via Python stdlib in seconds, querying Google OSV DB directly.

Quick Usage Guide & Practical Example

How to run local scans, export executable reports, and integrate Kevlar into your CI/CD pipeline.

Full Local Scan

Audit direct and transitive Java dependencies querying Google OSV DB:

Scan Command:


                                        $ python kevlar.py --tech java --path ./ --all --vuls

Export HTML / SARIF

Generate interactive HTML dashboards or standard SARIF v2.1.0 reports:

Report HTML:


                                            $ python kevlar.py --tech java --path ./ --all --vuls --output report.html

Report SARIF:


                                            $ python kevlar.py --tech java --path ./ --all --vuls --output report.sarif

CI/CD Build Breaking

Fail CI/CD pipelines automatically if severe vulnerabilities are detected:

Pipeline Command:


                                        $ python kevlar.py --tech java --path ./ --all --vuls --fail-on-vulns "critical:1,high:2"

Quick Comparison Matrix

Compare Kevlar-CheckDeps with common alternatives in the Java ecosystem.

Feature / Criterion	Kevlar-CheckDeps Featured	OWASP Dep-Check	Snyk CLI	JFrog Xray
Execution Speed	⚡ Ultra-fast (Multi-threaded & OSV Batch)	Very Slow (GB NVD Sync)	Slow (Cloud Analysis)	Medium (Artifactory API)
External Dependencies	Zero (Python 3.11+ Std Lib)	Requires Java JRE	Requires CLI Binary	Requires Enterprise Server
Cost & License	Free & Open Source (Apache 2.0 License)	Free & Open Source (Apache 2.0)	Freemium / Commercial	Commercial Enterprise

Frequently Asked Questions (FAQ)

Quick answers to common questions about Java dependency auditing.