OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
Java · active 2025-02-18 → 2026-08-04 (UTC)
Activity over time
Daily event counts in the loaded window
Line chart, 533 days from 2025-02-18 to 2026-08-04. Pushes: 356 total, peak 8 in a day. Pull requests: 524 total, peak 12 in a day. Issues: 568 total, peak 37 in a day. Comments: 1,076 total, peak 50 in a day. Stars: 347 total, peak 6 in a day.
- Pushes
- Pull requests
- Issues
- Comments
- Stars
Stars, PRs, issues and forks are under-captured in the later part of this window. GH Archive progressively stopped capturing non-push events during 2026 — −95% or worse by the end of the window. Every series here except Pushes fades for that reason, so a decline above reflects the archive, not this repository. Pushes stay reliable throughout, so read them, and the contributor counts derived from them, as the real signal. Data health has the measurements.
Top contributors
Pushes, PRs, issues, reviews and comments — stars and forks excluded, so this is contribution rather than popularity
| Contributor | Contributions | Pushes | PRs | Comments |
|---|---|---|---|---|
| jeremylong | 563 | 152 | 90 | 167 |
| chadlwilson | 504 | 0 | 28 | 263 |
| github-actions[bot] | 317 | 96 | 0 | 165 |
| dependabot[bot] | 300 | 2 | 281 | 17 |
| nhumblot | 154 | 81 | 8 | 12 |
| aikebah | 142 | 20 | 16 | 72 |
| boring-cyborg[bot] | 65 | 0 | 65 | 0 |
| Copilot | 63 | 1 | 5 | 41 |
| marcelstoer | 53 | 0 | 0 | 35 |
| OrangeDog | 17 | 0 | 2 | 9 |
| Umesh042005 | 15 | 0 | 2 | 13 |
| abhishek171287 | 13 | 0 | 0 | 0 |
| SachinAditya | 13 | 0 | 1 | 11 |
| cor3000 | 10 | 0 | 0 | 4 |
| radanliev | 9 | 0 | 0 | 0 |
| GALHP | 8 | 0 | 0 | 5 |
| evgeniiworkst | 8 | 0 | 1 | 7 |
| va699 | 7 | 0 | 0 | 3 |
| patpatpat123 | 7 | 0 | 0 | 5 |
| waileong | 7 | 0 | 0 | 0 |
Recent activity
Latest issues, pull requests and releases
- Pull request#8710dependabot[bot]2026-08-04 01:23
- Issue#8702chadlwilson2026-08-03 14:10Unrecognized option: --disableRetireJS
- Pull request#8670OrangeDog2026-07-29 11:51
- Issue comment#8639jeremylong2026-06-30 01:47CVE-2019-10219: executable affected-version evidence for dependency-check
- Issue#8613github-actions[bot]2026-06-16 05:43[FP]: CVE-2026-2587, CVE-2026-2586 and CVE-2024-9329 in relaxng-datatype@4.0.9
- Issue#8609dangkhoaphung2026-06-12 12:12Dependency vulnerability scan does not report CVE-2026-40973, but reports newer CVE-2026-4258
- Issue#8608dangkhoaphungvkey2026-06-12 12:07Dependency vulnerability scan does not report CVE-2026-40973, but reports newer CVE-2026-4258
- Issue comment#8599github-actions[bot]2026-06-12 09:16[FP]: Apache Camel Karaf OSGI Bundle Misidentified as Apache Karaf 3.22.4
- Issue comment#8605github-actions[bot]2026-06-12 04:53[FP]: jakarta nosql confused for jakarta mail
- Issue#8589chadlwilson2026-06-12 04:47[FP]: The scanner flags older CVEs in fixed camel version 3.22.4
- Issue comment#8597github-actions[bot]2026-06-11 18:29[FP]: Enterprise Shaded Jar Misidentified as Apache Camel 1.x
- Pull request#8586dependabot[bot]2026-06-10 01:23
- Pull request#8586dependabot[bot]2026-06-10 01:23
- Issue comment#8567bjansen2026-06-04 09:38fix: resolve overridden plugin dependencies correctly (#8570)
- Pull request#8546dependabot[bot]2026-05-30 11:47
- Pull request#8545dependabot[bot]2026-05-30 11:47
- Pull request#8555dependabot[bot]2026-05-28 01:51
- Pull request#8555dependabot[bot]2026-05-28 01:51
- Pull request#8546dependabot[bot]2026-05-25 01:41
- Issue#8515chadlwilson2026-05-24 07:35DC generates pkg:generic purls for nuget packages instead of pkg:nuget
- Issue comment#8497chadlwilson2026-05-23 17:17[FP]: CVE-2026-42154 matched against Micrometer instead of Prometheus
- Issue#8534chadlwilson2026-05-23 17:12[FP]: com.microsoft.kiota/microsoft-kiota-serialization-text matching microsoft:kiota CPE
- Issue comment#8523dependabot[bot]2026-05-22 06:21build(deps): bump org.junit:junit-bom from 5.14.3 to 6.1.0
- Issue#8537labkey-tchad2026-05-21 18:12[FP]: com.microsoft.kiota/microsoft-kiota-serialization-form matching microsoft:kiota CPE
- Issue#8537labkey-tchad2026-05-21 18:12[FP]: com.microsoft.kiota/microsoft-kiota-serialization-form matching microsoft:kiota CPE
Totals cover only the window loaded into ClickHouse and count events, not GitHub's lifetime totals — 347 stars here means stars gained during the window, not the repo's star count.