Dependency-Check

Dependency-Check: Open Source Software Composition Analysis Tool

Dependency-Check identifies project dependencies and checks for known, publicly disclosed vulnerabilities in Java, .NET, Python, Ruby, Node.js, and more.

What is Dependency-Check?

Dependency-Check is an open source software composition analysis and software vulnerability management tool that analyzes project dependencies to identify any known, publicly disclosed vulnerabilities. It works by scanning the binaries and libraries dependencies of applications to detect security issues, outdated software components, and license problems.

Dependency-Check supports a wide range of programming languages and build tools including Java, .NET, Python, Ruby, Node.js, PHP, and more. It can be integrated into the software development lifecycle to shift security left. Dependency-Check can be run within CI/CD pipelines as part of the build process to catch issues early before releasing vulnerable code.

Key features include:

• Identifying project dependencies, including transitive dependencies
• Checking dependencies against NVD and other vulnerability databases to detect known security issues
• Generating reports detailing dependencies and any associated Common Vulnerabilities and Exposures (CVEs)
• Integration with build tools like Maven, Gradle, MSBuild, etc.
• APIs for integrating into custom workflows and IDE plugins
• Web application for viewing analysis results and managing scans

Overall, Dependency-Check brings open source software vulnerability management capabilities to organizations and helps enforce security policies around acceptable dependencies and licenses.

Dependency-Check Features

Official Links