OWASP Dependency-Track

What OWASP Dependency-Track is

OWASP Dependency-Track is a free, open-source platform for managing software supply-chain risk. It creates inventories from software bills of materials, identifies vulnerable components, and evaluates policies across projects. It consumes, analyzes, and produces CycloneDX SBOM, HBOM, VEX, and VDR documents. Component matching draws on the NVD, GitHub Advisories, OSV, OSS Index, Snyk, Trivy, and VulnDB, while integrated EPSS support helps teams prioritize vulnerability mitigation. Integrity checks can flag components when published hashes differ from those served by the upstream registry. A Common Expression Language policy engine evaluates component policies and can break a build when a policy fails. Alerts can be sent to Slack, Teams, Mattermost, email, or webhooks, with filters based on event fields. Least-privilege portfolio access control and single sign-on through OpenID Connect, Active Directory, and LDAP support controlled access. Dependency-Track is self-hosted, with API and web interfaces. Version 5.1 is distributed as separate API server and frontend container images, and Kubernetes is supported. The project describes use across organizations ranging from a single team to enterprise portfolios of hundreds of thousands of projects.

Who it suits

Dependency-Track suits development and security teams that need to inventory software components from SBOMs, track vulnerabilities, and enforce supply-chain policies. Its stated scale spans single teams through organizations managing very large project portfolios, while self-hosting gives teams responsibility for deployment and database operations.

Limits

The free plan is self-hosted. Version 5 requires PostgreSQL and no longer supports H2, MySQL, or SQL Server. Version 5 does not upgrade in place from 4.x; migration uses an offline one-time migrator and requires a planned maintenance window.

Getting started

1. Visit the Dependency-Track website.
2. Use the self-hosted deployment model under the Apache 2.0 license.
3. For version 5.1, deploy the separate API server and frontend container images.
4. Use PostgreSQL for version 5; Kubernetes is supported.

Verdict

Choose Dependency-Track if you want a free, self-hosted platform to inventory SBOM components, identify vulnerabilities, and apply policies across projects. Its integrations, access controls, and policy engine support automated supply-chain workflows. Teams moving from version 4.x should plan for an offline migration and maintenance window, and version 5 requires PostgreSQL.