OWASP Dependency-Check

To scan project dependencies for known security vulnerabilities, you can run a basic scan on your current project directory. This process detects CVEs and other known risks in your libraries to help mitigate threats before exploitation.

Software composition analysis (SCA) identifies known vulnerabilities in project dependencies. You need SCA when generating a Software Bill of Materials (SBOM) or integrating automated security checks into your CI/CD pipeline to prevent deploying insecure software.

Yes, you need the Java Runtime Environment installed and the Dependency-Check tool configured to run vulnerability scans. Accurate vulnerability database lookups require this environment setup to function properly.

You can integrate dependency scanning into your CI/CD pipeline to automatically scan new code commits for vulnerable libraries. This workflow prevents the deployment of insecure software by detecting CVEs early.

Generating a Software Bill of Materials (SBOM) involves analyzing your project dependencies to identify included components and known vulnerabilities. This dependency analysis provides the SBOM output needed for security compliance.

The primary limitation of dependency scanning is that it requires a properly configured Java Runtime Environment and the Dependency-Check tool. Accurate vulnerability database lookups depend entirely on this environment being correctly set up.