{
  "history": [
    {
      "added": 0,
      "commit": "e6c887c0207baeec1f1346e28bf90000b4b45eda",
      "date": "2026-11-01",
      "dependencies": 212,
      "errors": [],
      "fixable": 0,
      "go_version": null,
      "in_binary": null,
      "new_vulnerabilities": 0,
      "osv_confirmed": 0,
      "osv_only": 0,
      "ref": "5.2.1",
      "release_changed": false,
      "release_integrity": "no-linux-binary",
      "removed": 0,
      "resolved_vulnerabilities": 0,
      "scorecard": 7.5,
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 0,
        "High": 0,
        "Low": 0,
        "Medium": 0,
        "Negligible": 0,
        "Unknown": 0
      },
      "workflow": {
        "High": 0,
        "Low": 0,
        "Medium": 0,
        "files": 15
      }
    },
    {
      "added": 0,
      "commit": "e6c887c0207baeec1f1346e28bf90000b4b45eda",
      "date": "2026-11-02",
      "dependencies": 211,
      "errors": [],
      "fixable": 0,
      "go_version": null,
      "in_binary": null,
      "kev": null,
      "kev_new": 0,
      "new_vulnerabilities": 0,
      "osv_confirmed": 0,
      "osv_only": 0,
      "ref": "5.2.1",
      "release_changed": false,
      "release_integrity": "no-linux-binary",
      "removed": 1,
      "resolved_vulnerabilities": 0,
      "scorecard": 7.5,
      "scorecard_date": "2026-10-26",
      "scorecard_note": null,
      "scorecard_source": "openssf-api",
      "upgraded": 0,
      "vulnerabilities": {
        "Critical": 0,
        "High": 0,
        "Low": 0,
        "Medium": 0,
        "Negligible": 0,
        "Unknown": 0
      },
      "vulnerable_packages": 0,
      "workflow": {
        "High": 0,
        "Low": 0,
        "Medium": 0,
        "files": 15
      }
    }
  ],
  "latest": {
    "archived": false,
    "category": "Software Composition Analysis (SCA)",
    "changes": {
      "added": [],
      "any": true,
      "baseline": false,
      "integrity_drift": 0,
      "license_changes": [
        {
          "from": [
            "Apache-2.0"
          ],
          "package": "test-database-support",
          "to": []
        }
      ],
      "new_vulnerabilities": [],
      "previous_ref": "5.2.1",
      "release_changed": false,
      "removed": [
        "junit-jupiter-api@UNKNOWN"
      ],
      "resolved_vulnerabilities": [],
      "upgraded": [],
      "workflow_new": 0,
      "workflow_resolved": 0
    },
    "commit": "e6c887c0207baeec1f1346e28bf90000b4b45eda",
    "compliance": {
      "overall_score": 55,
      "standards": {
        "bsi_tr03183": {
          "failed_checks": [
            "Component Creator",
            "Distribution Licences",
            "SHA-512 Hash",
            "Dependency Relationship",
            "SBOM Creator Contact"
          ],
          "passed": 4,
          "score": 44,
          "total": 9
        },
        "cisa": {
          "failed_checks": [
            "Software Producer",
            "Dependency Relationship",
            "License Information",
            "Component Hash",
            "SBOM Author"
          ],
          "passed": 5,
          "score": 50,
          "total": 10
        },
        "ntia": {
          "failed_checks": [
            "Supplier Name",
            "Dependency Relationship"
          ],
          "passed": 5,
          "score": 71,
          "total": 7
        }
      }
    },
    "components": [
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci-build.yaml",
        "name": "$/.github/workflows/_meta-build.yaml",
        "purl": "pkg:github/%24/.github#workflows/_meta-build.yaml",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/_meta-build.yaml",
        "name": "actions/attest",
        "purl": "pkg:github/actions/attest@v4.2.2",
        "version": "v4.2.2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/_meta-build.yaml",
        "name": "actions/cache/restore",
        "purl": "pkg:github/actions/cache@v6.1.0#restore",
        "version": "v6.1.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/_meta-build.yaml",
        "name": "actions/cache/save",
        "purl": "pkg:github/actions/cache@v6.1.0#save",
        "version": "v6.1.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/_meta-build.yaml",
        "name": "actions/checkout",
        "purl": "pkg:github/actions/checkout@v7.0.1",
        "version": "v7.0.1"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/_meta-build.yaml",
        "name": "actions/download-artifact",
        "purl": "pkg:github/actions/download-artifact@v8.0.2",
        "version": "v8.0.2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci-issue-template.yml",
        "name": "actions/github-script",
        "purl": "pkg:github/actions/github-script@v9.0.0",
        "version": "v9.0.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/_meta-build.yaml",
        "name": "actions/setup-java",
        "purl": "pkg:github/actions/setup-java@v6.0.1",
        "version": "v6.0.1"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/_meta-build.yaml",
        "name": "actions/upload-artifact",
        "purl": "pkg:github/actions/upload-artifact@v7.0.2",
        "version": "v7.0.2"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci-lint.yaml",
        "name": "bufbuild/buf-breaking-action",
        "purl": "pkg:github/bufbuild/buf-breaking-action@v1.1.4",
        "version": "v1.1.4"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci-lint.yaml",
        "name": "bufbuild/buf-lint-action",
        "purl": "pkg:github/bufbuild/buf-lint-action@v1.1.1",
        "version": "v1.1.1"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci-lint.yaml",
        "name": "bufbuild/buf-setup-action",
        "purl": "pkg:github/bufbuild/buf-setup-action@v1.50.0",
        "version": "v1.50.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci-test-pr-coverage.yml",
        "name": "codacy/codacy-coverage-reporter-action",
        "purl": "pkg:github/codacy/codacy-coverage-reporter-action@v1.3.0",
        "version": "v1.3.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/_meta-build.yaml",
