Skip to content
SPECIFICTION
Get listed

OWASP Dependency-Track

dependencytrack.org

Free plan WebAPISelf-hosted
Visit dependencytrack.org
Spec score 7.7 #11 of 22 in SBOM Management Software

What it is

OWASP Dependency-Track is a free, self-hosted platform for managing software-component risk across a supply chain. It builds inventories from software bills of materials and identifies vulnerable components, supporting CycloneDX SBOM, HBOM, VEX, and VDR documents for ingestion, analysis, and production. Components can be matched against NVD, GitHub Advisories, OSV, OSS Index, Snyk, Trivy, and VulnDB, while integrated EPSS support helps prioritize mitigation. Integrity checks flag components when published hashes differ from those served by an upstream registry. A Common Expression Language policy engine evaluates component rules and can break a build when a policy fails. Alerts can be filtered by event fields and sent to Slack, Teams, Mattermost, email, or webhooks. API and web interfaces are available, with least-privilege portfolio access and single sign-on through OpenID Connect, Active Directory, and LDAP. Version 5.1 uses separate API and frontend container images, supports Kubernetes, and requires PostgreSQL.

Spec sheet

Purpose
Dependency-Track inventories software components from SBOMs, identifies vulnerabilities, and helps enforce policy across the software supply chain.Read 5 Oct 2026 · dependencytrack.org
Intended users
The platform is described as serving organizations from a single team to enterprise portfolios of hundreds of thousands of projects.Read 5 Oct 2026 · dependencytrack.org
Deployment
Version 5.1 is distributed as separate API server and frontend container images, and Kubernetes is supported.Read 5 Oct 2026 · dependencytrack.org
Integrations
Alerts can be routed to Slack, Teams, Mattermost, email, and webhooks, with filters based on event fields.Read 5 Oct 2026 · dependencytrack.org
Founded
2013Read 28 Sep 2026 · dependencytrack.org
Access and identity
The platform supports least-privilege portfolio access control and single sign-on via OpenID Connect, with Active Directory and LDAP.Read 5 Oct 2026 · dependencytrack.org
Community
The project directs users to community support through Slack, GitHub Discussions, a mailing list, and YouTube.Read 5 Oct 2026 · dependencytrack.org
Database requirement
Version 5 standardizes on PostgreSQL; H2, MySQL, and SQL Server are no longer supported.Read 5 Oct 2026 · dependencytrack.org
Integrity checks
It flags components whose published hashes diverge from those served by the upstream registry.Read 5 Oct 2026 · dependencytrack.org
Migration limit
Version 5 does not upgrade in place from 4.x; migration uses an offline, one-time migrator and requires a planned maintenance window.Read 5 Oct 2026 · dependencytrack.org
Policies
A Common Expression Language policy engine evaluates component policies and can break the build when a policy fails.Read 5 Oct 2026 · dependencytrack.org
Risk prioritization
Integrated EPSS support helps prioritize vulnerability mitigation.Read 5 Oct 2026 · dependencytrack.org
SBOM formats
It consumes, analyzes, and produces CycloneDX SBOM, HBOM, VEX, and VDR documents.Read 5 Oct 2026 · dependencytrack.org
Vulnerability intelligence
It matches components against the NVD, GitHub Advisories, OSV, OSS Index, Snyk, Trivy, and VulnDB.Read 5 Oct 2026 · dependencytrack.org

Plans and prices

Dependency-Track Free Free and open source under the Apache 2.0 license · Self-hosted deployment Read 5 Oct 2026 · dependencytrack.org

Every OWASP Dependency-Track plan and price →

Strong points and limits

Strong points

  • Free and open source under Apache 2.0
  • Processes and produces several SBOM-related document types
  • Matches components against multiple vulnerability sources
  • Policy engine can break failing builds
  • Supports Kubernetes and containerized API/frontend deployment

Limits

  • Version 5 requires PostgreSQL
  • No in-place upgrade from version 4.x
  • Migration requires an offline maintenance window
  • Self-hosted deployment is required

Who it suits

It suits teams and organizations managing software inventories, SBOMs, vulnerabilities, and policy across projects, from one team to large enterprise portfolios. Self-hosted deployment and API or web access fit organizations operating their own infrastructure.

Verdict

Dependency-Track combines SBOM inventory, vulnerability intelligence, integrity checks, policy evaluation, and notification routing in a self-hosted package. Version 5 users should plan PostgreSQL operations and an offline migration from 4.x.

Where Specifiction places it

Alternatives to OWASP Dependency-TrackAll alternatives →