dependency-track

No entries match these filters. Clear filters

1. 5.1.1 Sep 20, 2026 · release notes

   Dependency-Track 5.1.1 adds a Snyk per-package endpoint toggle and refactors metrics computation.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 5.1.1 https://github.com/DependencyTrack/dependency-track.git
   # already have the repo? check out this version:
   $ git checkout 5.1.1

   • Adds an option to use Snyk's per-package endpoint when batching is not available

   1 detail in Everything

2. 4.14.4 Sep 14, 2026 · issue 074

   Dependency-Track 4.14.4 adds CycloneDX 1.7CycloneDX 1.7An OWASP-maintained Software Bill of Materials standard and schema; version 1.7 adds attestations and evidence fields, giving cyber tools a richer, machine-readable format for expressing supply-chain trust claims. support as its headline new capability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.14.4 https://github.com/DependencyTrack/dependency-track.git
   # already have the repo? check out this version:
   $ git checkout 4.14.4

   • Adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.7 support for ingesting and processing SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. in the new schema version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

3. 5.1.0 Aug 27, 2026 · issue 058

   Dependency-Track 5.1.0 adds KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. support, CycloneDX 1.7CycloneDX 1.7An OWASP-maintained Software Bill of Materials standard and schema; version 1.7 adds attestations and evidence fields, giving cyber tools a richer, machine-readable format for expressing supply-chain trust claims., Checkmarx SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., JVN data source, GitHub App auth, and compressed SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. uploads.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 5.1.0 https://github.com/DependencyTrack/dependency-track.git
   # already have the repo? check out this version:
   $ git checkout 5.1.0

   └──▷ TRY IT
   Upload a compressed SBOM and mark the project active in one API call — useful for CI pipelines that produce gzipped CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. BOMs.
   copy

   $ curl -X POST 'https://dtrack.example.com/api/v1/bom' \
     -H 'X-Api-Key: <api-key>' \
     -F 'autoCreate=true' \
     -F 'isActive=true' \
     -F 'projectName=my-app' \
     -F 'projectVersion=1.0.0' \
     -F 'bom=@bom.cdx.json.gz;type=application/gzip'

   • Adds isActive parameter to the BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. upload API endpoint, allowing projects to be marked active or inactive at upload time.
   • Adds REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints to view and trigger KEV (CISA Known Exploited VulnerabilitiesCISA Known Exploited VulnerabilitiesA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing CVEs confirmed to have been actively exploited in the wild, which cyber tools use as a high-signal prioritization feed for patching and scanning.) mirroring runs.
   • Exposes workflow run status on the BOM token polling endpoint.
   • Adds protobuf as a publishing option for webhook notifications.
   • Adds group_by parameter forwarding to DefectDojo (v5) integration.

   +20 more show less

   • Forwards analysis.detail to DefectDojo (v5) integration.
   • Supports compressed SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. (e.g. gzip) in multipart BOM uploads.
   • Implements initial KEV (CISA Known Exploited VulnerabilitiesKnown Exploited VulnerabilitiesCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.) support, including use in component and vulnerability policies and inclusion of the KEV flag in notifications.
   • Adds KEV dimension to time series metrics.
   • Adds VulnCheck KEV data source.
   • Adds Checkmarx SCA as a vulnerability analyser.
   • Adds CycloneDX 1.7 support.
   • Adds JVN (Japan Vulnerability Notes) as a vulnerability data source.
   • Adds GitHub App authentication for the GitHub Advisories mirror.
   • Supports AWS-managed credentials for S3 storage.
   • Adds component scope evaluation policy.
   • Extends distro-aware version matching with Red Hat support.
   • Applies OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. rating from VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. import.
   • Aligns VEX semantics with CISA guidance and tooling ecosystem.
   • Introduces package metadata resolution state tracking.
   • Adds server release version to the OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec info block.
   • Implements a banner backend for displaying configurable banners.
   • Makes the dex query timeout configurable.
   • Enforces a global database query timeout.
   • Optimizes portfolio-wide findings queries and improves activity task scheduling performance for deep backlogs.

   25 details in Everything

4. 5.0.5 Aug 24, 2026 · issue 055

   Dependency-Track 5.0.5 uses OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories.'s modified_id.csv list to speed up full archive downloads.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 5.0.5 https://github.com/DependencyTrack/dependency-track.git
   # already have the repo? check out this version:
   $ git checkout 5.0.5

5. 5.0.4 Jul 30, 2026 · issue 031

   Dependency-Track 5.0.4 adds configurable query timeouts and enforced execution timeouts for background workflow activities.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 5.0.4 https://github.com/DependencyTrack/dependency-track.git
   # already have the repo? check out this version:
   $ git checkout 5.0.4

   • Makes DEX query timeout configurable for tuning background task responsiveness.
   • Enforces execution timeouts for workflow activities with a defined default, preventing runaway background tasks.
   • Enables automatic heartbeating for long-running activities to prevent premature timeout detection.
   • Improves workflow task scheduling performance for deep backlogs using concurrency keys.
   • Executes multiple deletion batches per maintenance cycle, increasing throughput for cleanup operations.

