OWASP Dependency-Track
OWASP Dependency-Track is a free, open-source platform for inventorying software components from SBOMs, identifying vulnerabilities, and enforcing supply-cha…
What OWASP Dependency-Track is
OWASP Dependency-Track is a free, open-source platform for inventorying software components from SBOMs, identifying vulnerabilities, and enforcing supply-chain policies. It consumes, analyzes, and produces CycloneDX SBOM, HBOM, VEX, and VDR documents. Component matching draws on sources including NVD, GitHub Advisories, OSV, OSS Index, Snyk, Trivy, and VulnDB; integrated EPSS support helps teams prioritize mitigations. Integrity checks flag components when published hashes differ from those served by an upstream registry. A Common Expression Language policy engine evaluates component policies and can break a build when one fails. Alerts can be sent to Slack, Teams, Mattermost, email, or webhooks, with event-field filters. Access controls support least-privilege portfolio permissions, and sign-on is available through OpenID Connect, Active Directory, and LDAP. The platform is self-hosted with API and web interfaces. Version 5.1 uses separate API server and frontend container images and supports Kubernetes. Version 5 requires PostgreSQL, and moving from 4.x requires an offline, one-time migration during a planned maintenance window.
Good
- Free and open source under Apache 2.0.
- Consumes and produces multiple CycloneDX document types.
- Uses several vulnerability intelligence sources.
- Policy failures can break a build.
- Supports Kubernetes deployment.
Watch out
- Self-hosted deployment is required.
- Version 5 requires PostgreSQL.
- Migration from 4.x is not in place.
- Migration requires a planned maintenance window.
Who it suits
It suits teams managing software component risk across projects, from a single team to large enterprise portfolios. Organizations must be able to self-host and meet the PostgreSQL requirement for version 5.
Verdict
Dependency-Track brings SBOM inventory, vulnerability matching, policy checks, and alert routing into a self-hosted platform. Its PostgreSQL requirement and deliberate migration path make deployment planning important, especially for version 4 users.
Plans and prices
From OWASP Dependency-Track's own pricing page, checked 5 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Dependency-Track | Free | Free and open source under the Apache 2.0 license · Self-hosted deployment |
The facts
Each one read from OWASP Dependency-Track's own pages, with the date it was checked.
What it does
- Access and identity
- The platform supports least-privilege portfolio access control and single sign-on via OpenID Connect, with Active Directory and LDAP.checked 5 Oct 2026
- Community
- The project directs users to community support through Slack, GitHub Discussions, a mailing list, and YouTube.checked 5 Oct 2026
- Database requirement
- Version 5 standardizes on PostgreSQL; H2, MySQL, and SQL Server are no longer supported.checked 5 Oct 2026
- Deployment
- Version 5.1 is distributed as separate API server and frontend container images, and Kubernetes is supported.checked 5 Oct 2026
- Integrations
- Alerts can be routed to Slack, Teams, Mattermost, email, and webhooks, with filters based on event fields.checked 5 Oct 2026
- Integrity checks
- It flags components whose published hashes diverge from those served by the upstream registry.checked 5 Oct 2026
- Intended users
- The platform is described as serving organizations from a single team to enterprise portfolios of hundreds of thousands of projects.checked 5 Oct 2026
- Migration limit
- Version 5 does not upgrade in place from 4.x; migration uses an offline, one-time migrator and requires a planned maintenance window.checked 5 Oct 2026
- Policies
- A Common Expression Language policy engine evaluates component policies and can break the build when a policy fails.checked 5 Oct 2026
- Purpose
- Dependency-Track inventories software components from SBOMs, identifies vulnerabilities, and helps enforce policy across the software supply chain.checked 5 Oct 2026
- Risk prioritization
- Integrated EPSS support helps prioritize vulnerability mitigation.checked 5 Oct 2026
- SBOM formats
- It consumes, analyzes, and produces CycloneDX SBOM, HBOM, VEX, and VDR documents.checked 5 Oct 2026
- Vulnerability intelligence
- It matches components against the NVD, GitHub Advisories, OSV, OSS Index, Snyk, Trivy, and VulnDB.checked 5 Oct 2026
The company
- Founded
- 2013checked 28 Sep 2026
Alternatives to OWASP Dependency-Track
- 1
Ortelius
Free planWebAPISelf-hosted7.1From $40 a month - 2
sbomify
Free planWebAPILinuxmacOS7.0From $159 a month - 3
ReARM
Free planWebAPISelf-hosted6.9From $75 a month - 4
Exodos Labs
Free planWebAPISelf-hosted6.7From $29 a month - 5
Codenotary Trustcenter
WebAPILinuxmacOS6.6From $3,600 a month - 66.5From $150,000 a month