> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Demo Setup and Run Dependency Scanning
> This tutorial explains how to configure Jenkins for scanning project dependencies using NPM Audit and OWASP Dependency-Check to identify vulnerabilities.
In this tutorial, you’ll configure Jenkins to scan project dependencies using two methods:
1. **NPM Audit** (critical-level checks)
2. **OWASP Dependency-Check** (via Jenkins plugin)
These scans help you catch vulnerabilities early and enforce quality gates in your CI pipeline.
## Table of Contents
* [1. NPM Dependency Audit](#1-npm-dependency-audit)
* [2. OWASP Dependency-Check Plugin](#2-owasp-dependency-check-plugin)
* [2.1 Install the Plugin](#21-install-the-plugin)
* [2.2 Global Tool Configuration](#22-global-tool-configuration)
* [2.3 Generate Pipeline Snippet](#23-generate-pipeline-snippet)
* [3. Running the Pipeline](#3-running-the-pipeline)
* [4. Enforcing Quality Gates](#4-enforcing-quality-gates)
* [Conclusion](#conclusion)
***
## 1. NPM Dependency Audit
Add an NPM audit stage to your `Jenkinsfile`:
```groovy theme={null}
pipeline {
tools {
nodejs 'nodejs-22-6-0'
}
stages {
stage('Install Dependencies') {
steps {
sh 'npm install --no-audit'
}
}
stage('NPM Dependency Audit') {
steps {
sh '''
npm audit --audit-level=critical
echo $?
'''
}
}
}
}
```
What happens:
* `npm install --no-audit` installs dependencies without auditing.
* `npm audit --audit-level=critical` checks for critical vulnerabilities and exits `1` if found.
### Sample package.json
```json theme={null}
{
"scripts": {
"start": "node app.js",
"test": "mocha app-test.js --timeout 10000 --reporter mocha-junit-reporter --exit",
"coverage": "nyc --reporter cobertura --reporter lcov --reporter text --reporter json-summary mocha app-test.js"
},
"nyc": {
"check-coverage": true,
"lines": 90
},
"dependencies": {
"cors": "^2.8.5",
"express": "^4.18.2",
"mocha-junit-reporter": "^2.2.1",
"mongoose": "^5.13.20",
"nyc": "^15.1.0",
"serverless-http": "^3.2.0"
},
"devDependencies": {
"chai": "*",
"chai-http": "*"
}
}
```
### CLI Output Example
```bash theme={null}
# npm audit --audit-level=critical
@babel/traverse <7.23.2
Severity: critical
...
```
NPM Audit supports four severity levels: `low`, `moderate`, `high`, and `critical`.\
Adjust `--audit-level` based on your policy.
***
## 2. OWASP Dependency-Check Plugin
The OWASP Dependency-Check plugin scans multiple formats (HTML, XML, JSON, CSV) and supports quality gates.
### 2.1 Install the Plugin
1. **Manage Jenkins > Manage Plugins > Available**
2. Search **OWASP Dependency-Check**, install, and restart.
### 2.2 Global Tool Configuration
After restarting, go to **Manage Jenkins > Global Tool Configuration**.\
Add a **Dependency-Check** installation (e.g., version 10.0.3) and enable auto-install from GitHub.
### 2.3 Generate Pipeline Snippet
In **Pipeline Syntax > Snippet Generator**:
* Step: **Invoke Dependency-Check**
* Installation: `OWASP-DepCheck-10`
* Arguments:
```bash theme={null}
--scan ./
--out ./
--format 'ALL'
--prettyPrint
```
Insert into your `Jenkinsfile`:
```groovy theme={null}
stage('OWASP Dependency Check') {
steps {
dependencyCheck additionalArguments: '''
--scan ./
--out ./
--format 'ALL'
--prettyPrint
''', odcInstallation: 'OWASP-DepCheck-10'
}
}
```
***
## 3. Running the Pipeline
Commit and push your `Jenkinsfile`. The first run downloads the NVD database (\~263 000 records), taking about 20–30 minutes. Look for logs like:
```text theme={null}
[INFO] Checking for updates
[WARNING] An NVD API Key has not been provided ...
[INFO] NVD API has 263,560 records in this update
...
[INFO] Writing report to /workspace/.../dependency-check-report.html
```
Reports generated in the workspace:
| Format | File Name |
| ------ | ------------------------------ |
| HTML | `dependency-check-report.html` |
| XML | `dependency-check-report.xml` |
| JSON | `dependency-check-report.json` |
| CSV | `dependency-check-report.csv` |
By default, findings don’t fail the build:
***
## 4. Enforcing Quality Gates
Fail builds if thresholds are exceeded:
1. In **Snippet Generator**, select **Publish Dependency-Check results**
2. Configure:
* **XML report pattern**: `dependency-check-report.xml`
* **Stop build** on threshold violation
* **Failed total critical**: `1`
Generated snippet:
```groovy theme={null}
dependencyCheckPublisher failedTotalCritical: 1,
pattern: 'dependency-check-report.xml',
stopBuild: true
```
Combine both scans in parallel:
```groovy theme={null}
pipeline {
stages {
stage('Dependency Scanning') {
parallel {
stage('NPM Dependency Audit') {
steps {
sh '''
npm audit --audit-level=critical
echo $?
'''
}
}
stage('OWASP Dependency Check') {
steps {
dependencyCheck additionalArguments: '''
--scan ./
--out ./
--format 'ALL'
--prettyPrint
''', odcInstallation: 'OWASP-DepCheck-10'
dependencyCheckPublisher failedTotalCritical: 1,
pattern: 'dependency-check-report.xml',
stopBuild: true
}
}
}
}
}
}
```
On the next build you’ll see:
```text theme={null}
[INFO] Skipping the NVD API Update as it was completed within the last 240 minutes
...
Findings exceed configured thresholds
```
Builds will now fail if `critical` vulnerabilities exceed your defined threshold.\
Review detailed results in the Jenkins UI to remediate issues.
***
## Conclusion
In this guide, we have:
* Integrated **NPM Audit** to catch critical Node.js vulnerabilities.
* Configured **OWASP Dependency-Check** for comprehensive scanning.
* Parallelized both stages to reduce build time.
* Enforced quality gates to automatically fail on critical findings.
Address the flagged vulnerabilities to keep your application secure.