DependencyCheck 9.0.8 was released yesterday. I used that occasion to finally migrate nvd-clojure to API key workflow. (I was tracking their releases because the multiple bugfix releases in the 9.x series weren't exactly confidence-inspiring)