Is atlassian/bitbucket-dependency-scanner now dead?

[Paul S]

I found a project using this pipe failed to identify vulnerabilities whereas the OWASP dependency checker did identify. 

Is this pipe no longer supported?

[Aditya Srivastav]

Hi Paul,

The pipe does not appear to be dead or discontinued. The atlassian/bitbucket-dependency-scanner pipe was still being actively updated, with version 0.7.0 released in March 2025, and a 0.8.0 version was in use in December 2025.

Regarding the difference with OWASP Dependency-Check, the two scanners don't necessarily produce identical results. The Bitbucket pipe is based on OWASP Dependency-Check, but what it detects can depend on the dependency files/artifacts actually available to the scanner.

There is a particularly relevant example from another Community post: with Maven projects, the pipe may not detect vulnerabilities from the pom.xml directly; the project needs to be built first so the required JARs are available for scanning.

So a missed vulnerability does not by itself indicate that the pipe is unsupported. I'd first check that the dependency scanner is being run against the same resolved dependencies/artifacts that your OWASP scan is analyzing.

The Atlassian repository for the pipe is still available here: atlassian/bitbucket-dependency-scanner.