Dependency-Track
OWASP platform that ingests SBOMs and continuously monitors the components in them for known vulnerabilities.
0 members list Dependency-Track, unchanged over the last 12 weeks, data as of 24 October 2026
Members who list Dependency-Track in their Stack, by week.
Be the first to add Dependency-Track
Nobody on Stackness runs Dependency-Track yet. Add it to your stack and you're the first member running it.
About Dependency-Track
Dependency-Track is an open source platform for managing software supply chain risk through software bill of materials (SBOM) analysis. It allows organizations to track all components across their software projects, including libraries, containers, operating systems, and firmware. The platform continuously analyzes components against multiple vulnerability data sources to identify security, operational, and license risks. It supports ingesting CycloneDX-formatted SBOMs via REST API, CI/CD plugins, or a web interface, then monitors the inventory as new vulnerabilities and policy changes emerge. Findings can be routed to external tools through webhooks and integrations.
Dependency-Track was developed by DependencyTrack and is released under the Apache 2.0 license. The platform is built in Java and includes features for policy enforcement through an expression-based engine, automated triage of findings, and supply chain integrity verification. It supports integration with multiple vulnerability intelligence sources including the National Vulnerability Database, Sonatype OSS Index, and GitHub Advisories.
Checked 24 October 2026.
Nobody on Stackness runs Dependency-Track yet.
Sign up and add itPosts about Dependency-Track
- Can a coding agent find vulnerabilities in your codebase? Where the security pass goes: pre-commit, pull request or schedule
Agents found the PHP bugs fixed on 21 October 2026, but on real apps 82-86% of agent findings were false. Three security layers, with commands.