Repolode
Submit
DependencyTrack

DependencyTrack/dependency-track

An SBOM-based Component Analysis platform that tracks software dependencies and their known vulnerabilities across an organization's projects.

Open-source alternative to:SnykBlack Duck

View on GitHubWebsite
Stars
4,419
Forks
852
Open issues
877
Last commit
yesterday

What is it?

Dependency-Track is a Component Analysis platform from OWASP that helps organizations identify and reduce risk in their software supply chain. It works from Software Bill of Materials (SBOM) files, using them as the basis for tracking which components and versions each application contains.

By continuously monitoring the components it knows about, Dependency-Track surfaces vulnerabilities in those dependencies as new information becomes available, rather than only at build time. The project is maintained as a Java application, with a web frontend in a separate repository, and is distributed as Docker images and Helm charts for deployment.

The project provides a quickstart based on Docker Compose and user documentation at dependencytrack.org. Version 5 is the current line, while v4 is in maintenance mode.

Key features

  • 01Ingests SBOM files to track components and versions per project.
  • 02Monitors tracked dependencies for newly disclosed vulnerabilities.
  • 03Supports deployment via Docker images and Helm charts.
  • 04Provides a Docker Compose quickstart for a local instance.

Use cases

  • Tracking third-party dependency risk across many internal applications.
  • Adding vulnerability monitoring to a software supply chain security program.
  • Reviewing the component inventory of released software from SBOMs.

Quick start

  1. 1

    Follow the Quickstart tutorial to run a local instance with Docker Compose

Things to know

  • The README's quickstart relies on Docker Compose and points to external documentation for setup details.
  • v4 is in maintenance mode and v5 is the newer line, so migration from v4 may require effort.

Topics

#sbom#software-composition-analysis#vulnerability-detection#supply-chain-security#appsec#devsecops#bill-of-materials#bom#component-analysis#cyclonedx

FAQ

What is dependency-track?
An SBOM-based Component Analysis platform that tracks software dependencies and their known vulnerabilities across an organization's projects. Dependency-Track is a Component Analysis platform from OWASP that helps organizations identify and reduce risk in their software supply chain. It works from Software Bill of Materials (SBOM) files, using them as the basis for tracking which components and versions each application contains.
Is dependency-track free to use? What license does it have?
dependency-track is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is dependency-track still maintained?
Actively maintained. The last commit to dependency-track was on Nov 5, 2026.
What can I use dependency-track for?
Tracking third-party dependency risk across many internal applications. Adding vulnerability monitoring to a software supply chain security program. Reviewing the component inventory of released software from SBOMs.
How do I install dependency-track?
Follow the Quickstart tutorial to run a local instance with Docker Compose
Where can I get dependency-track?
The source code and installation instructions are on GitHub: https://github.com/DependencyTrack/dependency-track

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects