PAGES
← all tools
◆ SAST / SCA / Code Security

DependencyCheck

v13.0.0 open-source

OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. dependency-check is a software composition analysissoftware composition analysisSoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. utility that detects publicly disclosed vulnerabilities in application dependencies.

source ↗ website ↗ rss ↗ What is a cyber toolchain? last repo push Aug 10, 2026

Summary

DependencyCheck is an open-source software composition analysis tool, licensed under Apache 2.0, that scans a project's dependencies and flags publicly disclosed vulnerabilities by matching them to CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. identifiers and linking each match to its CVE entries. It runs from the command line, and also as a Maven plugin or via Homebrew, so it fits into a build or CI pipeline rather than running as a hosted service, which suits application developers and appsec teams who need vulnerability checks tied to the build itself rather than a separate scanning platform. It sits in the software composition analysis category, alongside dependency-scanning tools used earlier in the pipeline than runtime security monitoring. Backed by ten releases in the window we track, including recent work tightening detection accuracy and removing deprecated integrations, it shows active, ongoing maintenance.

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.

How DependencyCheck helps

Which of my project's dependencies have known, publicly disclosed vulnerabilities?

matches each dependency to a CPE identifier and reports every associated CVE entry it finds, with links to the source record

Does a vulnerability affecting one of my libraries actually show up in the NVD, or only in a broader vulnerability feed?

cross-checks findings against both the NVD and OSS Index, and adds extra references to a finding when both sources report it, so a gap in one source doesn't hide a match

Can I catch a vulnerable dependency before it reaches production, rather than after deployment?

runs as a command-line scan, Maven plugin, or Homebrew install directly in the build, producing a report as part of that build rather than requiring a separate scanning platform

Is the OpenSSL version bundled in my dependencies actually safe?

inspects the dependency tree for OpenSSL 3.x builds specifically and identifies the version present, rather than relying on generic library naming

Am I paying for vulnerability lookups I don't need to repeat?

caches OSS Index results between runs for a configurable number of hours, so unchanged dependencies aren't re-submitted and re-charged against the account's usage credits on every scan

Will my existing Nexus V2 or deprecated-setting configuration keep working if I upgrade?

no longer supports Nexus V2 Search or any previously deprecated configuration keys, so a setup relying on them stops functioning after the upgrade rather than degrading quietly

all 8 features, with the evidence for each →

Languages

Not documented

Features

8 capabilities

Built from DependencyCheck's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • DependencyCheck covers 1 of the 8 vulnerability assessment methods capabilities we track.

What DependencyCheck offers you

  • CI/CD pipeline integration1
  • Command-line interface1
  • JSON data export1
  • Ticketing integration1
All capabilities 8 capabilities
Dependency manifest support shipped suggested Identifies vulnerabilities by analyzing package manifests and lock files for supported package managers and build systems. 11 releases · 2 other sources · first seen Nov 2020

Suggested capability: Vulnerability database matching. This is our guess, not confirmed.

release 11 total

  • Enables configuration of the Central URL directly via CLI argument --centralUrl v8.3.0 · Jun 2023 · source · release history
  • Adds libman manifest file analysis capability via the new LibmanAnalyzer v8.3.0 · Jun 2023 · source · release history
  • Adds msbuild Directory.build.props scanning support to identify dependencies via MSBuild projects. v8.2.0 · Mar 2023 · source · release history
  • Supports scanning of Pipefile.lock files v8.1.0 · Feb 2023 · source · release history
  • Adds experimental support for scanning Python projects using Poetry (pyproject.toml/poetry.lock) v7.4.0 · Dec 2022 · source · release history
  • Adds support for npm package lock v2 and v3 formats to the scanner engine v7.4.0 · Dec 2022 · source · release history

example

  • Override the default central URL using the new CLI option. dependency-check.sh -n --centralUrl https://custom-central.example.com v8.3.0 · Jun 2023 · source
  • Enable scanning of MSBuild projects that use Directory.build.props files. dependency-check --scan /path/to/project --enableMSBuildDirectoryProps v8.2.0 · Mar 2023 · source
Configuration options shipped Allows users to customize the behavior of data retrieval and project scanning through various configuration parameters. 8 releases · 1 other source · first seen Sep 2020

