dependency-track

Track components and analyze dependency risk from SBOMs

DependencyTrack/dependency-track · Software Composition Analysis (SCA) · scanned 5.2.1 (released 2026-10-25) · commit e6c887c0207b · last scan 2026-11-02

The scan method changed on 2026-11-02. npm development dependencies and npm-shrinkwrap.json are now scanned; matches on GitHub Actions referenced by a moving tag and on npm packages the repository defines itself are no longer counted; directories such as integration-tests and test-fixtures are excluded as fixtures. Most differences from the previous week below come from that change, not from the projects. Details.

Changes since last week

1 removed; 1 license changes.

Removed (1)

junit-jupiter-api@UNKNOWN

License changes

• test-database-support: Apache-2.0 → none

Known vulnerabilities

No known advisories matched the declared dependencies.

Second opinion: OSV-Scanner

OSV-Scanner found 0 advisories in the same files; 0 of Grype's matches are confirmed by it (marked ✓ above). 0 advisories were reported only by OSV-Scanner.

osv-scanner could not resolve every manifest: failed resolution for vuln-data-source/osv/pom.xml: failed resolving {Maven:org.dependencytrack:vuln-data-source-osv[Concrete:5.2.1] {}}: version Maven:org.dependencytrack:os-distro-metadata[Concrete:

Release integrity

Verdict: no Linux binary.

• Checksums file: yes
• Signatures: no
• SLSA provenance: yes
• SBOM published with the release: no

Verified means a signature, provenance, or attestation was checked against an identity in DependencyTrack/dependency-track's own GitHub Actions workflows.

Repository security (OpenSSF Scorecard)

Score 7.5/10, assessed 2026-10-26 (OpenSSF public dataset). Scorecard viewer

GitHub Actions workflow audit (zizmor)

No medium- or high-confidence issues in 15 workflow files.

Dependencies (211)

By ecosystem: maven 189, github 22.

Licenses (as declared in the SBOM): unknown 140, Apache-2.0 71.

History

SBOM minimum elements

Scored by sbomlyze on the generated source SBOM. A source SBOM usually lacks supplier and hash data, so these scores mostly reflect what the project's manifests declare.

Evidence

Downloads for this week: CycloneDX SBOM · Grype report · sbomlyze diff from last week

Permanent copy of the raw SBOM, Grype, OSV-Scanner, and govulncheck output and release checks: release report-2026-11-02, folder supply-chain-shard-*/DependencyTrack__dependency-track/.

Full JSON for this project · Atom feed of weekly changes

Badges

shields.io endpoints refreshed with each weekly scan. They report this week's result for the latest release, nothing more.

[![release verification](https://img.shields.io/endpoint?url=https%3A%2F%2Frezmoss.github.io%2Fawesome-security-pipeline%2Fbadges%2FDependencyTrack%2Fdependency-track%2Frelease.json)](https://rezmoss.github.io/awesome-security-pipeline/projects/DependencyTrack/dependency-track/index.html)

How this report is made

Every Sunday a GitHub Actions workflow resolves each catalog tool to its latest release and runs the checks below. Every tool is installed from its own latest release and verified against its published checksum or digest. Nothing from the scanned projects is built or executed; release binaries are analyzed as files.