        "name": "docker/build-push-action",
        "purl": "pkg:github/docker/build-push-action@v7.4.0",
        "version": "v7.4.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/_meta-build.yaml",
        "name": "docker/login-action",
        "purl": "pkg:github/docker/login-action@v4.6.0",
        "version": "v4.6.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/_meta-build.yaml",
        "name": "docker/setup-buildx-action",
        "purl": "pkg:github/docker/setup-buildx-action@v4.4.1",
        "version": "v4.4.1"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/_meta-build.yaml",
        "name": "docker/setup-qemu-action",
        "purl": "pkg:github/docker/setup-qemu-action@v4.4.0",
        "version": "v4.4.0"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci-codeql.yaml",
        "name": "github/codeql-action/analyze",
        "purl": "pkg:github/github/codeql-action@v4.38.3#analyze",
        "version": "v4.38.3"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci-codeql.yaml",
        "name": "github/codeql-action/init",
        "purl": "pkg:github/github/codeql-action@v4.38.3#init",
        "version": "v4.38.3"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/mirror-container-image.yml",
        "name": "imjasonh/setup-crane",
        "purl": "pkg:github/imjasonh/setup-crane@v0.7",
        "version": "v0.7"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci-lint.yaml",
        "name": "oasdiff/oasdiff-action/breaking",
        "purl": "pkg:github/oasdiff/oasdiff-action@v0.1.18#breaking",
        "version": "v0.1.18"
      },
      {
        "ecosystem": "github",
        "licenses": [],
        "location": ".github/workflows/ci-lint.yaml",
        "name": "zizmorcore/zizmor-action",
        "purl": "pkg:github/zizmorcore/zizmor-action@v0.6.4",
        "version": "v0.6.4"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "ae-security",
        "purl": "pkg:maven/org.metaeffekt.core/ae-security@0.159.0",
        "version": "0.159.0"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "alpine/alpine-common/pom.xml",
        "name": "alpine-common",
        "purl": "pkg:maven/org.dependencytrack/alpine-common@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "alpine/alpine-infra/pom.xml",
        "name": "alpine-infra",
        "purl": "pkg:maven/org.dependencytrack/alpine-infra@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "alpine/alpine-model/pom.xml",
        "name": "alpine-model",
        "purl": "pkg:maven/org.dependencytrack/alpine-model@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "alpine/pom.xml",
        "name": "alpine-parent",
        "purl": "pkg:maven/org.dependencytrack/alpine-parent@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "alpine/alpine-server/pom.xml",
        "name": "alpine-server",
        "purl": "pkg:maven/org.dependencytrack/alpine-server@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "notification/publishing/pom.xml",
        "name": "angus-mail",
        "purl": "pkg:maven/org.eclipse.angus/angus-mail@2.0.5",
        "version": "2.0.5"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "api/pom.xml",
        "name": "api",
        "purl": "pkg:maven/org.dependencytrack/api@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "apiserver/pom.xml",
        "name": "apiserver",
        "purl": "pkg:maven/org.dependencytrack/apiserver@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "archunit-junit5",
        "purl": "pkg:maven/com.tngtech.archunit/archunit-junit5@1.5.1",
        "version": "1.5.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-common/pom.xml",
        "name": "assertj-core",
        "purl": "pkg:maven/org.assertj/assertj-core@3.27.7",
        "version": "3.27.7"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "awaitility",
        "purl": "pkg:maven/org.awaitility/awaitility@4.3.0",
        "version": "4.3.0"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "cache/api/pom.xml",
        "name": "cache-api",
        "purl": "pkg:maven/org.dependencytrack/cache-api@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "cache/pom.xml",
        "name": "cache-parent",
        "purl": "pkg:maven/org.dependencytrack/cache-parent@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "cache/provider-database/pom.xml",
        "name": "cache-provider-database",
        "purl": "pkg:maven/org.dependencytrack/cache-provider-database@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "cache/provider-memory/pom.xml",
        "name": "cache-provider-memory",
        "purl": "pkg:maven/org.dependencytrack/cache-provider-memory@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "cache/provider-memory/pom.xml",
        "name": "caffeine",
        "purl": "pkg:maven/com.github.ben-manes.caffeine/caffeine@3.3.1",
        "version": "3.3.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "cel",
        "purl": "pkg:maven/dev.cel/cel@0.14.0",
        "version": "0.14.0"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "common/config/pom.xml",
        "name": "common-config",
        "purl": "pkg:maven/org.dependencytrack/common-config@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "common/datasource/pom.xml",
        "name": "common-datasource",
        "purl": "pkg:maven/org.dependencytrack/common-datasource@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "common/health/pom.xml",
        "name": "common-health",
        "purl": "pkg:maven/org.dependencytrack/common-health@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "common/init/pom.xml",
        "name": "common-init",
        "purl": "pkg:maven/org.dependencytrack/common-init@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "common/pagination/pom.xml",
        "name": "common-pagination",
        "purl": "pkg:maven/org.dependencytrack/common-pagination@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "common/pom.xml",
        "name": "common-parent",
        "purl": "pkg:maven/org.dependencytrack/common-parent@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "vuln-data-source/github/pom.xml",