release 8 total

  • Allow HTTP auth settings for Retire JS repository configuration. v8.0.0 · Jan 2023 · source · release history
  • cveWaitTime is a new configuration option to define how many milliseconds to wait between NVD downloads; default is 4000 ms v6.4.0 · Oct 2021 · source · release history
  • CPE_MATCH_STRATEGY (implied by release notes) allows configuring a new matching algorithm v6.1.2 · Mar 2021 · source · release history
  • Added missing configuration options for msbuild. v6.1.1 · Feb 2021 · source · release history
  • Added missing configuration options for yarn. v6.1.1 · Feb 2021 · source · release history
  • Support for external Oracle databases added as a storage backend. v6.0.3 · Nov 2020 · source · release history

example

  • Enable auto-completion for DependencyCheck subcommands in the current bash session. source bin/completion-for-dependency-check.sh v6.0.3 · Nov 2020 · source
Report output formats shipped Generates scan results in various standardized formats for integration with external CI/CD and vulnerability management systems. 4 releases · 1 other source · first seen Jan 2021

Also counts toward: CI/CD pipeline integration, Command-line interface, JSON data export

release

  • Adds --format gitlab-dependency-scanner to output results in GitLab's expected JSON structure v9.0.0 · Nov 2023 · source · release history
  • Adds a new vanilla HTML report output format, configured via JenkinsReportFormat.HTML_PLAIN, for use in Jenkins pipelines v7.4.0 · Dec 2022 · source · release history
  • Improved sorting in the HTML report v7.1.0 · Apr 2022 · source · release history
  • Adds --sarif output option to generate results in SARIF file format for CI/CD integration v6.1.0 · Jan 2021 · source · release history

example

  • Generate a report compatible with GitLab's dependency scanning integration dependency-check --format gitlab-dependency-scanner --scan /path/to/project v9.0.0 · Nov 2023 · source
Dependency graph enhancement shipped Provides detailed information about the dependency tree, including root dependencies and transitive relationships. 4 releases · first seen Sep 2020

release

  • The gradle and maven plugins now scan the build plugins section of projects. v8.0.0 · Jan 2023 · source · release history
  • Transitive dependency reports now include the root dependency in the project that included it. v8.0.0 · Jan 2023 · source · release history
  • Archive analyzer now extracts files from RPM archives. v6.2.0 · May 2021 · source · release history
  • GoLang Analyzer now scans transitive dependencies v6.0.2 · Sep 2020 · source · release history
OpenSSL version detection shipped Identifies OpenSSL versions, including modern OpenSSL 3.x releases, within scanned dependencies. 3 releases · first seen Oct 2021

Shared capability: Vulnerability database matching

release

  • Adds OpenSSL 3.x detection to the OpenSSLAnalyzer, enabling accurate identification of modern OpenSSL versions in scanned dependencies. v13.0.0 · Aug 2026 · source · release history
  • Utilizes the NVD API for vulnerability data retrieval v9.0.0 · Nov 2023 · source · release history
  • The NVD CVE data files are now being cached for up to 4 hours in case a download fails, re-running ODC will use the cached version v6.4.0 · Oct 2021 · source · release history
Analyzer ecosystem shipped Supports analysis of additional technologies and file formats, including Bazel pinned dependencies and Nexus repositories. 3 releases · first seen May 2021

release

Vulnerability data integration shipped Incorporates external vulnerability data sources, including known exploited vulnerabilities and CVSS scores, into scan results. 3 releases · first seen Jan 2023

release

  • Includes CVSS V3 scores in NPM Audit analysis results for improved vulnerability severity assessment. v8.2.0 · Mar 2023 · source · release history
  • New XML report schema supports new data fields including CISA KEV and root dependency info. v8.0.0 · Jan 2023 · source · release history
  • Include the CISA Known Exploited Vulnerability Catalog in scan results. v8.0.0 · Jan 2023 · source · release history
Issue management integration shipped Automates the creation and tracking of vulnerability issues in external issue tracking platforms. 1 release · first seen Feb 2022

Also counts toward: Ticketing integration

release

  • Adds IssueOps capability to generate GitHub issues for false positive reports via a direct link template v7.0.0 · Feb 2022 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for DependencyCheck, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail DependencyCheck puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

20 entries

  1. August 20261
  3. November 20231
  5. August 20231
  7. June 20231
  9. March 20231
  11. February 20231
  13. January 20231
  15. December 20221
  17. October 20221
  19. September 20221
  21. April 20221
  23. February 20221
  25. November 20211
  27. October 20211
  29. May 20211
  31. March 20211
  33. February 20211
  35. January 20211
  37. November 20201
  39. September 20201
    Show

    20 entries

    1. v13.0.0 Aug 3, 2026 · issue 041

      DependencyCheck v13.0.0 drops Nexus V2 and deprecated config options, adds OpenSSL 3.x detection.

