# dependency-check/dependencycheck

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/dependency-check-dependencycheck).**

_How this analysis was created: the description and tags below were written by an AI model that read this project's README and public documentation pages; stars, license and language come straight from the GitHub API. The model does not read the source code._

7,763 stars · 1,430 forks · Java · Apache-2.0

## Links

- GitHub: https://github.com/dependency-check/DependencyCheck
- Homepage: https://owasp.org/www-project-dependency-check/
- awesome-repositories: https://awesome-repositories.com/repository/dependency-check-dependencycheck.md

## Topics

`ant-task` `build-tool` `gradle-plugin` `jenkins-plugin` `maven-plugin` `security` `security-audit` `software-composition-analysis` `vulnerability-detection`

## Description

DependencyCheck is a software composition analysis tool that identifies the third-party libraries a project depends on, maps them to Common Platform Enumeration identifiers, and links them to publicly disclosed CVE entries from the National Vulnerability Database. The result is a report listing each dependency alongside its matched identifiers and known vulnerabilities, so teams can see which components carry risk.

The same analysis engine is available as a command line program for Linux, Windows, and macOS, as a Docker container, and as plugins for Maven, Gradle, Ant, and Jenkins. Inside a build, it can fail the run when any dependency scores at or above a configured CVSS threshold, and multiple scan configurations can be registered with different thresholds. Maven multi-module builds can be combined into a single aggregated report. Analysis covers Java, JavaScript, Ruby, Go, .NET, and other ecosystems; some of those rely on matching build and audit tools being installed, and experimental analyzers run only when explicitly enabled.

Vulnerability data is kept in a local database that is downloaded once and then refreshed incrementally. Using an NVD API key avoids very slow updates. For restricted networks, the data can be pulled from a company-hosted mirror, a shared central database, or a CI cache, and scans can run offline. Results can be supplemented with Sonatype OSS Index data and with an external vulnerability index that reports issues the national database does not list; both require credentials and are disabled automatically when none are supplied. Library identification can also use Maven Central, Nexus, or Artifactory lookups.

Findings can be triaged with one or more suppression files, such as a shared company file plus a project-specific one. Custom analyzer plugins and central database drivers can be added by placing their JAR files in a plugins directory.

