OWASP Dependency-Check

Open source

Open-source tool that identifies known-vulnerable libraries in project dependencies.

by OWASP FoundationOfficial site ↗Source code ↗

Pricing: free
License: open-source
Open source: Yes

Editorial review

OWASP Dependency-Check has not yet been editorially reviewed. User reviews and published field data below are unaffected — we say so rather than implying an editorial verdict.

Facts & attributes

Every value carries its evidence state. “—” means unknown — never a silent default (P-02).

Identity · Taxonomy

Tags(open-source;cloud-native): software composition analysis, vulnerability scanning, supply chain security, owasp, java, devsecopsVerification pending

Platform · Deployment

Delivery model(SaaS;self-hosted;desktop;mobile;embedded;managed-cloud;appliance): self-hostedVerification pending

Pricing · Licensing

License model(proprietary;open-source;source-available;dual-license): open-sourceVerified
Pricing model(free;subscription;usage;seat;asset;transaction;revenue-share;perpetual;custom): freeVerified
Source repository(HTTPS URL): https://github.com/dependency-check/DependencyCheckVerified
SPDX license IDs(Apache-2.0;MIT): Apache-2.0Verification pending

Features · Product · Fit

Core capabilities(authoring;automation;analytics): identifies project dependencies and checks for known, publicly disclosed vulnerabilities, command line interface, Maven plugin, Gradle plugin, and Ant task, identifies the Common Platform Enumeration (CPE) for a given dependency, lists associated Common Vulnerability and Exposure (CVE) entries in a report, automatically updates itself using the NVD Data Feeds hosted by NIST, integrations with build tooling such as Jenkins, GitHub Actions and Azure DevOpsVerification pending

Api · Integrations · Ecosystem

CLI(true/false): trueVerification pending

Audience · Use · Case

Best for(Neutral editorial summary): Development teams scanning project dependencies for known, publicly disclosed vulnerabilities in their buildsVerification pending
Primary use cases(build;monitor;automate): software composition analysis (SCA) of applications and their dependent libraries, detecting components with known vulnerabilities from the National Vulnerability Database, supply chain security scanning in CI/CD pipelinesVerification pending

Lifecycle · Versioning

Current version(1.12.3): 13.0Verified
Maintenance status(active;maintenance;deprecated;EOL;archived): activeVerification pending

Vendor · Maintainer

Vendor type(commercial;foundation;community;government;consortium;individual): foundationVerified

User reviews

Review policy

No published reviews yet.