      └──▷ GET THIS VERSION 
      $ git clone --branch v13.0.0 https://github.com/dependency-check/DependencyCheck.git
# already have the repo? check out this version:
$ git checkout v13.0.0
      • Adds OpenSSL 3.x detection to the OpenSSLAnalyzer, enabling accurate identification of modern OpenSSL versions in scanned dependencies.
      • Drops Nexus V2 Search support and all previously deprecated configuration and integration options (see breaking changes).

      2 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !Nexus V2 Search support has been removed along with all previously deprecated configuration keys and integration options — any working setup relying on Nexus V2 or deprecated settings will break on upgrade.
    2. v9.0.0 Nov 22, 2023 · release notes

      DependencyCheck v9.0.0 introduces NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. API utilization and GitLab dependency scanner report format

      └──▷ GET THIS VERSION 
      $ git clone --branch v9.0.0 https://github.com/dependency-check/DependencyCheck.git
# already have the repo? check out this version:
$ git checkout v9.0.0
      └──▷ USE IT
      Generate a report compatible with GitLab's dependency scanning integration
      shell 
      dependency-check --format gitlab-dependency-scanner --scan /path/to/project
      • Utilizes the NVD API for vulnerability data retrieval
      • Adds --format gitlab-dependency-scanner to output results in GitLab's expected JSON structure

      2 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !Upgrade notice referenced but specific breaking changes not detailed in release notes text; check linked upgrade guide for migration steps.
    3. v8.4.0 Aug 19, 2023 · release notes

      Adds Nexus v3 repository support via the new NexusAnalyzer

      └──▷ GET THIS VERSION 
      $ git clone --branch v8.4.0 https://github.com/dependency-check/DependencyCheck.git
# already have the repo? check out this version:
$ git checkout v8.4.0
      • Add support for Nexus v3 to NexusAnalyzer

      1 detail in Everything

    4. v8.3.0 Jun 12, 2023 · release notes

      DependencyCheck v8.3.0 adds LibmanAnalyzer and configurable Central URL

      └──▷ GET THIS VERSION 
      $ git clone --branch v8.3.0 https://github.com/dependency-check/DependencyCheck.git
# already have the repo? check out this version:
$ git checkout v8.3.0
      └──▷ TRY IT
      Override the default central URL using the new CLI option.
      $ dependency-check.sh -n --centralUrl https://custom-central.example.com
      • Adds libman manifest file analysis capability via the new LibmanAnalyzer
      • Enables configuration of the Central URL directly via CLI argument --centralUrl

      2 details in Everything

    5. v8.2.0 Mar 22, 2023 · release notes

      Adds MSBuild Directory.build.props support and CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. V3 results for NPM Audit

      └──▷ GET THIS VERSION 
      $ git clone --branch v8.2.0 https://github.com/dependency-check/DependencyCheck.git
# already have the repo? check out this version:
$ git checkout v8.2.0
      └──▷ USE IT
      Enable scanning of MSBuild projects that use Directory.build.props files.
      shell 
      dependency-check --scan /path/to/project --enableMSBuildDirectoryProps
      • Adds msbuild Directory.build.props scanning support to identify dependencies via MSBuild projects.
      • Includes CVSS V3 scores in NPM Audit analysis results for improved vulnerability severity assessment.

      2 details in Everything

    6. v8.1.0 Feb 13, 2023 · release notes

      Adds Pipefile.lock support; enforces analysis for pyproject.toml-only projects

      └──▷ GET THIS VERSION 
      $ git clone --branch v8.1.0 https://github.com/dependency-check/DependencyCheck.git
# already have the repo? check out this version:
$ git checkout v8.1.0
      • Supports scanning of Pipefile.lock files
      • Reports an error when a Python project contains only pyproject.toml without a lock file or requirements

      2 details in Everything

    7. v8.0.0 Jan 15, 2023 · release notes

      DependencyCheck v8.0 adds CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. catalog, gradle/maven build plugin scanning, SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. severity field, and HTTP auth for Retire JS

