OWASP dependency-check
Metrics as of , from the GitHub or GitLab API of each repository. Refreshed monthly.
What OWASP dependency-check is
OWASP dependency-check is a project whose original repository is archived. The README of this repository states only that the project moved to github.com/dependency-check/DependencyCheck. The successor's README describes a software composition analysis tool that looks for publicly disclosed vulnerabilities in a project's dependencies. That README says the tool checks whether each dependency has a Common Platform Enumeration identifier and reports the linked CVE entries. That README also covers a command-line tool, Maven and Gradle plugins, an Ant task and a Jenkins plugin.
Written from the project's README, read , and its documentation (see sources).
- Category
- Security testing
- License
- Apache-2.0
- Language
- Java
- Changelog
- Releases on GitHub
Repository metrics
Status
archivedThe repository is marked archived on its host.Computed from the last commit date and the archive flag on the fetch date. See the status rules.
Alternatives
Listed security testing tools, same primary language first, then by GitHub stars. Each line gives one fact from the tool's documentation where it differs from OWASP dependency-check's, with its source.
ZAP: Scan targets: Web applications. source: README
sqlmap: Scan targets: Web application parameters: GET, POST, cookie, User-Agent and Referer values. source: Docs: Features
Trivy: Scan targets: Container images, filesystems, remote Git repositories, virtual machine images, Kubernetes. source: README
Nuclei: Scan targets: Target URLs and hosts, from a single target or a list file. source: README
Gitleaks: Scan targets: Secrets such as passwords, API keys and tokens in git repositories, files and stdin. source: README
Promptfoo: Scan targets: LLM apps, through red teaming and vulnerability scanning. source: README
ffuf: Scan targets: Web servers: content paths, virtual hosts, GET parameters and POST data. source: README
OSV-Scanner: Scan targets: Project dependencies, checked against the OSV database. source: README
Questions
Is OWASP dependency-check open source?
Yes. OWASP dependency-check is released under Apache-2.0, an OSI-approved license, as reported by the GitHub API on 2026-09-22.
Is OWASP dependency-check maintained?
On 2026-09-22, the last commit to the default branch was on 2025-02-17, so the listed status is archived. Rule: The repository is marked archived on its host.
How many GitHub stars does OWASP dependency-check have?
54 stars on 2026-09-22, from the GitHub API. The number is refreshed at each monthly update.
What language is OWASP dependency-check written in?
The repository's primary language, as reported by the GitHub API, is Java.