dependency-check / dependency-check/DependencyCheck

Support "NVD start year" for CLI

Open
#7,569 5 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

The Maven plugin supports `cveStartYear` to limit the scope of potentially fetched CVE entries. The CLI has no such feature.

**Describe the solution you'd like**
Add `nvdStartYear` for the CLI.

`bin/dependency-check.sh --updateonly --nvdDatafeed=https://dependency-check.github.io/DependencyCheck_Builder/nvd_cache/nvdcve-{0}.json.gz --nvdStartYear=2018` should skip all `.json.gz` files from before 2018.

**Describe alternatives you've considered**
To my knowledge, there are none.

**Additional context**
n/a

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.