      └──▷ GET THIS VERSION 
      $ git clone --branch v8.0.0 https://github.com/dependency-check/DependencyCheck.git
# already have the repo? check out this version:
$ git checkout v8.0.0
      • Include the CISA Known Exploited Vulnerability Catalog in scan results.
      • The gradle and maven plugins now scan the build plugins section of projects.
      • Transitive dependency reports now include the root dependency in the project that included it.
      • Added properties.security-severity field to SARIF report for GitHub Security Code scanning integration.
      • Allow HTTP auth settings for Retire JS repository configuration.
      +1 more show less
      • New XML report schema supports new data fields including CISA KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. and root dependency info.

      6 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !The database schema has been updated; if using an external database the update scripts must be run!
      • !The exit codes from the CLI have been changed to be in the range from 0-255.
    8. v7.4.0 Dec 4, 2022 · release notes

      DependencyCheck v7.4.0 adds Poetry scanning, npm lock v3 support, and Jenkins HTML report

      └──▷ GET THIS VERSION 
      $ git clone --branch v7.4.0 https://github.com/dependency-check/DependencyCheck.git
# already have the repo? check out this version:
$ git checkout v7.4.0
      • Adds support for npm package lock v2 and v3 formats to the scanner engine
      • Adds experimental support for scanning Python projects using Poetry (pyproject.toml/poetry.lock)
      • Adds a new vanilla HTML report output format, configured via JenkinsReportFormat.HTML_PLAIN, for use in Jenkins pipelines

      3 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !RELEASE_NOTES.md is renamed to CHANGELOG.md; scripts referencing the former file path will fail
    9. v7.3.0 Oct 19, 2022 · release notes

      DependencyCheck v7.3.0 adds experimental Dart analyzer support via CLI

      └──▷ GET THIS VERSION 
      $ git clone --branch v7.3.0 https://github.com/dependency-check/DependencyCheck.git
# already have the repo? check out this version:
$ git checkout v7.3.0
    10. v7.2.0 Sep 14, 2022 · release notes

      Adds support for Bazel's pinned maven_install.json dependency manifest

      └──▷ GET THIS VERSION 
      $ git clone --branch v7.2.0 https://github.com/dependency-check/DependencyCheck.git
# already have the repo? check out this version:
$ git checkout v7.2.0
    11. v7.1.0 Apr 23, 2022 · release notes

      DependencyCheck v7.1.0 adds improved Swift support and HTML report sorting

      └──▷ GET THIS VERSION 
      $ git clone --branch v7.1.0 https://github.com/dependency-check/DependencyCheck.git
# already have the repo? check out this version:
$ git checkout v7.1.0
    12. v7.0.0 Feb 28, 2022 · release notes

      DependencyCheck v7.0.0 adds false positive report issue generation and includes Java developer data in analysis.

      └──▷ GET THIS VERSION 
      $ git clone --branch v7.0.0 https://github.com/dependency-check/DependencyCheck.git
# already have the repo? check out this version:
$ git checkout v7.0.0
      • Adds IssueOps capability to generate GitHub issues for false positive reports via a direct link template

      1 detail in Everything

      └──▷ BREAKING ON UPGRADE
      • !The H2 database upgrade requires running a purge if the dataDirectory option was in use.
      • !DotNET assemblies now require the system to have the dotnet core 6.0.x runtime available for analysis.
    13. v6.5.0 Nov 8, 2021 · release notes

      Adds pnpm analyzer and Swift Resolved analyzer for dependency scanning.

      └──▷ GET THIS VERSION 
      $ git clone --branch v6.5.0 https://github.com/dependency-check/DependencyCheck.git
# already have the repo? check out this version:
$ git checkout v6.5.0
      • Added the a new pnpm Analyzer
      • Enabled the Swift Resolved analyzer per #3735

      2 details in Everything

    14. v6.4.0 Oct 11, 2021 · release notes

      Adds cveWaitTime config and makes cveStartYear configurable for NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. download control.

