The OWASP dependency check adds a lot of time to the build and is brittle due to updates always being provided. Many projects disable the checker.
Possible improvements:-
- Make the OWASP checker run in its own maven profile so it can be run as a seperate process.
- Increase the check update interval to prevent too many downloads.
- Report errors and not fail by default