## Tags

### Security & Cryptography

- [Dependency Vulnerability Scanners](https://awesome-repositories.com/f/security-cryptography/dependency-vulnerability-scanners.md) — Identifies a project's third-party dependencies, maps them to CPE identifiers, and reports the known CVE vulnerabilities in each component.
- [Dependency Vulnerability Scanning](https://awesome-repositories.com/f/security-cryptography/security-auditing/dependency-vulnerability-scanning.md) — Matches a project's third-party libraries against National Vulnerability Database data and reports known vulnerable components. ([source](https://dependency-check.github.io/DependencyCheck/dependency-check-gradle))
- [Software Composition Analysis Tools](https://awesome-repositories.com/f/security-cryptography/software-composition-analysis-tools.md) — Identifies third-party libraries a project depends on and reports which carry publicly disclosed vulnerabilities.
- [Vulnerability Report Generation](https://awesome-repositories.com/f/security-cryptography/vulnerability-report-generation.md) — Produces a report listing each identified component with its matched identifiers and known vulnerabilities so teams can prioritize remediation. ([source](https://dependency-check.github.io/DependencyCheck/))
- [CVE Dependency Scanners](https://awesome-repositories.com/f/security-cryptography/cve-dependency-scanners.md) — Produces a report listing each dependency across language ecosystems with its matched CPE identifiers and associated CVE entries.
- [Multi-Ecosystem Dependency Analyzers](https://awesome-repositories.com/f/security-cryptography/multi-ecosystem-dependency-analyzers.md) — Examines .NET, Go, Elixir, npm, pnpm, yarn, and Ruby projects by delegating to the matching installed build and audit tools. ([source](https://github.com/dependency-check/dependencycheck#readme))
- [Multi-Ecosystem Analyzers](https://awesome-repositories.com/f/security-cryptography/security-auditing/dependency-vulnerability-scanning/javascript-scanning-configurations/language-scanning-rules/multi-ecosystem-analyzers.md) — Applies file-type analyzers to identify dependencies across Java, JavaScript, Ruby, Go, .NET and more, with experimental analyzers opt-in. ([source](https://dependency-check.github.io/DependencyCheck))
- [Vulnerability Database Management](https://awesome-repositories.com/f/security-cryptography/security/offensive-operations/vulnerability-research-analysis/research-reference-knowledge/vulnerability-database-management.md) — Downloads the vulnerability feed into a local database and then fetches only small incremental updates, avoiding source queries on each scan. ([source](https://dependency-check.github.io/DependencyCheck/data/index.html))
- [CI Pipeline Integration](https://awesome-repositories.com/f/security-cryptography/vulnerability-scanning/ci-pipeline-integration.md) — Adds dependency vulnerability analysis to Jenkins pipelines through a dedicated plugin so each continuous integration build is checked. ([source](https://github.com/dependency-check/dependencycheck#readme))
- [Offline Vulnerability Analysis](https://awesome-repositories.com/f/security-cryptography/vulnerability-scanning/offline-vulnerability-analysis.md) — Keeps a local or company-hosted copy of vulnerability data so scans work offline or on restricted networks.
- [Vulnerability Data Synchronization](https://awesome-repositories.com/f/security-cryptography/vulnerability-scanning/vulnerability-data-synchronization.md) — Downloads National Vulnerability Database data into a local cache, refreshes it incrementally, and supports internal mirrors for restricted or offline networks.
- [Internal Data Mirrors](https://awesome-repositories.com/f/security-cryptography/vulnerability-scanning/vulnerability-data-synchronization/internal-data-mirrors.md) — Downloads vulnerability feed data from a company-hosted mirror instead of the public source for restricted networks. ([source](https://dependency-check.github.io/DependencyCheck/dependency-check-maven))

### DevOps & Infrastructure

- [Build Pipeline Scanning](https://awesome-repositories.com/f/devops-infrastructure/build-pipeline-scanning.md) — Runs dependency checks inside Maven, Gradle, or Ant builds and can tie the scan to the verify phase automatically. ([source](https://github.com/dependency-check/dependencycheck#readme))

### Testing & Quality Assurance

- [Security Severity Build Gates](https://awesome-repositories.com/f/testing-quality-assurance/build-gating-tools/security-severity-build-gates.md) — Fails builds in Maven, Gradle, Ant, Jenkins, or command line runs when any dependency has a vulnerability at or above a configured CVSS score.

### Part of an Awesome List

- [Finding Suppressions](https://awesome-repositories.com/f/awesome-lists/devtools/regex-and-pattern-matching/finding-suppressions.md) — Excludes known incorrect or accepted findings from reports using one or more suppression files, shared and project-specific. ([source](https://dependency-check.github.io/DependencyCheck/dependency-check-maven))

### Development Tools & Productivity

- [Command-Line Scanners](https://awesome-repositories.com/f/development-tools-productivity/command-line-scanners.md) — Ships a downloadable command-line program for Linux, Windows, and macOS that scans dependencies without any build tool installed. ([source](https://github.com/dependency-check/dependencycheck#readme))
- [Multi-Language Dependency Analysis](https://awesome-repositories.com/f/development-tools-productivity/multi-language-dependency-analysis.md) — Analyzes Java, JavaScript, Ruby, Go, .NET, and other ecosystems in a single scan to locate dependencies for vulnerability matching.
- [Security Build Plugins](https://awesome-repositories.com/f/development-tools-productivity/security-build-plugins.md) — Ships Maven, Gradle, and Ant plugins that run dependency vulnerability scans in the build and can fail it above a severity threshold.
- [Build Tool Integrations](https://awesome-repositories.com/f/development-tools-productivity/workflow-automation-tools/build-task-automation/build-pipeline-integrations/build-pipeline-integrators/build-tool-integrations.md) — Runs the same analysis engine as a command line tool or as plugins for Ant, Maven, Gradle, and Jenkins within existing build pipelines. ([source](https://dependency-check.github.io/DependencyCheck/))