No. 41 of 65 ·Software Composition Analysis Software

OWASP Dependency-Track

Web · Self-hosted · API

Freedom report

One barScore 5.2

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely1 of 6 device platforms
DocumentedThinly documented

OWASP Dependency-Track is ranked #41 of 65 in software composition analysis software on Freedom251. It runs on API, Self-hosted, Web. There is a free plan.

OWASP Dependency-Track plans and pricing

All plans

Dependency-Track Free Free and open source under the Apache 2.0 license · Self-hosted deployment dependencytrack.org · 5 Oct 2026

Compared on software composition analysis software

Free plan: Yes

Best OWASP Dependency-Track alternatives

See all 20

Two bars Snyk Open Source Free tier No. 1$25/mo6.7 Two bars Sonatype Nexus Repository Free tier No. 2$162.50/mo6.7 Two bars Accessibility Test Framework for Android Free tier No. 3Free6.6 Two bars Docker Desktop Free tier No. 4$9/mo6.6 Two bars Endor Labs Free tier No. 5Free6.6 Two bars Socket Free tier No. 6$25/mo6.6

The record

Purpose: Dependency-Track inventories software components from SBOMs, identifies vulnerabilities, and helps enforce policy across the software supply chain.
SBOM formats: It consumes, analyzes, and produces CycloneDX SBOM, HBOM, VEX, and VDR documents.
Vulnerability intelligence: It matches components against the NVD, GitHub Advisories, OSV, OSS Index, Snyk, Trivy, and VulnDB.
Risk prioritization: Integrated EPSS support helps prioritize vulnerability mitigation.
Integrity checks: It flags components whose published hashes diverge from those served by the upstream registry.
Policies: A Common Expression Language policy engine evaluates component policies and can break the build when a policy fails.
Integrations: Alerts can be routed to Slack, Teams, Mattermost, email, and webhooks, with filters based on event fields.
Access and identity: The platform supports least-privilege portfolio access control and single sign-on via OpenID Connect, with Active Directory and LDAP.
Deployment: Version 5.1 is distributed as separate API server and frontend container images, and Kubernetes is supported.
Database requirement: Version 5 standardizes on PostgreSQL; H2, MySQL, and SQL Server are no longer supported.
Migration limit: Version 5 does not upgrade in place from 4.x; migration uses an offline, one-time migrator and requires a planned maintenance window.
Intended users: The platform is described as serving organizations from a single team to enterprise portfolios of hundreds of thousands of projects.
Community: The project directs users to community support through Slack, GitHub Discussions, a mailing list, and YouTube.
Founded: 2013
Price from: Free

Where it ranks on Freedom251

Best Software Composition Analysis Software in 2026#41 of 65
Best Dependency Management Software in 2026#20 of 25
Best SBOM Management Software in 2026#20 of 22

Is OWASP Dependency-Track yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OWASP Dependency-Track

Sources

dependencytrack.org· checked 5 Oct 2026
dependencytrack.org/features/· checked 5 Oct 2026
dependencytrack.org/download/· checked 5 Oct 2026