jeremylong

Follow

Jeremy Long jeremylong

Follow

Founder and project lead for dependency-check.

997 followers · 5 following

Sponsors

Achievements

Achievements

Highlights

Pro

Organizations

Pinned Loading

dependency-check/DependencyCheck Public

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.

Java 6.8k 1.3k
dependency-check/dependency-check-gradle Public

The dependency-check gradle plugin is a Software Composition Analysis (SCA) tool that allows projects to monitor dependent libraries for known, published vulnerabilities.

Groovy 370 95
open-vulnerability-clients Public

Java library for working with available vulnerability data sources (GitHub Security Advisories, NVD, EPSS, CISA Known Exploited Vulnerabilities, etc.)

Java 5 3
open-vulnerability-cli Public

A cli that can be used to query various online vulnerability sources such as the NVD or GHSA. The CLI and docker images can be used to mirror the NVD.

Java 141 44
malicious-dependencies Public

Demonstrates how a malicious dependency could negatively impact the build output.

Java 25 10

8,561 contributions in the last year

Learn how we count contributions

Less

More

Contribution activity

March 2025

Created 26 commits in 6 repositories

Created a pull request in package-url/packageurl-java that received 10 comments

fix: make jspecify a compile time/optional dependency

As jspecify is just a compile-time annotation, I believe this should be marked as an optional dependency. Other examples of this: https://github.c…

+2 −0 lines changed • 10 comments

Opened 15 other pull requests in 5 repositories

jeremylong/open-vulnerability-cli 6 merged

fix: update install command
This contribution was made on Mar 16
feat: mirror additional sources
This contribution was made on Mar 4
chore: prepare 8.0.0 release and update docs
This contribution was made on Mar 3
fix: correct when action runs
This contribution was made on Mar 3
feat: reduce memory usage
This contribution was made on Mar 2
feat: implement forced http caching on full mirror of NVD
This contribution was made on Mar 1

package-url/packageurl-java 2 merged 1 closed

build: ensure semantic pr titles
This contribution was made on Mar 17
fix: use correct version in .java-version
This contribution was made on Mar 16
build: enforce Java 1.8
This contribution was made on Mar 9

dependency-check/DependencyCheck 1 open 2 merged

fix: disables automatic content decompression
This contribution was made on Mar 8
docs: correct gradle documentation
This contribution was made on Mar 7
fix: improve null checks in Downloader
This contribution was made on Mar 4

stevespringett/CPE-Parser 2 merged

chore: update build and site
This contribution was made on Mar 7
fix: allow parsing of empty CPE 2.2 part
This contribution was made on Mar 6

dependency-check/dependency-check-gradle 1 merged

build(deps): bump actions/upload-artifact from v3 to v4
This contribution was made on Mar 7

Reviewed 80 pull requests in 7 repositories

package-url/packageurl-java 25 pull requests

fix: fix UnnecessaryParentheses ErrorProne warning
This contribution was made on Mar 20
fix: improve performance of encode and decode
This contribution was made on Mar 20
build(deps): bump com.google.errorprone:error_prone_core from 2.36.0 to 2.37.0
This contribution was made on Mar 20
style: add Spotless formatter configuration
This contribution was made on Mar 19
fix: move uppercase char check into lowercase method
This contribution was made on Mar 19
feat: improve toString()
This contribution was made on Mar 19
feat(tests): Additional parametrization of tests
This contribution was made on Mar 19
fix: add missing @deprecated and @since to javadoc
This contribution was made on Mar 19
Add EditorConfig file
This contribution was made on Mar 17
Adds BND Maven Plugins
This contribution was made on Mar 17
fix: make jspecify a compile time/optional dependency
This contribution was made on Mar 16
Update dependencies
This contribution was made on Mar 16
feat: use parameterized tests for JSON data
This contribution was made on Mar 16
fix(test): fix compilation error introduced in #160
This contribution was made on Mar 16
Fix assertThrows
This contribution was made on Mar 16
Fix building in IntelliJ IDEA
This contribution was made on Mar 16
fix: update code to pass latest test suite
This contribution was made on Mar 16
Add gitattributes file
This contribution was made on Mar 16
build(deps): bump org.apache.maven.plugins:maven-install-plugin from 2.4 to 3.1.4
This contribution was made on Mar 16
build(deps): bump org.jacoco:jacoco-maven-plugin from 0.8.11 to 0.8.12
This contribution was made on Mar 16
build(deps): bump org.apache.maven.plugins:maven-clean-plugin from 2.5 to 3.4.1
This contribution was made on Mar 16
build(deps): bump org.apache.maven.plugins:maven-jar-plugin from 3.3.0 to 3.4.2
This contribution was made on Mar 16
build(deps): bump org.apache.maven.plugins:maven-site-plugin from 3.3 to 3.21.0
This contribution was made on Mar 16
Fix URL encoding and decoding
This contribution was made on Mar 14
Migrates tests to JUnit 5
This contribution was made on Mar 13
Some pull request reviews not shown.

