Dependency-Check is a software composition analysis tool that detects publicly disclosed vulnerabilities in application dependencies by identifying Common Platform Enumeration identifiers and linking them to associated CVE entries.
The tool addresses the problem of unknown security risks in project dependencies by scanning for publicly disclosed vulnerabilities. It works by determining if a CPE identifier exists for each dependency and generating reports that connect findings to CVE entries. The tool integrates with the National Vulnerability Database through an API to access vulnerability data.
Dependency-Check suits organizations that need automated vulnerability scanning as part of their build and deployment pipelines. It is particularly valuable for teams already using Maven, Gradle, Ant, or Jenkins, as the tool provides native plugins for these platforms. The tool also offers a command-line interface for standalone usage. Anyone adopting the tool should be aware that an NVD API key is highly recommended for acceptable performance, as updates without one are extremely slow. In CI environments with multiple concurrent builds, rate limiting on the NVD API can cause 403 errors, requiring a caching strategy. Additionally, the tool recently transitioned from using NVD data feeds to the NVD API, and users relying on Sonatype OSS Index analysis must now provide authentication credentials as the service enforces API token requirements.
The project maintains active compatibility with evolving external dependencies and services. Breaking changes in version 11.0.0 introduced a Java 11 requirement and H2 database upgrade that necessitated full NVD data redownloads. The tool has undergone significant architectural changes, including a mandatory migration from NVD data feeds to the NVD API in version 9.0.0, with subsequent compatibility updates required in version 12.1.0. The project actively documents migration paths and provides purge utilities to help users manage database compatibility issues across versions.