   5 details in Everything

6. 4.14.3 Jul 20, 2026 · release notes

   Dependency Track 4.14.3 adds groupBy and analysis.detail to DefectDojo integration payloads

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.14.3 https://github.com/DependencyTrack/dependency-track.git
   # already have the repo? check out this version:
   $ git checkout 4.14.3

   • Adds groupBy parameter to DefectDojo integration to allow grouping findings
   • Includes analysis.detail in the DefectDojo finding payload for richer context

   2 details in Everything

7. 5.0.1 Jun 12, 2026 · release notes

   Backport v4-migrator TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. keepalive/socket timeout, out-of-order Flyway migrations, and non-UTC metrics support to 5.0.1

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 5.0.1 https://github.com/DependencyTrack/dependency-track.git
   # already have the repo? check out this version:
   $ git checkout 5.0.1

   • Backport: v4-migrator now supports TCP keepalive and optional socket timeout for better connection stability during migration.
   • Backport: Allow out-of-order execution of Flyway migrations to accommodate custom or delayed database schema changes.
   • Backport: Support non-UTC timezones for metrics operations, allowing accurate time-based metric calculations in any region.

   3 details in Everything

8. 5.0.0 Jun 7, 2026 · release notes

   Dependency-Track v5.0.0 introduces container-only distribution, drops H2/MySQL/SQL Server for PostgreSQL 14+, and updates the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 5.0.0 https://github.com/DependencyTrack/dependency-track.git
   # already have the repo? check out this version:
   $ git checkout 5.0.0

   • Mandates container-based distribution; WAR file deployment is no longer supported
   • Requires PostgreSQL 14+ for database storage; H2, MySQL, and SQL Server are dropped
   • Updates REST API to version 1 with changes to existing endpoints and schemas
   • Introduces new notification schemas for event notifications

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !WAR file deployment is removed; you must now use the container-only distribution
   • !H2, MySQL, and SQL Server database support is dropped; PostgreSQL 14+ is now required
9. 4.14.2 May 7, 2026 · release notes

   Dependency Track v4.14.2 adds project filters to component identity search and improves vuln data mirroring performance.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.14.2 https://github.com/DependencyTrack/dependency-track.git
   # already have the repo? check out this version:
   $ git checkout 4.14.2

   • Add project filters to component identity search allows scoping the search results by specific projects.

   1 detail in Everything

10. 4.14.1 Apr 3, 2026 · release notes

    Adds NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. and Composer versioning schemes, Sonatype Guide token support for OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. Index analyzer, and new operational policy criteria.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.14.1 https://github.com/DependencyTrack/dependency-track.git
    # already have the repo? check out this version:
    $ git checkout 4.14.1

    • Backport: Add support for NuGet versioning scheme
    • Backport: Add support for Composer versioning scheme
    • Backport: Support Sonatype Guide tokens for OSS Index analyzer
    • Backport: Add age and version distance to operational policy criteria

    4 details in Everything

11. 4.14.0 Mar 9, 2026 · release notes

    Adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. filtering to findings API, CVSSv4 support,VERS version matching, internal status policies, and configurable OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. Index base URL.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.14.0 https://github.com/DependencyTrack/dependency-track.git
    # already have the repo? check out this version:
    $ git checkout 4.14.0

    • GET /api/v1/finding/project/{uuid} accepts epss query parameter to filter by EPSS score
    • Adds CVSSv4 score parsing and display support in findings model
    • Adds VERS approach for PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously. version matching with VERSATILE
    • Internal status policy condition support for project lifecycle policies
    • Configurable base URL for OSS Index API via environment variable or config

    +1 more show less

    • Support for CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. Scope Data in BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. upload

    6 details in Everything

12. 4.13.6 Nov 17, 2025 · release notes

    Adds Alpine-based container variants for Dependency Track.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.13.6 https://github.com/DependencyTrack/dependency-track.git
    # already have the repo? check out this version:
    $ git checkout 4.13.6

13. advisory CVE-2025-61776 Oct 7, 2025 · issue 128
    • CVE-2025-61776: Possible disclosure of private NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. repository credentials to api.nuget.org (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.7, affects < 4.13.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
14. 4.13.5 Oct 7, 2025 · release notes

    OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. Index credentials now required; SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. license list updated to 3.27.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.13.5 https://github.com/DependencyTrack/dependency-track.git
    # already have the repo? check out this version:
    $ git checkout 4.13.5

15. 4.13.4 Aug 26, 2025 · release notes

    Backport migration to NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. 2.0 data feeds

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.13.4 https://github.com/DependencyTrack/dependency-track.git
    # already have the repo? check out this version:
    $ git checkout 4.13.4

    • Migrates the dependency analysis engine to use NVD 2.0 data feeds instead of the previous CVE data source format.