dependency-check/DependencyCheck 13 pull requests

build(deps): bump com.google.guava:guava from 33.4.0-jre to 33.4.5-jre
This contribution was made on Mar 21
build(deps): bump com.github.spotbugs:spotbugs-annotations from 4.9.2 to 4.9.3
This contribution was made on Mar 17
build(deps): bump com.github.spotbugs:spotbugs-maven-plugin from 4.9.2.0 to 4.9.3.0
This contribution was made on Mar 17
fix: Use unscored severity only in absence of any CVSS baseScore
This contribution was made on Mar 16
fix(yarn): protect against exotic version number of yarn
This contribution was made on Mar 14
fix: Ignore require-bundle MANIFEST.MF entry for evidence
This contribution was made on Mar 12
docs: drop redundant text in the Internet Access Required section
This contribution was made on Mar 12
build(deps): bump org.jsoup:jsoup from 1.18.3 to 1.19.1
This contribution was made on Mar 6
build(deps): bump golang from 1.24.0-alpine to 1.24.1-alpine
This contribution was made on Mar 6
build(deps): bump com.github.spotbugs:spotbugs-maven-plugin from 4.9.1.0 to 4.9.2.0
This contribution was made on Mar 6
fix(yarn): avoid error on yarn berry audit when no vulnerability found
This contribution was made on Mar 6
chore(deps): Update Docker image jdbc-drivers
This contribution was made on Mar 4
build(deps): bump io.github.jeremylong:open-vulnerability-clients from 7.2.2 to 7.3.0
This contribution was made on Mar 4

stevespringett/CPE-Parser 8 pull requests

build(deps): Bump org.apache.maven.plugins:maven-project-info-reports-plugin from 3.7.0 to 3.9.0
This contribution was made on Mar 7
build(deps): Bump org.apache.maven.plugins:maven-site-plugin from 3.20.0 to 3.21.0
This contribution was made on Mar 7
build(deps): Bump org.apache.maven.plugins:maven-javadoc-plugin from 3.11.1 to 3.11.2
This contribution was made on Mar 6
Bump org.cyclonedx:cyclonedx-maven-plugin from 2.8.2 to 2.9.1
This contribution was made on Mar 6
Bump com.github.spotbugs:spotbugs-maven-plugin from 4.8.6.4 to 4.8.6.6
This contribution was made on Mar 6
Bump org.apache.maven.plugins:maven-jxr-plugin from 3.5.0 to 3.6.0
This contribution was made on Mar 6
Bump org.apache.maven.plugins:maven-checkstyle-plugin from 3.5.0 to 3.6.0
This contribution was made on Mar 6
breaking change: make ICpe implement Comparable<ICpe> and minor bug fixes
This contribution was made on Mar 6

jeremylong/open-vulnerability-cli 6 pull requests

fix: Issue a warning when users have used an un-resolved user-home relative path
This contribution was made on Mar 16
Upgrade to spring boot 3.4 and Java 17 fixes #263
This contribution was made on Mar 3
build(deps): bump io.prometheus:prometheus-metrics-instrumentation-jvm from 1.3.5 to 1.3.6
This contribution was made on Mar 2
build(deps): bump io.prometheus:prometheus-metrics-exposition-formats from 1.3.5 to 1.3.6
This contribution was made on Mar 2
build(deps): bump io.prometheus:prometheus-metrics-core from 1.3.5 to 1.3.6
This contribution was made on Mar 2
feat: implement forced http caching on full mirror of NVD
This contribution was made on Mar 2

dependency-check/dependency-check-gradle 2 pull requests

fix: Use unscored severity only in absence of any CVSS baseScore and add CVSSv4 score evaluation
This contribution was made on Mar 16
feat: Add support for startYear
This contribution was made on Mar 7

jeremylong/open-vulnerability-clients 2 pull requests

fix: Prevent index-out-of-bound on too short API key
This contribution was made on Mar 12
fix: Add explicit time-outs to the HTTP Clients
This contribution was made on Mar 1

OWASP/owasp-java-encoder 1 pull request

Fixed a typo
This contribution was made on Mar 10

Created an issue in package-url/purl-spec that received 1 comment

Proposal: add `servicenow` as a PURL-TYPE

ServiceNow has a large ecosystem of applications written by ServiceNow, partners, consulting firms, customers, etc. A large number of these applica…

1 comment

Opened 1 other issue in 1 repository

package-url/packageurl-java 1 closed

Consider Conventional Commits
This contribution was made on Mar 11