dependency-check/DependencyCheck

Health v2 · maintenance only

Adoption not part of the score

7671 stars · 1419 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

OWASP Dependency-Check is a Software Composition Analysis (SCA) tool that identifies publicly disclosed vulnerabilities (CVEs) in a project's dependencies by matching them to CPE identifiers using the NVD API and other data sources. It ships as a CLI, Maven plugin, Gradle plugin, Ant task, and CI integrations like Jenkins and GitHub Actions.

Use cases

• scan project dependencies for known CVEs
• find vulnerable libraries in a Maven build
• add dependency vulnerability checking to a Gradle build
• run software composition analysis in Jenkins CI
• generate a report of disclosed vulnerabilities in third-party components
• audit npm and Java dependencies against the NVD

When to choose

• you need OWASP Top 10 'known vulnerable components' checks in JVM builds
• you want a mature, free SCA tool with Maven/Gradle/CLI/CI integrations
• you need CVE reports linked to NVD data

When to avoid

• you need real-time SBOM analysis across many ecosystems with commercial support
• you cannot obtain or manage an NVD API key
• you need language ecosystems better served by dedicated tools like npm audit or Bundler Audit alone

Facets

cli-tool · maturity active

security vulnerability-scanning dependency-audit build-tool cli security developer-tools jvm cli cross-platform sca cve cpe nvd maven-plugin gradle-plugin jenkins-plugin owasp software-composition-analysis devops

Member repositories

For agents

markdown · JSON · MCP: product_card(name="dependency-check/DependencyCheck")