OWASP Dependency-Track

Visit Website

Introduction

OWASP Dependency-Track is an intelligent component analysis platform that helps organisations identify and reduce risk in the software supply chain. It is built around the Software Bill of Materials (SBOM): you upload SBOMs for your projects and it continuously analyses the components inside them. The project is Apache-2.0 with about 4,400 GitHub stars.

Unlike a one-off scanner run in CI, Dependency-Track keeps a portfolio-wide inventory. When a new vulnerability is published, it can tell you which projects and versions include the affected component, without re-running builds.

Version note: Dependency-Track v5 is now the main line. The README says v4 is in maintenance mode on the 4.14.x branch and will reach end-of-life in December 2026, about six months after v5 general availability, with a migration guide provided.

In the quality loop, Dependency-Track spans release and production: CI pipelines upload SBOMs at build time, and the platform keeps watching those components after release.

Features

1. SBOM ingestion: Upload SBOMs (CycloneDX) from builds via API or UI.
2. Portfolio inventory: See every component across every project and version.
3. Continuous analysis: New advisories are matched against existing inventories.
4. Multiple vulnerability sources: Aggregates several intelligence sources; see the docs for the current list.
5. Policy engine: Define security, licence and operational policies.
6. Notifications: Alerts to chat, email and webhooks.
7. REST API: Automate uploads and queries from CI.
8. Docker Compose quickstart: Run a local instance in minutes, per the README.

Pros

1. Portfolio view: Answers ‘where are we affected?’ quickly.
2. Free and OWASP: Apache-2.0, community-governed.
3. SBOM-first: Fits supply-chain and regulatory requirements.
4. Continuous: Does not depend on rebuilds.
5. Active: Commits in November 2026.

Cons

1. Self-hosted: You run and maintain the server and database.
2. Requires SBOM generation: Builds must produce SBOMs (for example with Syft or CycloneDX plugins).
3. Migration effort: v4 users need to plan the v5 migration before v4 end-of-life.
4. Triage load: Large portfolios produce many findings.
5. Learning curve: Policies and integrations take setup.

Usage and Links (Example)

Run the Quickstart with Docker Compose from the documentation, then upload an SBOM from CI:

syft my-image:latest -o cyclonedx-json > sbom.json
curl -X POST "$DT_URL/api/v1/bom" \
  -H "X-Api-Key: $DT_API_KEY" \
  -F "projectName=my-app" -F "projectVersion=1.2.0" -F "autoCreate=true" \
  -F "bom=@sbom.json"

Tips: upload an SBOM for every release, set policies for critical vulnerabilities and disallowed licences, and route notifications to the owning team.

Resources:

• Dependency-Track website
• Documentation
• GitHub repository

Pricing

Dependency-Track is free and open source under Apache-2.0. Hosting is your own cost.

Recommended for?

1. Organisations with many applications needing a supply-chain inventory.
2. Teams with SBOM requirements from customers or regulators.
3. Security teams responding to newly disclosed vulnerabilities.
4. Not a fit if you only need a single CI scan; use OSV-Scanner or Trivy.

Conclusion

Dependency-Track turns SBOMs into a living, portfolio-wide view of component risk.

Plan for hosting and SBOM generation, and if you are on v4, schedule the move to v5.