Alternatives to Dependency-Check
OWASP scanner that finds known vulnerabilities in a project's dependencies. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Dependency-Check
OWASP scanner that finds known vulnerabilities in a project's dependencies.
Replacements
Listings that take over the same core job as Dependency-Check.
OSV-Scanner
Check project dependencies against the OSV vulnerability database.
OSV-Scanner checks dependencies against the OSV database across multiple ecosystems instead of CPE matching against NVD, so it avoids the NVD API key and long download.
Grype
Find known vulnerabilities in container images and filesystems.
Grype scans container images, filesystems and SBOMs for known vulnerabilities, extending beyond project dependencies, and is licensed Apache-2.0 like Dependency-Check.
Trivy
Scan software and infrastructure for known security issues.
Trivy scans containers, filesystems and configuration as well as dependencies, so one tool covers infrastructure checks too, under the same Apache-2.0 license.
Dependency-Track
Track component risk using software bills of materials.
Dependency-Track is a self-hosted web platform that tracks component risk centrally from software bills of materials rather than a scanner run inside each build.
Similar software
Related functionality, not a direct replacement.
Syft
Generate software bills of materials from images and files.
DefectDojo
An open source, self-hosted vulnerability management platform that collects and tracks findings from security scanners.
Semgrep
Find code patterns and potential problems with static analysis.
Gitleaks
Scans Git repositories, files and pipelines for leaked secrets.
TruffleHog
Find exposed credentials in repositories and other data sources.
Checkov
Scan infrastructure code for configuration problems.