    1 detail in Everything

16. 4.13.0 Apr 7, 2025 · release notes

    Dependency Track 4.13 introduces collection projects, batchDelete API, scheduled notifications, and Snyk v2024-10-15 support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.13.0 https://github.com/DependencyTrack/dependency-track.git
    # already have the repo? check out this version:
    $ git checkout 4.13.0

    • Introduce collection projects for better usage of hierarchical view
    • Add /v1/project/batchDelete API method that deletes with SQL
    • Add support for Snyk API version 2024-10-15
    • Add feature to define the test title for DefectDojo integration
    • Implement basic telemetry collection

    +4 more show less

    • Add property to control verified flag in DefectDojo integration
    • Add support for scheduled summary notifications
    • Add lastVulnerabilityAnalysis to project
    • Add endpoint to mass-create tags

    9 details in Everything

17. advisory CVE-2025-27137 Feb 24, 2025 · issue 128
    • CVE-2025-27137: Local file inclusion via custom notification templates (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.4, affects < 4.12.6)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
18. advisory CVE-2024-54002 Dec 4, 2024 · issue 128
    • CVE-2024-54002: Enumeration of managed users via /api/v1/user/login endpoint (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects < 4.12.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
19. 4.12.0 Oct 1, 2024 · release notes

    Dependency Track 4.12.0 adds tag-based project filtering and bulk tagging REST endpoints to its cyber tooling

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.12.0 https://github.com/DependencyTrack/dependency-track.git
    # already have the repo? check out this version:
    $ git checkout 4.12.0

    • Add support for authors field in CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. BOMs
    • Support ingestion of CycloneDX v1.6 BOMs
    • Raise baseline Java version to 21
    • Migrate from Swagger v2 to OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. v3 specification
    • Add isLatest project flag and allow policies to be limited to latest version only

    +13 more show less

    • Add REST endpoint for tag retrieval (GET /api/v1/tag)
    • Add REST endpoints for bulk tagging & un-tagging of projects (POST /api/v1/projects/tags, DELETE /api/v1/projects/tags)
    • Add REST endpoint for tag deletion (DELETE /api/v1/tag/{uuid})
    • Add REST endpoints to tag and untag policies in bulk (POST /api/v1/policies/tags, DELETE /api/v1/policies/tags)
    • Enable string de-duplication JVMJVMThe Java Virtual Machine, a runtime maintained by Oracle (and implemented by others) that executes Java bytecode on any OS, giving cyber tools a portable, garbage-collected environment with a large ecosystem of libraries. option by default
    • Disable H2 database shutdown hook
    • Add support for configurable system-wide default locale
    • Support customizable welcome message on the login page
    • Support configuration of teams for portfolio ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. when creating a project
    • Add active field to Project Versions in API responses
    • Add option to test notification publisher via UI/API
    • Add Notification for BOM_VALIDATION_FAILED events
    • Enhance badge API to require authorization

    18 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The minimum supported Java version is now 21; older versions will fail to start.
    • !The /api/v1/tag/{policyUuid} endpoint is deprecated in favor of /api/v1/tag/policy/{uuid}.
    • !Badge API calls now require authorization; unauthenticated requests will fail.
20. advisory CVE-2024-38515 Jun 24, 2024 · issue 128
    • CVE-2024-38515: Possible XML External Entity injection via upload of CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. BOMs in XML format (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.4, affects >= 3.6.0, < 4.11.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
21. 4.11.4 Jun 24, 2024 · release notes

    Dependency Track 4.11.4 adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. v1.6 BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. ingestion support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.11.4 https://github.com/DependencyTrack/dependency-track.git
    # already have the repo? check out this version:
    $ git checkout 4.11.4

    • Adds support for ingesting CycloneDX v1.6 BOMs, enabling the service to process projects using the latest SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. specification.

    1 detail in Everything

22. 4.11.0 May 7, 2024 · release notes

    Dependency Track v4.11.0 adds SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. export, VulnDB aliases, and Trivy meta analyzers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.11.0 https://github.com/DependencyTrack/dependency-track.git
    # already have the repo? check out this version:
    $ git checkout 4.11.0

    • Generate a SARIF file containing project vulnerability findings via the new API endpoint
    • Look up vulnerabilities using VulnDB aliases (e.g., GHSA, OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees.-Fuzz IDs) in addition to standard CPEs/PURLs
    • Analyze Hackage and Nixpkgs dependencies by leveraging the new hackage and nixpkgs meta analyzers
    • Store computed severities in the database for persistence across restarts
    • Validate uploaded BOMs against the CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. schema during import

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Disable automatic API key generation for teams
    • !Truncate ComponentProperty value at 1024 characters
23. advisory CVE-2022-39351 Oct 11, 2022 · issue 128
    • CVE-2022-39351: Logging of API keys in clear text when handling API requests using keys with insufficient permissions (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.4, affects < 4.6.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
24. 4.3.0 Aug 2, 2021 · release notes

    Dependency-Track 4.3.0 introduces Project Component Metadata API, Open Policy Agent integration, and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. format enhancements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 4.3.0 https://github.com/DependencyTrack/dependency-track.git
    # already have the repo? check out this version:
    $ git checkout 4.3.0

    • Adds GET /api/v1/project/{uuid}/metadata endpoint to retrieve metadata for a project's components.
    • Adds new opa notification payload format and configuration option to integrate with Open Policy Agent for policy-based alerts.
    • Adds support for cyclonedx-vex SBOM format in import and export operations.

    3 details in Everything