OWASP Dependency-Check

• Category: sca (Java-focused)
• Fingerprint: cve-package-version-v1 (dedupes with Trivy, OSV)
• License: Apache-2.0

The gold standard for Java/Maven/Gradle SCA because of its deep CPE-matched NVD integration. Opt-in because the NVD database cache is ~1 GB and warm-up adds minutes to the first scan.

sca:
  dependency_check: { enabled: true }

Air-gapped mode

Point at an operator-provided NVD mirror via sca.dependency_check.nvd_endpoint. When set, the runner resolves every NVD lookup against the mirror instead of the public endpoint.

Cross-tool dedup

Dependency-Check findings carry SchemeCVEPackageVersion fingerprints. A Log4Shell finding reported by both Trivy and Dependency-Check shows up as a single row on the dashboard.

Common false positives

• CPE-match over-fires on generic package names (apache-httpd vs httpd). Override by adding a .dependency-check/suppressions.xml entry in the repo.