OWASP Dependency-Check Integration Guide

Integrate OWASP Dependency-Check with Vulnetix. Scan project dependencies for known CVEs and export SARIF or CycloneDX reports for upload to Vulnetix.

Install & scan

$ # Download and extract the CLI distribution
VERSION=$(curl -s https://api.github.com/repos/jeremylong/DependencyCheck/releases/latest | grep '"tag_name"' | sed -E 's/.*"v([^"]+)".*/\1/')
curl -L "https://github.com/jeremylong/DependencyCheck/releases/download/v${VERSION}/dependency-check-${VERSION}-release.zip" -o dc.zip
unzip dc.zip && rm dc.zip
$ dependency-check/bin/dependency-check.sh   --scan .   --format SARIF   --out dependency-check.sarif   --enableRetired

Run OWASP Dependency-Check in CI

Scan on every push and upload the report as a workflow artifact:

- name: Setup Java
  uses: actions/setup-java@v4
  with:
    java-version: '17'
    distribution: 'temurin'

- name: Download Dependency-Check
  run: |
    VERSION=$(curl -s https://api.github.com/repos/jeremylong/DependencyCheck/releases/latest | grep '"tag_name"' | sed -E 's/.*"v([^"]+)".*/\1/')
    curl -L "https://github.com/jeremylong/DependencyCheck/releases/download/v${VERSION}/dependency-check-${VERSION}-release.zip" -o dc.zip
    unzip dc.zip

- name: Run Dependency-Check
  run: |
    dependency-check/bin/dependency-check.sh --scan . --format SARIF --out dc.sarif
  env:
    NVD_API_KEY: ${{ secrets.NVD_API_KEY }}

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: owasp-dependency-check
    path: dc.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under OWASP Dependency-Check's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace OWASP Dependency-Check. Keep running it. Vulnetix sits on top of OWASP Dependency-Check (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

OWASP Dependency-Check is strongest at its core category and also carries features in SBOM Generation, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What OWASP Dependency-Check does well

• Free and open-source, the long-standing OWASP-flagship SCA tool with wide CI/build integrations (Maven, Gradle, Jenkins, SonarQube, GitHub Actions, Azure DevOps)
• Correlates dependencies to CVEs via CPE identifiers against the NVD, augmented by NPM Audit, OSS Index, RetireJS, and Bundler Audit data sources
• Self-hostable and fully offline-capable with a local NVD mirror, useful for air-gapped or privacy-sensitive builds
• Generates CycloneDX SBOM output and SARIF/HTML/JSON reports for downstream tooling

Where Vulnetix adds to it: OWASP Dependency-Check is a free single-purpose SCA scanner. Vulnetix ingests its SARIF/CycloneDX output and dedupes it with other scanners into one prioritised queue, then adds everything Dependency-Check lacks: exploit-intel prioritisation (EPSS, KEV, ESS, CWSS, LEV), reachability, versioned VEX with audit, autofix, EOL and SSVC policy, and a supply-chain package firewall. Vulnetix orchestrates on top rather than replacing the scanner.

No migration, no rip-and-replace. OWASP Dependency-Check keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise OWASP Dependency-Check results in Vulnetix

Upload OWASP Dependency-Check SARIF, CycloneDX, JSON, XML output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

OWASP Dependency-Check documentation ↗  ·  Source repository ↗

Wire OWASP Dependency-Check into your CI/CD pipeline →