        "name": "commons-lang3",
        "purl": "pkg:maven/org.apache.commons/commons-lang3@3.21.0",
        "version": "3.21.0"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "coverage-report/pom.xml",
        "name": "coverage-report",
        "purl": "pkg:maven/org.dependencytrack/coverage-report@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "cpe-parser",
        "purl": "pkg:maven/us.springett/cpe-parser@3.0.1",
        "version": "3.0.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "cyclonedx-core-java",
        "purl": "pkg:maven/org.cyclonedx/cyclonedx-core-java@13.4.0",
        "version": "13.4.0"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "support/cyclonedx-proto/pom.xml",
        "name": "cyclonedx-proto",
        "purl": "pkg:maven/org.dependencytrack/cyclonedx-proto@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-infra/pom.xml",
        "name": "datanucleus-api-jdo",
        "purl": "pkg:maven/org.datanucleus/datanucleus-api-jdo@6.0.5",
        "version": "6.0.5"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-infra/pom.xml",
        "name": "datanucleus-core",
        "purl": "pkg:maven/org.datanucleus/datanucleus-core@6.0.11",
        "version": "6.0.11"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "support/datanucleus-plugin/plugin/pom.xml",
        "name": "datanucleus-plugin",
        "purl": "pkg:maven/org.dependencytrack/datanucleus-plugin@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "support/datanucleus-plugin/pom.xml",
        "name": "datanucleus-plugin-parent",
        "purl": "pkg:maven/org.dependencytrack/datanucleus-plugin-parent@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "coverage-report/pom.xml",
        "name": "datanucleus-plugin-test",
        "purl": "pkg:maven/org.dependencytrack/datanucleus-plugin-test@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-infra/pom.xml",
        "name": "datanucleus-rdbms",
        "purl": "pkg:maven/org.datanucleus/datanucleus-rdbms@6.0.11",
        "version": "6.0.11"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "db-scheduler",
        "purl": "pkg:maven/com.github.kagkarlsson/db-scheduler@16.12.0",
        "version": "16.12.0"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "package-metadata/resolution/pom.xml",
        "name": "dec",
        "purl": "pkg:maven/org.brotli/dec@0.1.2",
        "version": "0.1.2"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "pom.xml",
        "name": "dependency-track-parent",
        "purl": "pkg:maven/org.dependencytrack/dependency-track-parent@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "dex/api/pom.xml",
        "name": "dex-api",
        "purl": "pkg:maven/org.dependencytrack/dex-api@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "dex/engine/pom.xml",
        "name": "dex-engine",
        "purl": "pkg:maven/org.dependencytrack/dex-engine@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "dex/engine-api/pom.xml",
        "name": "dex-engine-api",
        "purl": "pkg:maven/org.dependencytrack/dex-engine-api@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "dex/engine-migration/pom.xml",
        "name": "dex-engine-migration",
        "purl": "pkg:maven/org.dependencytrack/dex-engine-migration@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "dex/pom.xml",
        "name": "dex-parent",
        "purl": "pkg:maven/org.dependencytrack/dex-parent@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "dex-testing",
        "purl": "pkg:maven/org.dependencytrack/dex-testing@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "error_prone_annotations",
        "purl": "pkg:maven/com.google.errorprone/error_prone_annotations@2.50.0",
        "version": "2.50.0"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "file-storage/api/pom.xml",
        "name": "file-storage-api",
        "purl": "pkg:maven/org.dependencytrack/file-storage-api@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "file-storage/pom.xml",
        "name": "file-storage-parent",
        "purl": "pkg:maven/org.dependencytrack/file-storage-parent@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "file-storage/provider-local/pom.xml",
        "name": "file-storage-provider-local",
        "purl": "pkg:maven/org.dependencytrack/file-storage-provider-local@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "file-storage/provider-memory/pom.xml",
        "name": "file-storage-provider-memory",
        "purl": "pkg:maven/org.dependencytrack/file-storage-provider-memory@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "file-storage/provider-s3/pom.xml",
        "name": "file-storage-provider-s3",
        "purl": "pkg:maven/org.dependencytrack/file-storage-provider-s3@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "support/flyway/pom.xml",
        "name": "flyway-core",
        "purl": "pkg:maven/org.flywaydb/flyway-core",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "dex/engine-migration/pom.xml",
        "name": "flyway-database-postgresql",
        "purl": "pkg:maven/org.flywaydb/flyway-database-postgresql",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "support/flyway/pom.xml",
        "name": "flyway-support",
        "purl": "pkg:maven/org.dependencytrack/flyway-support@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "notification/publishing/pom.xml",
        "name": "greenmail-junit5",
        "purl": "pkg:maven/com.icegreen/greenmail-junit5@2.1.14",
        "version": "2.1.14"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "HikariCP",
        "purl": "pkg:maven/com.zaxxer/HikariCP@7.1.0",
        "version": "7.1.0"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "vuln-data-source/github/pom.xml",
        "name": "httpclient5",
        "purl": "pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.6.5",
        "version": "5.6.5"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-common/pom.xml",
        "name": "jackson-annotations",
        "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-annotations",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-model/pom.xml",
