# dependency-check/DependencyCheck

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.

Repository: https://github.com/dependency-check/DependencyCheck
Canonical: https://ross.abutalabs.com/products/dependencycheck
Homepage: https://owasp.org/www-project-dependency-check/
Language: Java
License: Apache-2.0
License Family: permissive
Topics: security-audit, build-tool, maven-plugin, jenkins-plugin, gradle-plugin, vulnerability-detection, security, ant-task, software-composition-analysis
Last push: 2026-08-26T10:51:49+00:00

## Health v2 (maintenance only)
Score: 98/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 96, longevity 100
- inputs: {"age_days": 5112, "days_push": 7, "days_rel": 30, "gap_med": 24.5, "n_releases_24m": 19}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 7671, forks 1419 (observed 2026-08-28T04:10:02.326348+00:00)

## What it is
OWASP Dependency-Check is a Software Composition Analysis (SCA) tool that identifies publicly disclosed vulnerabilities (CVEs) in a project's dependencies by matching them to CPE identifiers using the NVD API and other data sources. It ships as a CLI, Maven plugin, Gradle plugin, Ant task, and CI integrations like Jenkins and GitHub Actions.

## Use cases
- scan project dependencies for known CVEs
- find vulnerable libraries in a Maven build
- add dependency vulnerability checking to a Gradle build
- run software composition analysis in Jenkins CI
- generate a report of disclosed vulnerabilities in third-party components
- audit npm and Java dependencies against the NVD

## When to choose
- you need OWASP Top 10 'known vulnerable components' checks in JVM builds
- you want a mature, free SCA tool with Maven/Gradle/CLI/CI integrations
- you need CVE reports linked to NVD data

## When to avoid
- you need real-time SBOM analysis across many ecosystems with commercial support
- you cannot obtain or manage an NVD API key
- you need language ecosystems better served by dedicated tools like npm audit or Bundler Audit alone

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, vulnerability-scanning, dependency-audit, build-tool, cli
- domain: security, developer-tools
- platform: jvm, cli, cross-platform
- tags: sca, cve, cpe, nvd, maven-plugin, gradle-plugin, jenkins-plugin, owasp, software-composition-analysis, devops

## Member repositories
- dependency-check/DependencyCheck (main) score 98

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:10:02.326348+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:36:03.527364+00:00, confidence not recorded.
  - readme: https://github.com/dependency-check/DependencyCheck (fetched 2026-08-28T04:10:02.326348+00:00, sha 258c0e2bc163)
  - homepage: https://owasp.org/www-project-dependency-check/ (fetched 2026-08-29T08:31:40.382378+00:00, sha 0d5858e74a61)
  - site_page: https://owasp.org/about (fetched 2026-08-29T08:31:40.392082+00:00, sha b21a48297b2d)
- Data as of 2026-08-30T08:39:29.467469+00:00.