Question: how owasp dependency check works?
Answer: Dependency-Check works by collecting Evidence in the form of vendor, product, and version information, from files scanned by its Analyzers. Evidence is assigned a confidence level of low, medium, high, or highest according to its reliability. Currently, Dependency-Check gathers this information from the Manifest, pom.