awesome-repositories.com
Blog
MCP
awesome-repositories.com

Discover the best open-source repositories with AI-powered search.

ExploreCurated searchesOpen-source alternativesSelf-hosted softwareBlogSitemap
ProjectMCP serverAboutHow we rankPress
LegalPrivacyTerms
© 2026 Bringes Technology SRL·VAT RO45896025·hello@awesome-repositories.com
dependency-check avatar

dependency-check/DependencyCheck

0
View on GitHub↗
owasp.org/www-project-dependency-check↗

DependencyCheck

DependencyCheck is a software composition analysis tool that identifies the third-party libraries a project depends on, maps them to Common Platform Enumeration identifiers, and links them to publicly disclosed CVE entries from the National Vulnerability Database. The result is a report listing each dependency alongside its matched identifiers and known vulnerabilities, so teams can see which components carry risk.

The same analysis engine is available as a command line program for Linux, Windows, and macOS, as a Docker container, and as plugins for Maven, Gradle, Ant, and Jenkins. Inside a build, it can fail the run when any dependency scores at or above a configured CVSS threshold, and multiple scan configurations can be registered with different thresholds. Maven multi-module builds can be combined into a single aggregated report. Analysis covers Java, JavaScript, Ruby, Go, .NET, and other ecosystems; some of those rely on matching build and audit tools being installed, and experimental analyzers run only when explicitly enabled.

Vulnerability data is kept in a local database that is downloaded once and then refreshed incrementally. Using an NVD API key avoids very slow updates. For restricted networks, the data can be pulled from a company-hosted mirror, a shared central database, or a CI cache, and scans can run offline. Results can be supplemented with Sonatype OSS Index data and with an external vulnerability index that reports issues the national database does not list; both require credentials and are disabled automatically when none are supplied. Library identification can also use Maven Central, Nexus, or Artifactory lookups.

Findings can be triaged with one or more suppression files, such as a shared company file plus a project-specific one. Custom analyzer plugins and central database drivers can be added by placing their JAR files in a plugins directory.

Features

  • Dependency Vulnerability Scanners - Identifies a project's third-party dependencies, maps them to CPE identifiers, and reports the known CVE vulnerabilities in each component.
  • Dependency Vulnerability Scanning - Matches a project's third-party libraries against National Vulnerability Database data and reports known vulnerable components.
  • Software Composition Analysis Tools - Identifies third-party libraries a project depends on and reports which carry publicly disclosed vulnerabilities.
  • Build Pipeline Scanning - Runs dependency checks inside Maven, Gradle, or Ant builds and can tie the scan to the verify phase automatically.

AI search

Explore more awesome repositories

Describe what you need in plain English — the AI ranks thousands of curated open-source projects by relevance.

Start searching with AI
7,763 stars·1,430 forks·Java·Apache-2.0·1 view
  • Vulnerability Report Generation - Produces a report listing each identified component with its matched identifiers and known vulnerabilities so teams can prioritize remediation.
  • Security Severity Build Gates - Fails builds in Maven, Gradle, Ant, Jenkins, or command line runs when any dependency has a vulnerability at or above a configured CVSS score.
  • Finding Suppressions - Excludes known incorrect or accepted findings from reports using one or more suppression files, shared and project-specific.
  • Command-Line Scanners - Ships a downloadable command-line program for Linux, Windows, and macOS that scans dependencies without any build tool installed.
  • Multi-Language Dependency Analysis - Analyzes Java, JavaScript, Ruby, Go, .NET, and other ecosystems in a single scan to locate dependencies for vulnerability matching.
  • Security Build Plugins - Ships Maven, Gradle, and Ant plugins that run dependency vulnerability scans in the build and can fail it above a severity threshold.
  • Build Tool Integrations - Runs the same analysis engine as a command line tool or as plugins for Ant, Maven, Gradle, and Jenkins within existing build pipelines.
  • CVE Dependency Scanners - Produces a report listing each dependency across language ecosystems with its matched CPE identifiers and associated CVE entries.
  • Multi-Ecosystem Dependency Analyzers - Examines .NET, Go, Elixir, npm, pnpm, yarn, and Ruby projects by delegating to the matching installed build and audit tools.
  • Multi-Ecosystem Analyzers - Applies file-type analyzers to identify dependencies across Java, JavaScript, Ruby, Go, .NET and more, with experimental analyzers opt-in.
  • Vulnerability Database Management - Downloads the vulnerability feed into a local database and then fetches only small incremental updates, avoiding source queries on each scan.
  • CI Pipeline Integration - Adds dependency vulnerability analysis to Jenkins pipelines through a dedicated plugin so each continuous integration build is checked.
  • Offline Vulnerability Analysis - Keeps a local or company-hosted copy of vulnerability data so scans work offline or on restricted networks.
  • Vulnerability Data Synchronization - Downloads National Vulnerability Database data into a local cache, refreshes it incrementally, and supports internal mirrors for restricted or offline networks.
  • Internal Data Mirrors - Downloads vulnerability feed data from a company-hosted mirror instead of the public source for restricted networks.

