https://cybertoolchain.io/tools/dependency-track New releases and features in dependency-track, tracked by The Cyber Toolchain. en Mon, 14 Sep 2026 11:19:52 GMT https://github.com/DependencyTrack/dependency-track/releases/tag/4.14.4 https://github.com/DependencyTrack/dependency-track/releases/tag/4.14.4 Mon, 14 Sep 2026 11:19:52 GMT Dependency-Track 4.14.4 adds CycloneDX 1.7 support as its headline new capability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds CycloneDX 1.7 support for ingesting and processing SBOMs in the new schema version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependency-track https://github.com/DependencyTrack/dependency-track/releases/tag/5.1.0 https://github.com/DependencyTrack/dependency-track/releases/tag/5.1.0 Thu, 27 Aug 2026 15:33:20 GMT Dependency-Track 5.1.0 adds KEV support, CycloneDX 1.7, Checkmarx SCA, JVN data source, GitHub App auth, and compressed SBOM uploads. • Adds `isActive` parameter to the BOM upload API endpoint, allowing projects to be marked active or inactive at upload time. • Adds REST API endpoints to view and trigger KEV (CISA Known Exploited Vulnerabilities) mirroring runs. • Exposes workflow run status on the BOM token polling endpoint. • Adds protobuf as a publishing option for webhook notifications. • Adds `group_by` parameter forwarding to DefectDojo (v5) integration. • Forwards `analysis.detail` to DefectDojo (v5) integration. • Supports compressed SBOMs (e.g. gzip) in multipart BOM uploads. • Implements initial KEV (CISA Known Exploited Vulnerabilities) support, including use in component and vulnerability policies and inclusion of the KEV flag in notifications. • Adds KEV dimension to time series metrics. • Adds VulnCheck KEV data source. • Adds Checkmarx SCA as a vulnerability analyser. • Adds CycloneDX 1.7 support. • Adds JVN (Japan Vulnerability Notes) as a vulnerability data source. • Adds GitHub App authentication for the GitHub Advisories mirror. • Supports AWS-managed credentials for S3 storage. • Adds component scope evaluation policy. • Extends distro-aware version matching with Red Hat support. • Applies OWASP rating from VEX import. • Aligns VEX semantics with CISA guidance and tooling ecosystem. • Introduces package metadata resolution state tracking. • Adds server release version to the OpenAPI spec info block. • Implements a banner backend for displaying configurable banners. • Makes the dex query timeout configurable. • Enforces a global database query timeout. • Optimizes portfolio-wide findings queries and improves activity task scheduling performance for deep backlogs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependency-track https://github.com/DependencyTrack/dependency-track/releases/tag/5.0.5 https://github.com/DependencyTrack/dependency-track/releases/tag/5.0.5 Mon, 24 Aug 2026 13:49:41 GMT Dependency-Track 5.0.5 uses OSV's `modified_id.csv` list to speed up full archive downloads. • Leverages OSV's `modified_id.csv` list to optimize full vulnerability archive downloads, reducing unnecessary data transfer. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependency-track https://github.com/DependencyTrack/dependency-track/releases/tag/5.0.4 https://github.com/DependencyTrack/dependency-track/releases/tag/5.0.4 Thu, 30 Jul 2026 16:59:52 GMT Dependency-Track 5.0.4 adds configurable query timeouts and enforced execution timeouts for background workflow activities. • Makes DEX query timeout configurable for tuning background task responsiveness. • Enforces execution timeouts for workflow activities with a defined default, preventing runaway background tasks. • Enables automatic heartbeating for long-running activities to prevent premature timeout detection. • Improves workflow task scheduling performance for deep backlogs using concurrency keys. • Executes multiple deletion batches per maintenance cycle, increasing throughput for cleanup operations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependency-track https://github.com/DependencyTrack/dependency-track/releases/tag/5.0.1 https://github.com/DependencyTrack/dependency-track/releases/tag/5.0.1 Fri, 12 Jun 2026 12:39:24 GMT Backport v4-migrator TCP keepalive/socket timeout, out-of-order Flyway migrations, and non-UTC metrics support to 5.0.1 • Backport: v4-migrator now supports TCP keepalive and optional socket timeout for better connection stability during migration. • Backport: Allow out-of-order execution of Flyway migrations to accommodate custom or delayed database schema changes. • Backport: Support non-UTC timezones for metrics operations, allowing accurate time-based metric calculations in any region. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependency-track https://github.com/DependencyTrack/dependency-track/releases/tag/5.0.0 https://github.com/DependencyTrack/dependency-track/releases/tag/5.0.0 Sun, 07 Jun 2026 15:32:21 GMT Dependency-Track v5.0.0 introduces container-only distribution, drops H2/MySQL/SQL Server for PostgreSQL 14+, and updates the REST API. • Mandates container-based distribution; WAR file deployment is no longer supported • Requires PostgreSQL 14+ for database storage; H2, MySQL, and SQL Server are dropped • Updates REST API to version 1 with changes to existing endpoints and schemas • Introduces new notification schemas for event notifications Breaking changes: • WAR file deployment is removed; you must now use the container-only distribution • H2, MySQL, and SQL Server database support is dropped; PostgreSQL 14+ is now required Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependency-track https://github.com/DependencyTrack/dependency-track/releases/tag/4.14.2 https://github.com/DependencyTrack/dependency-track/releases/tag/4.14.2 Thu, 07 May 2026 16:45:13 GMT Dependency Track v4.14.2 adds project filters to component identity search and improves vuln data mirroring performance. • `Add project filters to component identity search` allows scoping the search results by specific projects. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependency-track https://github.com/DependencyTrack/dependency-track/releases/tag/4.14.1 https://github.com/DependencyTrack/dependency-track/releases/tag/4.14.1 Fri, 03 Apr 2026 17:43:42 GMT Adds NuGet and Composer versioning schemes, Sonatype Guide token support for OSS Index analyzer, and new operational policy criteria. • Backport: Add support for NuGet versioning scheme • Backport: Add support for Composer versioning scheme • Backport: Support Sonatype Guide tokens for OSS Index analyzer • Backport: Add age and version distance to operational policy criteria Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependency-track https://github.com/DependencyTrack/dependency-track/releases/tag/4.14.0 https://github.com/DependencyTrack/dependency-track/releases/tag/4.14.0 Mon, 09 Mar 2026 22:05:03 GMT Adds EPSS filtering to findings API, CVSSv4 support,VERS version matching, internal status policies, and configurable OSS Index base URL. • `GET /api/v1/finding/project/{uuid}` accepts `epss` query parameter to filter by EPSS score • Adds `CVSSv4` score parsing and display support in findings model • Adds VERS approach for PURL version matching with VERSATILE • Internal status policy condition support for project lifecycle policies • Configurable base URL for OSS Index API via environment variable or config • Support for CycloneDX Scope Data in BOM upload Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependency-track https://github.com/DependencyTrack/dependency-track/releases/tag/4.13.6 https://github.com/DependencyTrack/dependency-track/releases/tag/4.13.6 Mon, 17 Nov 2025 08:43:39 GMT Adds Alpine-based container variants for Dependency Track. • Adds Alpine-based container variants for Dependency Track Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependency-track https://github.com/DependencyTrack/dependency-track/releases/tag/4.13.5 https://github.com/DependencyTrack/dependency-track/releases/tag/4.13.5 Tue, 07 Oct 2025 14:54:24 GMT OSS Index credentials now required; SPDX license list updated to 3.27.0 • Bump SPDX license list to 3.27.0 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependency-track https://github.com/DependencyTrack/dependency-track/releases/tag/4.13.4 https://github.com/DependencyTrack/dependency-track/releases/tag/4.13.4 Tue, 26 Aug 2025 10:01:24 GMT Backport migration to NVD 2.0 data feeds • Migrates the dependency analysis engine to use NVD 2.0 data feeds instead of the previous CVE data source format. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependency-track https://github.com/DependencyTrack/dependency-track/releases/tag/4.13.0 https://github.com/DependencyTrack/dependency-track/releases/tag/4.13.0 Mon, 07 Apr 2025 09:32:51 GMT Dependency Track 4.13 introduces collection projects, batchDelete API, scheduled notifications, and Snyk v2024-10-15 support • Introduce 'collection' projects for better usage of hierarchical view • Add `/v1/project/batchDelete` API method that deletes with SQL • Add support for Snyk API version `2024-10-15` • Add feature to define the test title for DefectDojo integration • Implement basic telemetry collection • Add property to control `verified` flag in DefectDojo integration • Add support for scheduled summary notifications • Add `lastVulnerabilityAnalysis` to project • Add endpoint to mass-create tags Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependency-track https://github.com/DependencyTrack/dependency-track/releases/tag/4.12.0 https://github.com/DependencyTrack/dependency-track/releases/tag/4.12.0 Tue, 01 Oct 2024 20:44:10 GMT Dependency Track 4.12.0 adds tag-based project filtering and bulk tagging REST endpoints to its cyber tooling • Add support for `authors` field in CycloneDX BOMs • Support ingestion of CycloneDX v1.6 BOMs • Raise baseline Java version to 21 • Migrate from Swagger v2 to OpenAPI v3 specification • Add `isLatest` project flag and allow policies to be limited to latest version only • Add REST endpoint for tag retrieval (`GET /api/v1/tag`) • Add REST endpoints for bulk tagging & un-tagging of projects (`POST /api/v1/projects/tags`, `DELETE /api/v1/projects/tags`) • Add REST endpoint for tag deletion (`DELETE /api/v1/tag/{uuid}`) • Add REST endpoints to tag and untag policies in bulk (`POST /api/v1/policies/tags`, `DELETE /api/v1/policies/tags`) • Enable string de-duplication JVM option by default • Disable H2 database shutdown hook • Add support for configurable system-wide default locale • Support customizable welcome message on the login page • Support configuration of teams for portfolio ACL when creating a project • Add `active` field to Project Versions in API responses • Add option to test notification publisher via UI/API • Add Notification for `BOM_VALIDATION_FAILED` events • Enhance badge API to require authorization Breaking changes: • The minimum supported Java version is now 21; older versions will fail to start. • The `/api/v1/tag/{policyUuid}` endpoint is deprecated in favor of `/api/v1/tag/policy/{uuid}`. • Badge API calls now require authorization; unauthenticated requests will fail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependency-track https://github.com/DependencyTrack/dependency-track/releases/tag/4.11.4 https://github.com/DependencyTrack/dependency-track/releases/tag/4.11.4 Mon, 24 Jun 2024 09:37:06 GMT Dependency Track 4.11.4 adds CycloneDX v1.6 BOM ingestion support • Adds support for ingesting CycloneDX v1.6 BOMs, enabling the service to process projects using the latest SBOM specification. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependency-track https://github.com/DependencyTrack/dependency-track/releases/tag/4.11.0 https://github.com/DependencyTrack/dependency-track/releases/tag/4.11.0 Tue, 07 May 2024 14:15:12 GMT Dependency Track v4.11.0 adds SARIF export, VulnDB aliases, and Trivy meta analyzers • Generate a SARIF file containing project vulnerability findings via the new API endpoint • Look up vulnerabilities using VulnDB aliases (e.g., GHSA, OSS-Fuzz IDs) in addition to standard CPEs/PURLs • Analyze Hackage and Nixpkgs dependencies by leveraging the new hackage and nixpkgs meta analyzers • Store computed severities in the database for persistence across restarts • Validate uploaded BOMs against the CycloneDX schema during import Breaking changes: • Disable automatic API key generation for teams • Truncate `ComponentProperty` value at 1024 characters Full history on Cyber Toolchain: https://cybertoolchain.io/tools/dependency-track