        "name": "jackson-databind",
        "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "common/pagination/pom.xml",
        "name": "jackson-dataformat-cbor",
        "purl": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-cbor",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "jackson-dataformat-yaml",
        "purl": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "jackson-datatype-jdk8",
        "purl": "pkg:maven/com.fasterxml.jackson.datatype/jackson-datatype-jdk8",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "jackson-datatype-jsr310",
        "purl": "pkg:maven/com.fasterxml.jackson.datatype/jackson-datatype-jsr310",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "jackson-jakarta-rs-base",
        "purl": "pkg:maven/com.fasterxml.jackson.jakarta.rs/jackson-jakarta-rs-base",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "jackson-jakarta-rs-json-provider",
        "purl": "pkg:maven/com.fasterxml.jackson.jakarta.rs/jackson-jakarta-rs-json-provider",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "api/pom.xml",
        "name": "jakarta.annotation-api",
        "purl": "pkg:maven/jakarta.annotation/jakarta.annotation-api",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "jakarta.json",
        "purl": "pkg:maven/org.eclipse.parsson/jakarta.json@1.1.9",
        "version": "1.1.9"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "jakarta.json-api",
        "purl": "pkg:maven/jakarta.json/jakarta.json-api",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "jakarta.servlet-api",
        "purl": "pkg:maven/jakarta.servlet/jakarta.servlet-api",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "api/pom.xml",
        "name": "jakarta.validation-api",
        "purl": "pkg:maven/jakarta.validation/jakarta.validation-api",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "api/pom.xml",
        "name": "jakarta.ws.rs-api",
        "purl": "pkg:maven/jakarta.ws.rs/jakarta.ws.rs-api",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "dex/engine/pom.xml",
        "name": "java-uuid-generator",
        "purl": "pkg:maven/com.fasterxml.uuid/java-uuid-generator@5.2.0",
        "version": "5.2.0"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "javacron",
        "purl": "pkg:maven/com.asahaf.javacron/javacron@1.4.0",
        "version": "1.4.0"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-infra/pom.xml",
        "name": "javax.jdo",
        "purl": "pkg:maven/org.datanucleus/javax.jdo@3.2.1",
        "version": "3.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "jbcrypt",
        "purl": "pkg:maven/org.mindrot/jbcrypt@0.4",
        "version": "0.4"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "support/jdbi/pom.xml",
        "name": "jdbi-support",
        "purl": "pkg:maven/org.dependencytrack/jdbi-support@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "jdbi3-core",
        "purl": "pkg:maven/org.jdbi/jdbi3-core",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "jdbi3-freemarker",
        "purl": "pkg:maven/org.jdbi/jdbi3-freemarker",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "jdbi3-jackson2",
        "purl": "pkg:maven/org.jdbi/jdbi3-jackson2",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "jdbi3-postgres",
        "purl": "pkg:maven/org.jdbi/jdbi3-postgres",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "jdbi3-sqlobject",
        "purl": "pkg:maven/org.jdbi/jdbi3-sqlobject",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-model/pom.xml",
        "name": "jersey-bean-validation",
        "purl": "pkg:maven/org.glassfish.jersey.ext/jersey-bean-validation",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "jersey-client",
        "purl": "pkg:maven/org.glassfish.jersey.core/jersey-client",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "jersey-container-servlet",
        "purl": "pkg:maven/org.glassfish.jersey.containers/jersey-container-servlet",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "jersey-hk2",
        "purl": "pkg:maven/org.glassfish.jersey.inject/jersey-hk2",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "jersey-media-json-jackson",
        "purl": "pkg:maven/org.glassfish.jersey.media/jersey-media-json-jackson",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "jersey-media-multipart",
        "purl": "pkg:maven/org.glassfish.jersey.media/jersey-media-multipart",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "jersey-micrometer",
        "purl": "pkg:maven/org.glassfish.jersey.ext/jersey-micrometer",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "jersey-test-framework-provider-grizzly2",
        "purl": "pkg:maven/org.glassfish.jersey.test-framework.providers/jersey-test-framework-provider-grizzly2",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "jetty-compression-gzip",
        "purl": "pkg:maven/org.eclipse.jetty.compression/jetty-compression-gzip",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "jetty-compression-server",
        "purl": "pkg:maven/org.eclipse.jetty.compression/jetty-compression-server",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "jetty-compression-zstandard",
        "purl": "pkg:maven/org.eclipse.jetty.compression/jetty-compression-zstandard",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "jetty-ee11-servlet",
        "purl": "pkg:maven/org.eclipse.jetty.ee11/jetty-ee11-servlet",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "jetty-server",
        "purl": "pkg:maven/org.eclipse.jetty/jetty-server",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "file-storage/provider-local/pom.xml",
        "name": "jimfs",
        "purl": "pkg:maven/com.google.jimfs/jimfs@1.3.2",
        "version": "1.3.2"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "plugin/config/pom.xml",
        "name": "json-schema-validator",
        "purl": "pkg:maven/com.networknt/json-schema-validator@2.0.8",
        "version": "2.0.8"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "json-unit-assertj",
        "purl": "pkg:maven/net.javacrumbs.json-unit/json-unit-assertj@6.3.0",
        "version": "6.3.0"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-model/pom.xml",
        "name": "jspecify",
        "purl": "pkg:maven/org.jspecify/jspecify@1.0.1",
        "version": "1.0.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "jul-to-slf4j",
        "purl": "pkg:maven/org.slf4j/jul-to-slf4j",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-common/pom.xml",
        "name": "junit-jupiter",
        "purl": "pkg:maven/org.junit.jupiter/junit-jupiter",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "dex/engine-api/pom.xml",
        "name": "junit-jupiter-params",
        "purl": "pkg:maven/org.junit.jupiter/junit-jupiter-params",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "junit-pioneer",
        "purl": "pkg:maven/org.junit-pioneer/junit-pioneer@2.3.0",
        "version": "2.3.0"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "notification/publishing/pom.xml",
        "name": "kafka-clients",
        "purl": "pkg:maven/org.apache.kafka/kafka-clients@4.4.0",
        "version": "4.4.0"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "kev-data-source/api/pom.xml",
        "name": "kev-data-source-api",
        "purl": "pkg:maven/org.dependencytrack/kev-data-source-api@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "kev-data-source/builtin/pom.xml",
        "name": "kev-data-source-builtin",
        "purl": "pkg:maven/org.dependencytrack/kev-data-source-builtin@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "kev-data-source/pom.xml",
        "name": "kev-data-source-parent",
        "purl": "pkg:maven/org.dependencytrack/kev-data-source-parent@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "logback-classic",
        "purl": "pkg:maven/ch.qos.logback/logback-classic@1.6.5",
        "version": "1.6.5"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "logback-core",
        "purl": "pkg:maven/ch.qos.logback/logback-core@1.6.5",
        "version": "1.6.5"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "logstash-logback-encoder",
        "purl": "pkg:maven/net.logstash.logback/logstash-logback-encoder@8.1",
        "version": "8.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-infra/pom.xml",
        "name": "micrometer-core",
        "purl": "pkg:maven/io.micrometer/micrometer-core",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "micrometer-java11",
        "purl": "pkg:maven/io.micrometer/micrometer-java11",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "micrometer-jvm-extras",
        "purl": "pkg:maven/io.github.mweirauch/micrometer-jvm-extras@0.3.0",
        "version": "0.3.0"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "micrometer-registry-prometheus",
        "purl": "pkg:maven/io.micrometer/micrometer-registry-prometheus",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "cache/api/pom.xml",
        "name": "microprofile-config-api",
        "purl": "pkg:maven/org.eclipse.microprofile.config/microprofile-config-api@3.1.2",
        "version": "3.1.2"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "microprofile-health-api",
        "purl": "pkg:maven/org.eclipse.microprofile.health/microprofile-health-api@4.0.1",
        "version": "4.0.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "migration/pom.xml",
        "name": "migration",
        "purl": "pkg:maven/org.dependencytrack/migration@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "minio",
        "purl": "pkg:maven/io.minio/minio@9.0.3",
        "version": "9.0.3"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-infra/pom.xml",
        "name": "mockito-core",
        "purl": "pkg:maven/org.mockito/mockito-core",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "support/v4-migrator/pom.xml",
        "name": "mssql-jdbc",
        "purl": "pkg:maven/com.microsoft.sqlserver/mssql-jdbc@13.6.1.jre11",
        "version": "13.6.1.jre11"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "support/net/pom.xml",
        "name": "net-support",
        "purl": "pkg:maven/org.dependencytrack/net-support@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "notification/api/pom.xml",
        "name": "notification-api",
        "purl": "pkg:maven/org.dependencytrack/notification-api@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "notification/pom.xml",
        "name": "notification-parent",
        "purl": "pkg:maven/org.dependencytrack/notification-parent@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "notification/publishing/pom.xml",
        "name": "notification-publishing",
        "purl": "pkg:maven/org.dependencytrack/notification-publishing@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "notification/templating/pom.xml",
        "name": "notification-templating",
        "purl": "pkg:maven/org.dependencytrack/notification-templating@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "oauth2-oidc-sdk",
        "purl": "pkg:maven/com.nimbusds/oauth2-oidc-sdk@11.38.2",
        "version": "11.38.2"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "okhttp-jvm",
        "purl": "pkg:maven/com.squareup.okhttp3/okhttp-jvm@5.5.0",
        "version": "5.5.0"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "vuln-data-source/github/pom.xml",
        "name": "open-vulnerability-clients",
        "purl": "pkg:maven/io.github.jeremylong/open-vulnerability-clients@9.0.7",
        "version": "9.0.7"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "support/os-distro-metadata/pom.xml",
        "name": "os-distro-metadata",
        "purl": "pkg:maven/org.dependencytrack/os-distro-metadata@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "owasp-risk-rating-calculator",
        "purl": "pkg:maven/us.springett/owasp-risk-rating-calculator@1.0.1",
        "version": "1.0.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "package-metadata/api/pom.xml",
        "name": "package-metadata-api",
        "purl": "pkg:maven/org.dependencytrack/package-metadata-api@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "package-metadata/pom.xml",
        "name": "package-metadata-parent",
        "purl": "pkg:maven/org.dependencytrack/package-metadata-parent@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "package-metadata/resolution/pom.xml",
        "name": "package-metadata-resolution",
        "purl": "pkg:maven/org.dependencytrack/package-metadata-resolution@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "packageurl-java",
        "purl": "pkg:maven/com.github.package-url/packageurl-java@1.5.0",
        "version": "1.5.0"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "pebble",
        "purl": "pkg:maven/io.pebbletemplates/pebble@4.1.2",
        "version": "4.1.2"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "support/v4-migrator/pom.xml",
        "name": "picocli",
        "purl": "pkg:maven/info.picocli/picocli@4.7.7",
        "version": "4.7.7"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "plugin/api/pom.xml",
        "name": "plugin-api",
        "purl": "pkg:maven/org.dependencytrack/plugin-api@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "plugin/config/pom.xml",
        "name": "plugin-config",
        "purl": "pkg:maven/org.dependencytrack/plugin-config@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "plugin/pom.xml",
        "name": "plugin-parent",
        "purl": "pkg:maven/org.dependencytrack/plugin-parent@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "plugin/runtime/pom.xml",
        "name": "plugin-runtime",
        "purl": "pkg:maven/org.dependencytrack/plugin-runtime@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "coverage-report/pom.xml",
        "name": "plugin-testing",
        "purl": "pkg:maven/org.dependencytrack/plugin-testing@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "postgresql",
        "purl": "pkg:maven/org.postgresql/postgresql@42.7.14",
        "version": "42.7.14"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "prometheus-metrics-exposition-textformats",
        "purl": "pkg:maven/io.prometheus/prometheus-metrics-exposition-textformats",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "proto/pom.xml",
        "name": "proto",
        "purl": "pkg:maven/org.dependencytrack/proto@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "dex/api/pom.xml",
        "name": "protobuf-java",
        "purl": "pkg:maven/com.google.protobuf/protobuf-java@4.36.2",
        "version": "4.36.2"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "protobuf-java-util",
        "purl": "pkg:maven/com.google.protobuf/protobuf-java-util@4.36.2",
        "version": "4.36.2"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "dex/engine/pom.xml",
        "name": "resilience4j-circuitbreaker",
        "purl": "pkg:maven/io.github.resilience4j/resilience4j-circuitbreaker",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "resilience4j-core",
        "purl": "pkg:maven/io.github.resilience4j/resilience4j-core",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "dex/engine/pom.xml",
        "name": "resilience4j-micrometer",
        "purl": "pkg:maven/io.github.resilience4j/resilience4j-micrometer",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "file-storage/provider-s3/pom.xml",
        "name": "s3mock-testcontainers",
        "purl": "pkg:maven/com.adobe.testing/s3mock-testcontainers@5.2.3",
        "version": "5.2.3"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "secret-management/pom.xml",
        "name": "secret-management",
        "purl": "pkg:maven/org.dependencytrack/secret-management@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "security-logging-common",
        "purl": "pkg:maven/org.owasp/security-logging-common@1.1.7",
        "version": "1.1.7"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "security-logging-logback",
        "purl": "pkg:maven/org.owasp/security-logging-logback@1.1.7",
        "version": "1.1.7"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-common/pom.xml",
        "name": "slf4j-api",
        "purl": "pkg:maven/org.slf4j/slf4j-api",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-common/pom.xml",
        "name": "slf4j-nop",
        "purl": "pkg:maven/org.slf4j/slf4j-nop",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "cache/provider-database/pom.xml",
        "name": "slf4j-simple",
        "purl": "pkg:maven/org.slf4j/slf4j-simple",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "cache/api/pom.xml",
        "name": "smallrye-config-core",
        "purl": "pkg:maven/io.smallrye.config/smallrye-config-core",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "support/smallrye-config-secret-handler-file/pom.xml",
        "name": "smallrye-config-secret-handler-file",
        "purl": "pkg:maven/org.dependencytrack/smallrye-config-secret-handler-file@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "support/smallrye-config-source-memory/pom.xml",
        "name": "smallrye-config-source-memory",
        "purl": "pkg:maven/org.dependencytrack/smallrye-config-source-memory@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-model/pom.xml",
        "name": "swagger-annotations-jakarta",
        "purl": "pkg:maven/io.swagger.core.v3/swagger-annotations-jakarta@2.2.55",
        "version": "2.2.55"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "support/swagger-model-converters/pom.xml",
        "name": "swagger-core-jakarta",
        "purl": "pkg:maven/io.swagger.core.v3/swagger-core-jakarta@2.2.55",
        "version": "2.2.55"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "support/swagger-model-converters/pom.xml",
        "name": "swagger-model-converters",
        "purl": "pkg:maven/org.dependencytrack/swagger-model-converters@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "swagger-parser",
        "purl": "pkg:maven/io.swagger.parser.v3/swagger-parser@2.1.48",
        "version": "2.1.48"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-infra/pom.xml",
        "name": "test-database-support",
        "purl": "pkg:maven/org.dependencytrack/test-database-support@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "vuln-analysis/trivy/pom.xml",
        "name": "testcontainers",
        "purl": "pkg:maven/org.testcontainers/testcontainers",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "testcontainers-junit-jupiter",
        "purl": "pkg:maven/org.testcontainers/testcontainers-junit-jupiter",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "notification/publishing/pom.xml",
        "name": "testcontainers-kafka",
        "purl": "pkg:maven/org.testcontainers/testcontainers-kafka",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "testcontainers-ldap",
        "purl": "pkg:maven/org.testcontainers/testcontainers-ldap",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "support/v4-migrator/pom.xml",
        "name": "testcontainers-mssqlserver",
        "purl": "pkg:maven/org.testcontainers/testcontainers-mssqlserver",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "testcontainers-postgresql",
        "purl": "pkg:maven/org.testcontainers/testcontainers-postgresql@2.0.5",
        "version": "2.0.5"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "cache/provider-database/pom.xml",
        "name": "testcontainers-postgresql",
        "purl": "pkg:maven/org.testcontainers/testcontainers-postgresql",
        "version": "UNKNOWN"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "secret-management/pom.xml",
        "name": "tink",
        "purl": "pkg:maven/com.google.crypto.tink/tink@1.24.0",
        "version": "1.24.0"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "support/v4-migrator/pom.xml",
        "name": "v4-migrator",
        "purl": "pkg:maven/org.dependencytrack/v4-migrator@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "versatile-core",
        "purl": "pkg:maven/io.github.nscuro/versatile-core@0.26.1",
        "version": "0.26.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "vuln-analysis/api/pom.xml",
        "name": "vuln-analysis-api",
        "purl": "pkg:maven/org.dependencytrack/vuln-analysis-api@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "vuln-analysis/pom.xml",
        "name": "vuln-analysis-parent",
        "purl": "pkg:maven/org.dependencytrack/vuln-analysis-parent@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "vuln-analysis/checkmarx/pom.xml",
        "name": "vuln-analyzer-checkmarx",
        "purl": "pkg:maven/org.dependencytrack/vuln-analyzer-checkmarx@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "vuln-analysis/internal/pom.xml",
        "name": "vuln-analyzer-internal",
        "purl": "pkg:maven/org.dependencytrack/vuln-analyzer-internal@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "vuln-analysis/oss-index/pom.xml",
        "name": "vuln-analyzer-oss-index",
        "purl": "pkg:maven/org.dependencytrack/vuln-analyzer-oss-index@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "vuln-analysis/snyk/pom.xml",
        "name": "vuln-analyzer-snyk",
        "purl": "pkg:maven/org.dependencytrack/vuln-analyzer-snyk@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "vuln-analysis/trivy/pom.xml",
        "name": "vuln-analyzer-trivy",
        "purl": "pkg:maven/org.dependencytrack/vuln-analyzer-trivy@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "vuln-analysis/vuln-db/pom.xml",
        "name": "vuln-analyzer-vuln-db",
        "purl": "pkg:maven/org.dependencytrack/vuln-analyzer-vuln-db@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "vuln-data-source/api/pom.xml",
        "name": "vuln-data-source-api",
        "purl": "pkg:maven/org.dependencytrack/vuln-data-source-api@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "vuln-data-source/github/pom.xml",
        "name": "vuln-data-source-github",
        "purl": "pkg:maven/org.dependencytrack/vuln-data-source-github@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "vuln-data-source/jvn/pom.xml",
        "name": "vuln-data-source-jvn",
        "purl": "pkg:maven/org.dependencytrack/vuln-data-source-jvn@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "vuln-data-source/nvd/pom.xml",
        "name": "vuln-data-source-nvd",
        "purl": "pkg:maven/org.dependencytrack/vuln-data-source-nvd@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "vuln-data-source/osv/pom.xml",
        "name": "vuln-data-source-osv",
        "purl": "pkg:maven/org.dependencytrack/vuln-data-source-osv@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [
          "Apache-2.0"
        ],
        "location": "vuln-data-source/pom.xml",
        "name": "vuln-data-source-parent",
        "purl": "pkg:maven/org.dependencytrack/vuln-data-source-parent@5.2.1",
        "version": "5.2.1"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "alpine/alpine-server/pom.xml",
        "name": "wiremock-standalone",
        "purl": "pkg:maven/org.wiremock/wiremock-standalone@3.13.2",
        "version": "3.13.2"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "apiserver/pom.xml",
        "name": "woodstox-core",
        "purl": "pkg:maven/com.fasterxml.woodstox/woodstox-core@7.3.0",
        "version": "7.3.0"
      },
      {
        "ecosystem": "maven",
        "licenses": [],
        "location": "file-storage/provider-local/pom.xml",
        "name": "zstd-jni",
        "purl": "pkg:maven/com.github.luben/zstd-jni@1.5.7-23",
        "version": "1.5.7-23"
      }
    ],
    "description": "Track components and analyze dependency risk from SBOMs",
    "errors": [],
    "id": "DependencyTrack__dependency-track",
    "manifests": [
      ".github/workflows/_meta-build.yaml",
      ".github/workflows/ci-build.yaml",
      ".github/workflows/ci-codeql.yaml",
      ".github/workflows/ci-issue-template.yml",
      ".github/workflows/ci-lint.yaml",
      ".github/workflows/ci-pr-template.yml",
      ".github/workflows/ci-publish.yaml",
      ".github/workflows/ci-release.yaml",
      ".github/workflows/ci-test-e2e.yaml",
      ".github/workflows/ci-test-pr-coverage.yml",
      ".github/workflows/ci-test.yaml",
      ".github/workflows/config-docs-update.yml",
      ".github/workflows/mirror-container-image.yml",
      ".github/workflows/openapi-docs-update.yml",
      ".github/workflows/proto-docs-update.yml",
      "alpine/alpine-common/pom.xml",
      "alpine/alpine-infra/pom.xml",
      "alpine/alpine-model/pom.xml",
      "alpine/alpine-server/pom.xml",
      "alpine/pom.xml",
      "api/pom.xml",
      "apiserver/pom.xml",
      "cache/api/pom.xml",
      "cache/pom.xml",
      "cache/provider-database/pom.xml",
      "cache/provider-memory/pom.xml",
      "common/config/pom.xml",
      "common/datasource/pom.xml",
      "common/health/pom.xml",
      "common/init/pom.xml",
      "common/pagination/pom.xml",
      "common/pom.xml",
      "coverage-report/pom.xml",
      "dex/api/pom.xml",
      "dex/engine-api/pom.xml",
      "dex/engine-migration/pom.xml",
      "dex/engine/pom.xml",
      "dex/pom.xml",
      "file-storage/api/pom.xml",
      "file-storage/pom.xml",
      "file-storage/provider-local/pom.xml",
      "file-storage/provider-memory/pom.xml",
      "file-storage/provider-s3/pom.xml",
      "kev-data-source/api/pom.xml",
      "kev-data-source/builtin/pom.xml",
      "kev-data-source/pom.xml",
      "migration/pom.xml",
      "notification/api/pom.xml",
      "notification/pom.xml",
      "notification/publishing/pom.xml",
      "notification/templating/pom.xml",
      "package-metadata/api/pom.xml",
      "package-metadata/pom.xml",
      "package-metadata/resolution/pom.xml",
      "plugin/api/pom.xml",
      "plugin/config/pom.xml",
      "plugin/pom.xml",
      "plugin/runtime/pom.xml",
      "pom.xml",
      "proto/pom.xml",
      "secret-management/pom.xml",
      "support/cyclonedx-proto/pom.xml",
      "support/datanucleus-plugin/plugin/pom.xml",
      "support/datanucleus-plugin/pom.xml",
      "support/flyway/pom.xml",
      "support/jdbi/pom.xml",
      "support/net/pom.xml",
      "support/os-distro-metadata/pom.xml",
      "support/smallrye-config-secret-handler-file/pom.xml",
      "support/smallrye-config-source-memory/pom.xml",
      "support/swagger-model-converters/pom.xml",
      "support/v4-migrator/pom.xml",
      "vuln-analysis/api/pom.xml",
      "vuln-analysis/checkmarx/pom.xml",
      "vuln-analysis/internal/pom.xml",
      "vuln-analysis/oss-index/pom.xml",
      "vuln-analysis/pom.xml",
      "vuln-analysis/snyk/pom.xml",
      "vuln-analysis/trivy/pom.xml",
      "vuln-analysis/vuln-db/pom.xml",
      "vuln-data-source/api/pom.xml",
      "vuln-data-source/github/pom.xml",
      "vuln-data-source/jvn/pom.xml",
      "vuln-data-source/nvd/pom.xml",
      "vuln-data-source/osv/pom.xml",
      "vuln-data-source/pom.xml"
    ],
    "name": "dependency-track",
    "osv": {
      "advisories": 0,
      "available": true,
      "confirmed": 0,
      "osv_only": [],
      "warning": "osv-scanner could not resolve every manifest: failed resolution for vuln-data-source/osv/pom.xml: failed resolving {Maven:org.dependencytrack:vuln-data-source-osv[Concrete:5.2.1] {}}: version Maven:org.dependencytrack:os-distro-metadata[Concrete:"
    },
    "ref": "5.2.1",
    "ref_kind": "release",
    "release_integrity": {
      "assets": 4,
      "checksums_published": true,
      "methods": [],
      "provenance_published": true,
      "sbom_published": false,
      "signatures_published": false,
      "verdict": "no-linux-binary"
    },
    "released_at": "2026-10-25T11:13:32Z",
    "repository": "DependencyTrack/dependency-track",
    "sbomlyze_diff": {
      "added": 0,
      "changed": 1,
      "drift": {
        "integrity_drift": 0,
        "metadata_drift": 1,
        "version_drift": 0
      },
      "findings": [
        "Attack surface: -2 packages (-0.6%)",
        "0 version changes among 315 shared packages \u2014 no actual upgrades",
        "Core system packages stable: github (44) unchanged",
        "License shift: permissive -1"
      ],
      "html": "sbomlyze-diff.html",
      "removed": 2
    },
    "scanned_at": "2026-11-02T03:06:55+00:00",
    "scorecard": {
      "checks": [
        {
          "name": "Fuzzing",
          "reason": "project is not fuzzed",
          "score": 0
        },
        {
          "name": "Code-Review",
          "reason": "Found 2/13 approved changesets -- score normalized to 1",
          "score": 1
        },
        {
          "name": "CII-Best-Practices",
          "reason": "badge detected: InProgress",
          "score": 2
        },
        {
          "name": "Branch-Protection",
          "reason": "branch protection is not maximal on development and all release branches",
          "score": 3
        },
        {
          "name": "Pinned-Dependencies",
          "reason": "dependency not pinned by hash detected -- score normalized to 9",
          "score": 9
        },
        {
          "name": "Security-Policy",
          "reason": "security policy file detected",
          "score": 9
        },
        {
          "name": "Binary-Artifacts",
          "reason": "no binaries found in the repo",
          "score": 10
        },
        {
          "name": "Dangerous-Workflow",
          "reason": "no dangerous workflow patterns detected",
          "score": 10
        },
        {
          "name": "License",
          "reason": "license file detected",
          "score": 10
        },
        {
          "name": "Maintained",
          "reason": "30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10",
          "score": 10
        },
        {
          "name": "SAST",
          "reason": "SAST tool is run on all commits",
          "score": 10
        },
        {
          "name": "Signed-Releases",
          "reason": "5 out of the last 5 releases have a total of 5 signed artifacts.",
          "score": 10
        },
        {
          "name": "Token-Permissions",
          "reason": "GitHub workflow tokens follow principle of least privilege",
          "score": 10
        },
        {
          "name": "Packaging",
          "reason": "packaging workflow not detected",
          "score": -1
        }
      ],
      "date": "2026-10-26",
      "score": 7.5,
      "source": "openssf-api",
      "version": "v5.6.0"
    },
    "vulnerabilities": [],
    "workflow_audit": {
      "files": 15,
      "findings": []
    }
  },
  "updated": "2026-11-02"
}