Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM).
Warning
Dependency-Track v5 is currently in release candidate stage and not yet generally available.
v5 release candidates are published for testing and feedback. They are not
recommended for production deployments. The release candidate images are
tagged 5.0.0-rc.<N> and are not pulled by :5-snapshot.
For production use, stay on the latest v4 release.
Important
Looking for Dependency-Track v4?
- v4 is in maintenance mode on the
4.14.xbranch. - v4 documentation: https://docs.dependencytrack.org/.
- Migrating from v4 to v5? See V5_MIGRATION.md.
- v4 will reach end-of-life ~6 months after v5 GA.
Want to kick the tires? Follow the Quickstart tutorial to get a local instance running with Docker Compose in a few minutes.
User-facing documentation is rendered at dependencytrack.github.io/docs/next and maintained in the docs repository.
Dependency-Track is an open source project maintained by a community of contributors. Join the monthly community meeting to hear project updates, ask questions, and meet other users and maintainers.
- frontend: Frontend repository
- docs: Documentation repository
- helm-charts: Helm charts
- community: Community resources