OWASP dep-check

dependency-check --project <p> --scan <path>

Analyze project dependencies with OWASP Dependency-Check, detecting known CVEs of components against the NVD database.

Run it in the CI/CD pipeline when you want OWASP's multi-language SCA: dependency-check identifies project dependencies (formats: Maven, npm, pip, etc.) and cross-references them with the NVD database — components with CVEs, severity, and CPE. It's OWASP's reference open-source SCA: detection via the NVD database without vendor dependency. In DevSecOps, dependency-check is the pipeline piece (with Jenkins plugin or CLI): a high-severity finding blocks the merge.

Don't use it without accessible NVD database: dependency-check downloads the NVD database (first use downloads data) — without access (or mirror in isolated environment), analysis fails or uses stale data. Analysis is slow (component identification and NVD query): run in pipeline (not on every local push). And note: CPE-based detection generates false positives (misidentified components) and false negatives (CVEs without CPE): findings need triage. For commercial SCA, Snyk (019); dependency-check is OWASP's open source.