      └──▷ GET THIS VERSION 
      $ git clone --branch v6.4.0 https://github.com/dependency-check/DependencyCheck.git
# already have the repo? check out this version:
$ git checkout v6.4.0
      • cveWaitTime is a new configuration option to define how many milliseconds to wait between NVD downloads; default is 4000 ms
      • cveStartYear is now configurable and can be set to any year from 2002 to present
      • The NVD CVE data files are now being cached for up to 4 hours in case a download fails, re-running ODC will use the cached version

      3 details in Everything

    15. v6.2.0 May 29, 2021 · release notes

      Adds Perl CPANCPANThe Comprehensive Perl Archive Network, a public repository of reusable Perl modules maintained by the Perl community, giving cyber tools instant access to thousands of tested libraries without reinventing common functionality. and RPM archive analysis to DependencyCheck v6.2.0

      └──▷ GET THIS VERSION 
      $ git clone --branch v6.2.0 https://github.com/dependency-check/DependencyCheck.git
# already have the repo? check out this version:
$ git checkout v6.2.0
      • Added perl-cpan analyzer for scanning Perl modules from CPAN.
      • Archive analyzer now extracts files from RPM archives.

      2 details in Everything

    16. v6.1.2 Mar 8, 2021 · release notes

      Adds a new CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. matching strategy to reduce false negatives in dependency detection

      └──▷ GET THIS VERSION 
      $ git clone --branch v6.1.2 https://github.com/dependency-check/DependencyCheck.git
# already have the repo? check out this version:
$ git checkout v6.1.2
      • CPE_MATCH_STRATEGY (implied by release notes) allows configuring a new matching algorithm

      1 detail in Everything

    17. v6.1.1 Feb 13, 2021 · release notes

      Adds missing configuration options for Yarn and MSBuild in DependencyCheck v6.1.1

      └──▷ GET THIS VERSION 
      $ git clone --branch v6.1.1 https://github.com/dependency-check/DependencyCheck.git
# already have the repo? check out this version:
$ git checkout v6.1.1
      • Added missing configuration options for yarn.
      • Added missing configuration options for msbuild.

      2 details in Everything

    18. v6.1.0 Jan 27, 2021 · release notes

      DependencyCheck v6.1.0 adds SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output format and Yarn dependency scanning support

      └──▷ GET THIS VERSION 
      $ git clone --branch v6.1.0 https://github.com/dependency-check/DependencyCheck.git
# already have the repo? check out this version:
$ git checkout v6.1.0
      • Adds --sarif output option to generate results in SARIF file format for CI/CD integration
      • Adds native scanning support for Yarn lockfiles via the new Yarn analyzer

      2 details in Everything

    19. v6.0.3 Nov 3, 2020 · release notes

      Adds bash completion script, experimental PIP analyzer, and external Oracle DB support

      └──▷ GET THIS VERSION 
      $ git clone --branch v6.0.3 https://github.com/dependency-check/DependencyCheck.git
# already have the repo? check out this version:
$ git checkout v6.0.3
      └──▷ USE IT
      Enable auto-completion for DependencyCheck subcommands in the current bash session.
      shell 
      source bin/completion-for-dependency-check.sh
      • completion-for-dependency-check.sh in the bin directory adds bash command completion to the CLI.
      • Experimental PIP File Analyzer added to scan Python packages.
      • Support for external Oracle databases added as a storage backend.

      3 details in Everything

    20. v6.0.2 Sep 27, 2020 · release notes

      DependencyCheck v6.0.2 adds --nodeAuditSkipDevDependencies and transitive Go scanning; moves archives to GitHub

      └──▷ GET THIS VERSION 
      $ git clone --branch v6.0.2 https://github.com/dependency-check/DependencyCheck.git
# already have the repo? check out this version:
$ git checkout v6.0.2
      • Adds --nodeAuditSkipDevDependencies flag to skip dev dependencies in Npm Audit Analyzer
      • GoLang Analyzer now scans transitive dependencies
      • Release archives moved from Bintray to GitHub release assets

      3 details in Everything

    Project health

    Issue, contributor and maintainer activity in dependency-check/DependencyCheck, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 31 −2 vs prior 12 months
    2. Maintainers 2 +0 joined · −2 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 90% of issues opened, last 12 months
    5. Median time to close < 1 day first maintainer reply 0.7 hours
    6. Open backlog 183 of 5,528 issues ever filed
    1. Issues opened / month 6 · 0 communitymaintainers
    2. Open backlog 183
    3. Contributors / month 2
    4. Commits / month 5
    5. Stars 7,700
    Issue themes, last 12 months
    • bugs 14%
    • features 7%
    • questions 12%
    • docs 1%
    • other 66%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback