https://cybertoolchain.io/tools/dependencycheck New releases and features in DependencyCheck, tracked by The Cyber Toolchain. en Mon, 03 Aug 2026 10:43:02 GMT https://github.com/dependency-check/DependencyCheck/releases/tag/v13.0.0 https://github.com/dependency-check/DependencyCheck/releases/tag/v13.0.0 Mon, 03 Aug 2026 10:43:02 GMT DependencyCheck v13.0.0 drops Nexus V2 and deprecated config options, adds OpenSSL 3.x detection. • Adds OpenSSL 3.x detection to the `OpenSSLAnalyzer`, enabling accurate identification of modern OpenSSL versions in scanned dependencies. • Drops Nexus V2 Search support and all previously deprecated configuration and integration options (see breaking changes). Breaking changes: • Nexus V2 Search support has been removed along with all previously deprecated configuration keys and integration options — any working setup relying on Nexus V2 or deprecated settings will break on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependencycheck https://github.com/dependency-check/DependencyCheck/releases/tag/v9.0.0 https://github.com/dependency-check/DependencyCheck/releases/tag/v9.0.0 Wed, 22 Nov 2023 12:36:27 GMT DependencyCheck v9.0.0 introduces NVD API utilization and GitLab dependency scanner report format • Utilizes the NVD API for vulnerability data retrieval • Adds `--format gitlab-dependency-scanner` to output results in GitLab's expected JSON structure Breaking changes: • Upgrade notice referenced but specific breaking changes not detailed in release notes text; check linked upgrade guide for migration steps. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependencycheck https://github.com/dependency-check/DependencyCheck/releases/tag/v8.4.0 https://github.com/dependency-check/DependencyCheck/releases/tag/v8.4.0 Sat, 19 Aug 2023 13:35:23 GMT Adds Nexus v3 repository support via the new NexusAnalyzer • Add support for Nexus v3 to NexusAnalyzer Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependencycheck https://github.com/dependency-check/DependencyCheck/releases/tag/v8.3.0 https://github.com/dependency-check/DependencyCheck/releases/tag/v8.3.0 Mon, 12 Jun 2023 12:28:30 GMT DependencyCheck v8.3.0 adds LibmanAnalyzer and configurable Central URL • Adds `libman` manifest file analysis capability via the new `LibmanAnalyzer` • Enables configuration of the Central URL directly via CLI argument `--centralUrl` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependencycheck https://github.com/dependency-check/DependencyCheck/releases/tag/v8.2.0 https://github.com/dependency-check/DependencyCheck/releases/tag/v8.2.0 Wed, 22 Mar 2023 10:41:33 GMT Adds MSBuild Directory.build.props support and CVSS V3 results for NPM Audit • Adds `msbuild Directory.build.props` scanning support to identify dependencies via MSBuild projects. • Includes CVSS V3 scores in NPM Audit analysis results for improved vulnerability severity assessment. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependencycheck https://github.com/dependency-check/DependencyCheck/releases/tag/v8.1.0 https://github.com/dependency-check/DependencyCheck/releases/tag/v8.1.0 Mon, 13 Feb 2023 11:34:46 GMT Adds `Pipefile.lock` support; enforces analysis for pyproject.toml-only projects • Supports scanning of `Pipefile.lock` files • Reports an error when a Python project contains only `pyproject.toml` without a lock file or requirements Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependencycheck https://github.com/dependency-check/DependencyCheck/releases/tag/v8.0.0 https://github.com/dependency-check/DependencyCheck/releases/tag/v8.0.0 Sun, 15 Jan 2023 11:38:40 GMT DependencyCheck v8.0 adds CISA KEV catalog, gradle/maven build plugin scanning, SARIF severity field, and HTTP auth for Retire JS • Include the `CISA Known Exploited Vulnerability Catalog` in scan results. • The `gradle` and `maven` plugins now scan the `build plugins` section of projects. • Transitive dependency reports now include the `root dependency` in the project that included it. • Added `properties.security-severity` field to SARIF report for GitHub Security Code scanning integration. • Allow HTTP auth settings for `Retire JS repository` configuration. • New XML report schema supports new data fields including CISA KEV and root dependency info. Breaking changes: • The database schema has been updated; if using an external database the update scripts must be run! • The exit codes from the CLI have been changed to be in the range from 0-255. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependencycheck https://github.com/dependency-check/DependencyCheck/releases/tag/v7.4.0 https://github.com/dependency-check/DependencyCheck/releases/tag/v7.4.0 Sun, 04 Dec 2022 14:27:51 GMT DependencyCheck v7.4.0 adds Poetry scanning, npm lock v3 support, and Jenkins HTML report • Adds support for `npm` package lock v2 and v3 formats to the scanner engine • Adds experimental support for scanning Python projects using `Poetry` (pyproject.toml/poetry.lock) • Adds a new vanilla HTML report output format, configured via `JenkinsReportFormat.HTML_PLAIN`, for use in Jenkins pipelines Breaking changes: • `RELEASE_NOTES.md` is renamed to `CHANGELOG.md`; scripts referencing the former file path will fail Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependencycheck https://github.com/dependency-check/DependencyCheck/releases/tag/v7.3.0 https://github.com/dependency-check/DependencyCheck/releases/tag/v7.3.0 Wed, 19 Oct 2022 11:49:04 GMT DependencyCheck v7.3.0 adds experimental Dart analyzer support via CLI • Adds an experimental Dart analyzer to detect vulnerabilities in Dart projects Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependencycheck https://github.com/dependency-check/DependencyCheck/releases/tag/v7.2.0 https://github.com/dependency-check/DependencyCheck/releases/tag/v7.2.0 Wed, 14 Sep 2022 11:19:52 GMT Adds support for Bazel's pinned `maven_install.json` dependency manifest • Add support for Bazel's pinned `maven_install.json` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependencycheck https://github.com/dependency-check/DependencyCheck/releases/tag/v7.1.0 https://github.com/dependency-check/DependencyCheck/releases/tag/v7.1.0 Sat, 23 Apr 2022 10:14:20 GMT DependencyCheck v7.1.0 adds improved Swift support and HTML report sorting • Improved sorting in the HTML report Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependencycheck https://github.com/dependency-check/DependencyCheck/releases/tag/v7.0.0 https://github.com/dependency-check/DependencyCheck/releases/tag/v7.0.0 Mon, 28 Feb 2022 12:05:50 GMT DependencyCheck v7.0.0 adds false positive report issue generation and includes Java developer data in analysis. • Adds `IssueOps` capability to generate GitHub issues for false positive reports via a direct link template Breaking changes: • The H2 database upgrade requires running a purge if the `dataDirectory` option was in use. • DotNET assemblies now require the system to have the dotnet core 6.0.x runtime available for analysis. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependencycheck https://github.com/dependency-check/DependencyCheck/releases/tag/v6.5.0 https://github.com/dependency-check/DependencyCheck/releases/tag/v6.5.0 Mon, 08 Nov 2021 13:20:21 GMT Adds pnpm analyzer and Swift Resolved analyzer for dependency scanning. • Added the a new pnpm Analyzer • Enabled the Swift Resolved analyzer per #3735 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependencycheck