• Improve VEX import performance - apiserver/#6141
• Include groupBy parameter in DefectDojo finding upload - apiserver/#6130
• Include analysis detail in DefectDojo finding payload - apiserver/#6181
• Improve performance of OSV mirroring - apiserver/#6345
• Show exploit predictions from all sources - frontend/#1523

Fixes:

• Reject parent objects with null UUID when creating, updating or patching projects - apiserver/#6355
• Fix NPE and redundant queries in VEX / VDR export - apiserver/#6614
• Prevent duplicate downloads when using export and download buttons - frontend/#1659

For a complete list of changes, refer to the respective GitHub milestones:

• API server milestone 4.14.3
• Frontend milestone 4.14.3

We thank all organizations and individuals who contributed to this release, from logging issues to taking part in discussions on GitHub & Slack to testing of fixes.

Special thanks to everyone who contributed code to implement enhancements and fix defects:

@ElenaStroebele, @heyiamwahab236, @webdevred, @yuwwx

dependency-track-apiserver.jar

dependency-track-bundled.jar

frontend-dist.zip

Software Bill of Materials (SBOM)

• API Server: bom.json
• Frontend: bom.json

• Improve performance of vuln data source mirroring - apiserver/#6040
• Handle epoch PURL qualifier for version comparison - apiserver/#6083
• Add project filters to component identity search - apiserver/#6087

Fixes:

• Fix incorrect format of Composer packages being sent to Trivy - apiserver/#6117
• Fix incorrect version comparison of NuGet packages when v-prefix is present - apiserver/#6116

For a complete list of changes, refer to the respective GitHub milestones:

• API server milestone 4.14.2
• Frontend milestone 4.14.2

We thank all organizations and individuals who contributed to this release, from logging issues to taking part in discussions on GitHub & Slack to testing of fixes.

Special thanks to everyone who contributed code to implement enhancements and fix defects:

@Abdelmonem-BEN-NACEUR, @hoobio

dependency-track-apiserver.jar

dependency-track-bundled.jar

frontend-dist.zip

Software Bill of Materials (SBOM)

• API Server: bom.json
• Frontend: bom.json

• Add support for NuGet versioning scheme - apiserver/#5958
• Add support for Composer versioning scheme - apiserver/#5963
• Document age and version distance operational policy criteria - apiserver/#5964
• Use ecosystem-aware version comparison for latest version detection - apiserver/#5995
• Support Sonatype Guide tokens for OSS Index analyzer - apiserver/#5996
• Improve Chinese translations - frontend/#1490

Fixes:

• Fix PURL-specific version matching being bypassed for components with CPE - apiserver/#5959
• Fix wasteful existence queries - apiserver/#5960
• Fix potentially wrong version being used for CPE comparison - apiserver/#5962
• Fix scheduled notification query failing when ID columns are not of type BIGINT - apiserver/#5979
• Avoid NPE when computing Trivy pkgType - apiserver/#5987
• Remove leading whitespace from vulnerability badge SVG template - apiserver/#6000
• Fix Japanese Trivy analyzer strings - frontend/#1489

For a complete list of changes, refer to the respective GitHub milestones:

• API server milestone 4.14.1
• Frontend milestone 4.14.1

We thank all organizations and individuals who contributed to this release, from logging issues to taking part in discussions on GitHub & Slack to testing of fixes.

Special thanks to everyone who contributed code to implement enhancements and fix defects:

@Zureno, @jonbally, @retanoj, @shayFoo, @stohrendorf

dependency-track-apiserver.jar

dependency-track-bundled.jar

frontend-dist.zip

Software Bill of Materials (SBOM)

• API Server: bom.json
• Frontend: bom.json

• Ecosystem-aware version matching. Vulnerability analysis now uses version comparison algorithms native to the component’s ecosystem, rather than relying on generic semantic versioning. For example, Debian versions are compared using the dpkg sorting algorithm. Supported ecosystems are Alpine Linux, Debian, Go, Maven, NPM, PyPI, and RPM.
• Distro-aware vulnerability matching. Linux distributions like Debian backport security fixes to older releases, meaning a component may be vulnerable in one distro release but not another. Dependency-Track now uses the distro qualifier of package URLs (e.g., pkg:deb/debian/libcurl4t64@8.14.1-2%2Bdeb13u2?distro=debian-13.3) to determine the OS release and match vulnerabilities accordingly. Currently supported for Alpine Linux, Debian, and Ubuntu.
  • Note: Requires vulnerability data from OSV, as the NVD does not contextualize version ranges by OS release. Not all BOM generators populate the distro PURL qualifier today.
• CVSSv4 support. Upstream vulnerability sources are increasingly publishing CVSSv4 scores. Dependency-Track now ingests and displays CVSSv4 vectors and derived severities alongside existing CVSSv2 and CVSSv3 data.

Features:

• Include project UUID in log messages - apiserver/#5500
• Add support for incremental mirroring of OSV - apiserver/#5537
• Add internal status policy condition support - apiserver/#5570
• Implement VERS approach for PURL version matching - apiserver/#5591
• Add projectUuid via MDC to logger statements within VEX upload - apiserver/#5615
• Specify newer version of Docker Compose in README - apiserver/#5648
• Add configurable base URL for OSS Index API - apiserver/#5736
• Update OSS Index documentation - apiserver/#5774
• Improve efficiency and caching behaviour of OSS Index analyzer - apiserver/#5793
• Switch to G1GC and limit default Docker Compose memory to 4GB - apiserver/#5794
• Add EPSS score support for GitHub Advisory vulnerabilities - apiserver/#5829
• Add page on users and permissions to documentation - apiserver/#5831
• Include CVSS vectors and metadata in Finding model - apiserver/#5844
• Tweak vulnerability persistence logic - apiserver/#5862
• Add CVSSv4 support - apiserver/#5863
• Delete NVD feed timestamp files during v4.14.0 upgrade - apiserver/#5886
• Bump SPDX license list to v3.28.0 - apiserver/#5888
• Bump CWE dictionary to v4.19.1 - apiserver/#5889
• Make username optional for Repositories Bearer Auth - frontend/#1128
• Improve German Translation - frontend/#1227
• Add suffix to vulnerability locale keys - frontend/#1276
• Add match mode selector to internal component config - frontend/#1283
• Display license ID - frontend/#1311
• Support for scope mentioned in CycloneDX format - frontend/#1319
• Add support for IS_INTERNAL policy condition - frontend/#1394
• Add Traditional Chinese (zh-TW) language support - frontend/#1412
• Remove database information from About dialogue - frontend/#1421
• Add OSS Index Base URL configuration field - frontend/#1431
• Add CVSSv4 support - frontend/#1455
• Add missing internal_status i18n key for zh-TW locale - frontend/#1456

Fixes:

• Fix sneaky double quote - apiserver/#5420
• Fix incorrect UTF-8 encoding in notification payload - apiserver/#5574
• Fix excessive memory usage of Nix analyzer - apiserver/#5653
• Fix wrong NPM component coordinate separator for Trivy analysis - apiserver/#5679
• Fix performance issue with PURL lookups - apiserver/#5711
• Fall back to generic versioning scheme if no PURL is available - apiserver/#5714
• Fix incorrect URL for VulnDB analyzer - apiserver/#5751
• Ensure container zombie processes are reaped - apiserver/#5758
• Fix singleton events not being labelled as such - apiserver/#5775
• Consider OS distro during vulnerability matching - apiserver/#5783
• Fix re-initialization of teams when opening create-modal - frontend/#1410

Upgrade Notes:

• To backfill CVSSv4 and EPSS data, mirror watermarks for NVD and GitHub Advisories will be reset,
  triggering a full re-mirror on next invocation.

For a complete list of changes, refer to the respective GitHub milestones:

• API server milestone 4.14.0
• Frontend milestone 4.14.0

We thank all organizations and individuals who contributed to this release, from logging issues to taking part in discussions on GitHub & Slack to testing of fixes.

Special thanks to everyone who contributed code to implement enhancements and fix defects:

@anantk24, @AndreVirtimo, @arjavdongaonkar, @brianf, @ch8matt, @ElenaStroebele, @fupgang, @Granjow, @jonbally, @jvirgovic, @setchy, @snieguu, @stohrendorf, @tobiasgies, @valentijnscholten, @WoozyMasta, @wengct

dependency-track-apiserver.jar

dependency-track-bundled.jar

frontend-dist.zip

Software Bill of Materials (SBOM)

• API Server: bom.json
• Frontend: bom.json

To use the new image variant, append the -alpine suffix to the image tag, e.g.:

• docker.io/dependencytrack/apiserver:latest-alpine
• docker.io/dependencytrack/bundled:4.13.6-alpine

The previous Debian-based image variant continues to be the default for now, but will eventually be discontinued in a future release. Users experiencing issues with alpine images can safely fall back to non-alpine variants.

Features:

• Add Alpine-based container variants - apiserver/#5533
• Update Ukrainian translation - frontend/#1385

Fixes:

• Improve performance of database migration to v4.13.5 - apiserver/#5419
• Ignore stale Lucene index entries - apiserver/#5428
• Fix typo in email notification template - apiserver/#5434
• Fix referential integrity violation during bulk project deletion - apiserver/#5446
• Fix referential integrity violation during team deletion - apiserver/#5447
• Fix NPE in Composer component metadata analyzer - apiserver/#5519
• Fix XML External Entity injection via validation of CycloneDX BOMs in XML format - apiserver/#5528 / GHSA-93r8-3g93-w2gq
• Fix OSS Index documentation link - apiserver/#5531
• Change toString() method of Project to use name and version instead of PURL - apiserver/#5532
• Fix broken routing when BASE_PATH is configured - frontend/#1381
• Fix policy tag selection dialogue using the wrong REST API endpoint - frontend/#1382
• Fix persistent Cross-Site-Scripting via welcome message - frontend/#1383 / GHSA-7xvh-c266-cfr5
• Fix redirect loop when authenticated user is lacking permissions - frontend/#1386

For a complete list of changes, refer to the respective GitHub milestones:

• API server milestone 4.13.6
• Frontend milestone 4.13.6

We thank all organizations and individuals who contributed to this release, from logging issues to taking part in discussions on GitHub & Slack to testing of fixes.

Special thanks to everyone who contributed code to implement enhancements and fix defects:

@ElenaStroebele, @arjavdongaonkar, @aurifi, @ch8matt, @illenko, @sahibamittal, @snieguu, @stohrendorf

dependency-track-apiserver.jar

dependency-track-bundled.jar

frontend-dist.zip

Software Bill of Materials (SBOM)

• API Server: bom.json
• Frontend: bom.json

Sonatype has started to enforce an authentication requirement for OSS Index.

The OSS Index analyzer has historically been enabled by default for Dependency-Track, and configuration of credentials for authentication was not strictly necessary.

This has now changed, and users who wish to continue using OSS Index will need to register for a free account, and configure credentials in the analyzer’s settings.

Please refer to Sonatype’s announcement for further details.

In the midterm, we’ll be looking into enabling OSV per default to compensate for this change.

Fixes:

• Fix CPE matching not being fully case-insensitive - apiserver/#5299
• Improve detection whether version of a github PURL is a commit SHA or release tag - apiserver/#5350
• Make OSS Index credentials required - apiserver/#5351
• Fix occasional NullPointerException when mirroring the NVD via REST API - apiserver/#5352
• Fix /api/v1/tag/policy/{uuid} endpoint returning more tags than are assigned to a policy - apiserver/#5353
• Fix possible failure of NVD mirroring due to corrupted timestamp files - apiserver/#5354
• Fix BOM validation failing due to unrecognized new SPDX license IDs - apiserver/#5355
• Fix new SPDX license IDs not being recognized - apiserver/#5356
• Fix high CPU utilization when watchdog logger is configured - apiserver/#5357
• Fix NullPointerException in GithubMetaAnalyzer when analyzing GitHub Actions - apiserver/#5359
• Fix connection reset during OSV mirroring - apiserver/#5360
• Fix compatibility of custom NuGet repositories with JFrog Artifactory - apiserver/#5381
• Fix custom NuGet repositories not working with Sonatype Nexus - apiserver/#5381
• Fix possible disclosure of private NuGet repository credentials to api.nuget.org - apiserver/#5381 / GHSA-83g2-vgqh-mgxc

For a complete list of changes, refer to the respective GitHub milestones:

• API server milestone 4.13.5
• Frontend milestone 4.13.5

We thank all organizations and individuals who contributed to this release, from logging issues to taking part in discussions on GitHub & Slack to testing of fixes.

Special thanks to everyone who contributed code to implement enhancements and fix defects:

@colinfyfe, @framayo, @jonbally, @snieguu, @stohrendorf

dependency-track-apiserver.jar

dependency-track-bundled.jar

frontend-dist.zip

Software Bill of Materials (SBOM)

• API Server: bom.json
• Frontend: bom.json

Users who cannot perform this upgrade immediately can configure NVD mirroring to be performed via the NVD REST API instead. Refer to the NVD datasource documentation for details.

Features:

• Migrate to NVD 2.0 data feeds - apiserver/#5236

Fixes:

• Handle URLs in composer package metadata pattern - apiserver/#5234
• Fix failing TrivyAnalysisTaskIntegrationTest - apiserver/#5241
• Handle adduser / addgroup removal in Debian base image - apiserver/#5246
• Fix inconsistent ordering in findings endpoints - apiserver/#5247
• Fix failing Trivy OS matching for distro versions with special characters - apiserver/#5249

For a complete list of changes, refer to the respective GitHub milestones:

• API server milestone 4.13.4
• Frontend milestone 4.13.4

We thank all organizations and individuals who contributed to this release, from logging issues to taking part in discussions on GitHub & Slack to testing of fixes.

dependency-track-apiserver.jar

dependency-track-bundled.jar

frontend-dist.zip

Software Bill of Materials (SBOM)

• API Server: bom.json
• Frontend: bom.json

• Add AWS Cognito configuration example - apiserver/#5172

Fixes:

• Fix too many query parameters when retrieving vuln aliases - apiserver/#5167
• Add apiserver health check to Compose files - apiserver/#5171
• Fix OSV ubuntu advisory containing severity without type - apiserver/#5168
• Handle dangling SPDX expression operators - apiserver/#5173
• Fix BOM export failing for projects of type NONE - apiserver/#5178
• Add whitespace sanitization in fuzzySearch CPE to fix CPE validation errors - apiserver/#5176
• Ensure VulnerableSoftware query is able to leverage indexes - apiserver/#5177
• Bulk load component relationships for BOM export - apiserver/#5179
• Improve Composer meta analyzer’s ability to deal with minified metadata - apiserver/#5175
• Fix failing v4.13.1 migration for H2 deployments that pre-date v4.11.0 - apiserver/#5180

For a complete list of changes, refer to the respective GitHub milestones:

• API server milestone 4.13.3
• Frontend milestone 4.13.3

We thank all organizations and individuals who contributed to this release, from logging issues to taking part in discussions on GitHub & Slack to testing of fixes.

Special thanks to everyone who contributed code to implement enhancements and fix defects:

@ch8matt, @jonbally, @vdieieva

dependency-track-apiserver.jar

dependency-track-bundled.jar

frontend-dist.zip

Software Bill of Materials (SBOM)

• API Server: bom.json
• Frontend: bom.json

• Fix failing v4.13.1 migration for MSSQL deployments that pre-date v4.11.0 - apiserver/#4911
• Fix summary notifications not sent when “skip if unchanged” is enabled - apiserver/#4913

For a complete list of changes, refer to the respective GitHub milestones:

• API server milestone 4.13.2
• Frontend milestone 4.13.2

We thank all organizations and individuals who contributed to this release, from logging issues to taking part in discussions on GitHub & Slack to testing of fixes.

dependency-track-apiserver.jar

dependency-track-bundled.jar

frontend-dist.zip

Software Bill of Materials (SBOM)

• API Server: bom.json
• Frontend: bom.json

• Show collection projects using a tag in the tags list - frontend/#1241

Fixes:

• Fix NEW_VULNERABILITIES_SUMMARY notification dispatch failing for PostgreSQL - apiserver/#4859
• Fix team email addresses not being available when publishing scheduled notification emails - apiserver/#4860
• Prevent duplicate tag names and relationships - apiserver/#4861
• Fix missing NONE value in classifier check constraint - apiserver/#4887
• Improve stability of tag binding - apiserver/#4885
• Fix tag deletion failing when tag is used by project collection logic - apiserver/#4888

For a complete list of changes, refer to the respective GitHub milestones:

• API server milestone 4.13.1
• Frontend milestone 4.13.1

We thank all organizations and individuals who contributed to this release, from logging issues to taking part in discussions on GitHub & Slack to testing of fixes.

dependency-track-apiserver.jar

dependency-track-bundled.jar

frontend-dist.zip

Software Bill of Materials (SBOM)

• API Server: bom.json
• Frontend: bom.json