- Home
- SBOM Management Software
- OWASP Dependency-Track
OWASP Dependency-Track
What it is
OWASP Dependency-Track is a free, open-source platform for managing software supply-chain risk from a self-hosted API and web interface. It builds component inventories from software bills of materials, identifies vulnerabilities, and evaluates policy across projects. The platform consumes, analyzes, and produces CycloneDX SBOM, HBOM, VEX, and VDR documents. It matches components with vulnerability information from the NVD, GitHub Advisories, OSV, OSS Index, Snyk, Trivy, and VulnDB, while EPSS support helps prioritize mitigation. Integrity checks flag components when published hashes differ from upstream registry hashes. A Common Expression Language policy engine can break builds when rules fail. Alerts can reach Slack, Teams, Mattermost, email, and webhooks. Access controls support least-privilege portfolios, with OpenID Connect, Active Directory, and LDAP options. Version 5.1 uses separate API and frontend containers and supports Kubernetes. Version 5 requires PostgreSQL.
For and against
For
- Free and open source
- Broad SBOM document support
- Multiple vulnerability intelligence sources
- Policy engine can break builds
- Slack, Teams, and webhook alerts
Against
- Requires self-hosted deployment
- Version 5 requires PostgreSQL
- No in-place upgrade from 4.x
- Migration needs planned maintenance
The verdict
Dependency-Track combines SBOM inventory, vulnerability matching, policy enforcement, and alert routing in a self-hosted package. Its PostgreSQL requirement and migration process are important planning considerations for existing installations.
Who it suits
It suits development and security teams managing software components across projects, from one team to enterprise portfolios. Self-hosting users needing SBOM and vulnerability workflows may find it appropriate.
Plans and prices
Dependency-Track
Free and open source under the Apache 2.0 license · Self-hosted deployment
Read 5 Oct 2026 · dependencytrack.org
On the record
- Access and identity
- The platform supports least-privilege portfolio access control and single sign-on via OpenID Connect, with Active Directory and LDAP.dependencytrack.org · read 5 Oct 2026
- Community
- The project directs users to community support through Slack, GitHub Discussions, a mailing list, and YouTube.dependencytrack.org · read 5 Oct 2026
- Database requirement
- Version 5 standardizes on PostgreSQL; H2, MySQL, and SQL Server are no longer supported.dependencytrack.org · read 5 Oct 2026
- Deployment
- Version 5.1 is distributed as separate API server and frontend container images, and Kubernetes is supported.dependencytrack.org · read 5 Oct 2026
- Integrations
- Alerts can be routed to Slack, Teams, Mattermost, email, and webhooks, with filters based on event fields.dependencytrack.org · read 5 Oct 2026
- Integrity checks
- It flags components whose published hashes diverge from those served by the upstream registry.dependencytrack.org · read 5 Oct 2026
- Intended users
- The platform is described as serving organizations from a single team to enterprise portfolios of hundreds of thousands of projects.dependencytrack.org · read 5 Oct 2026
- Migration limit
- Version 5 does not upgrade in place from 4.x; migration uses an offline, one-time migrator and requires a planned maintenance window.dependencytrack.org · read 5 Oct 2026
- Policies
- A Common Expression Language policy engine evaluates component policies and can break the build when a policy fails.dependencytrack.org · read 5 Oct 2026
- Purpose
- Dependency-Track inventories software components from SBOMs, identifies vulnerabilities, and helps enforce policy across the software supply chain.dependencytrack.org · read 5 Oct 2026
- Risk prioritization
- Integrated EPSS support helps prioritize vulnerability mitigation.dependencytrack.org · read 5 Oct 2026
- SBOM formats
- It consumes, analyzes, and produces CycloneDX SBOM, HBOM, VEX, and VDR documents.dependencytrack.org · read 5 Oct 2026
- Vulnerability intelligence
- It matches components against the NVD, GitHub Advisories, OSV, OSS Index, Snyk, Trivy, and VulnDB.dependencytrack.org · read 5 Oct 2026