    • Star history

    Star history chart for dependency-check/dependencycheckStar history chart for dependency-check/dependencycheck

    How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.

    Frequently asked questions

    What does dependency-check/dependencycheck do?

    DependencyCheck is a software composition analysis tool that identifies the third-party libraries a project depends on, maps them to Common Platform Enumeration identifiers, and links them to publicly disclosed CVE entries from the National Vulnerability Database. The result is a report listing each dependency alongside its matched identifiers and known vulnerabilities, so teams can see which components carry risk.

    What are the main features of dependency-check/dependencycheck?

    The main features of dependency-check/dependencycheck are: Dependency Vulnerability Scanners, Dependency Vulnerability Scanning, Software Composition Analysis Tools, Build Pipeline Scanning, Vulnerability Report Generation, Security Severity Build Gates, Finding Suppressions, Command-Line Scanners.

    Which projects share features with dependency-check/dependencycheck?

    Projects with overlapping indexed features include: snyk/snyk — Snyk is an application security testing platform designed to identify and remediate vulnerabilities across source… google/osv-scanner — osv-scanner is a software composition analysis tool and vulnerability scanner that checks project dependencies and… snyk/cli — The Snyk CLI is a command-line security scanner that detects known vulnerabilities across open-source dependencies,… xmirrorsecurity/opensca-cli — OpenSCA-cli is an open-source software composition analysis tool and vulnerability management command-line interface… dependencytrack/dependency-track — Dependency-Track is a software composition analysis tool and vulnerability management system designed to track… google/osv.dev — OSV is a distributed database and aggregator of open-source security advisories that uses a standardized vulnerability…

    Projects sharing features with DependencyCheck

    These projects share indexed features with DependencyCheck. Shared tags can include platform or build tooling; verify the primary use case before treating a result as a replacement.
    • snyk/snyksnyk avatar

      snyk/snyk

      5,586View on GitHub↗

      Snyk is an application security testing platform designed to identify and remediate vulnerabilities across source code, open-source dependencies, container images, and infrastructure-as-code configurations. It functions as a comprehensive security workflow automation tool, utilizing a static analysis engine and dependency graph mapping to detect security flaws and license compliance issues throughout the software development lifecycle. The platform distinguishes itself through agentic workflow orchestration and an automated remediation pipeline that generates and submits pull requests to patc

      TypeScript
      View on GitHub↗5,586
    • google/osv-scannergoogle avatar

      google/osv-scanner

      10,565View on GitHub↗

      osv-scanner is a software composition analysis tool and vulnerability scanner that checks project dependencies and container images against the Open Source Vulnerabilities database. It functions as a dependency remediation tool and can be integrated into custom Go applications as a programmable security library. The project distinguishes itself through a remediation workflow that includes an interactive terminal user interface and automated scripting for upgrading vulnerable packages in lockfiles and manifests. It employs call-graph reachability analysis to determine if vulnerable code is act

      Goscannersecurity-auditsecurity-tools
      View on GitHub↗10,565
    • snyk/clisnyk avatar

      snyk/cli

      5,701View on GitHub↗

      The Snyk CLI is a command-line security scanner that detects known vulnerabilities across open-source dependencies, proprietary application code, container images, and infrastructure-as-code configuration files. It also serves as a platform management tool, allowing users to configure organizations, users, SSO, and reporting from the terminal rather than the web dashboard. The CLI integrates directly into development workflows, enabling scanning within IDEs, build pipelines, and version control systems. It implements static analysis with interfile data flow analysis to find complex security f

      TypeScriptmonitorsecuritysnyk
      View on GitHub↗5,701
  • xmirrorsecurity/opensca-cliXmirrorSecurity avatar

    XmirrorSecurity/OpenSCA-cli

    1,115View on GitHub↗

    OpenSCA-cli is an open-source software composition analysis tool and vulnerability management command-line interface that inspects third-party dependencies for known security vulnerabilities and compliance risks. It parses package manager configuration and lock files across diverse programming languages to extract software component trees and generate standard inventory reports. The tool performs local vulnerability matching against embedded or downloaded databases without requiring external network connections, ensuring complete data privacy. It includes a license compliance engine that eval

    Gocyclonedxdevsecopslicense-compliance
    View on GitHub↗1,115
    • Compare all 30 related projects→