Dependency-Check

Visit Website

Introduction

Dependency-Check is a Software Composition Analysis (SCA) tool that attempts to detect publicly disclosed vulnerabilities contained within a project’s dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries.

The latest GitHub release listed on 25 Oct 2026 was v13.0.0, published 2026-08-03.

Features

These items are quoted from public documentation fetched on 25 Oct 2026. Taken from repository README headings.

1. Notice: This product uses the NVD API but is not endorsed or certified by the NVD.
2. Mandatory Upgrade to 12.1.0+: Due to NVD API compatibility changes, an upgrade is mandatory. See #7463 for more information.
3. Breaking Changes in 11.0.0: - Java 11 is now required to run dependency-check 11.0.0 or higher - H2 database upgrade
4. NVD API Key Highly Recommended: Dependency-check moved from using the NVD data-feed to the NVD API since 9.0.0+ (January 2024). Users of dependency-check are highly encouraged to obtain an NVD API Key; see https://nvd.nist.gov/developers/request-an-api-key Without an NVD API Key dependency-check’s updates will be extremely slow. Please see the…
5. Sonatype OSS Index mandatory authentication and migration to Sonatype Guide: In September 2025 Sonatype OSS Index started enforcing use of API tokens for authentication. In April 2026 a subsequent migration to Sonatype Guide began, kicking off a transition to use of Sonatype Guide API Tokens that are planned to replace the legacy OSS Index API keys/tokens before the end of 2026.
6. Internet Access: OWASP dependency-check requires access to several externally hosted resources. For more information see Internet Access Required.

Pros

Points stated in the public sources fetched on 25 Oct 2026:

1. Published license: The GitHub repository lists Apache License 2.0 (Apache-2.0).
2. Repository topics: The repository’s GitHub topics include ant-task, build-tool, gradle-plugin, jenkins-plugin, maven-plugin, security, security-audit, software-composition-analysis.

Cons

The pages fetched on 25 Oct 2026 do not publish a limitations list. That absence is not evidence that the tool has no drawbacks. Current issues are tracked at https://github.com/dependency-check/DependencyCheck/issues.

Usage and Links (Example)

The repository README includes this example (from “Gradle build Environment”):

dependencies {
    constraints {
        // org.owasp.dependencycheck needs at least this version of jackson. Other plugins pull in older versions..
        add("implementation", "com.fasterxml.jackson:jackson-bom:2.21.2")

        // org.owasp.dependencycheck needs these versions. Other plugins pull in older versions..
        add("implementation", "org.apache.commons:commons-lang3:3.20.0")
        add("implementation", "org.apache.commons:commons-text:1.15.0")
    }
}

Resources:

• Dependency-Check website
• GitHub repository
• Documentation
• GitHub release v13.0.0

Pricing

The repository lists Apache License 2.0 (Apache-2.0). No public price was found on the pages fetched on 25 Oct 2026. This rewrite does not guess a number. Check the official website before treating the tool as free or paid.

Recommended for?

The fetched pages do not name a target audience. Decide fit from the official description and the feature list above.

Conclusion

Dependency-Check is summarized by its public description as: “OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.”.

The latest GitHub release listed was v13.0.0, published 2026-08-03.

This page was rebuilt on 25 Oct 2026 from owasp.org, github.com. It keeps only what those pages stated. Confirm the current product, license, and price on the official site before you adopt it.