hub / github.com/DependencyTrack/dependency-track

github.com/DependencyTrack/dependency-track @5.0.2

repository ↗ · DeepWiki ↗ · release 5.0.2 ↗ · + Follow

11,421 symbols 78,048 edges 1,580 files 1,231 documented · 11%

What it actually does AI analysis from the code graph — generated when you open this

loading…

README

OWASP Dependency-Track

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM).

[!IMPORTANT] Looking for Dependency-Track v4? * v4 is in maintenance mode on the 4.14.x branch. * v4 documentation: https://dependencytrack.github.io/docs/4.x. * Migrating from v4 to v5? See V5_MIGRATION.md. * v4 will reach end-of-life in December 2026, ~6 months after v5 GA.

Quickstart

Want to kick the tires? Follow the Quickstart tutorial to get a local instance running with Docker Compose in a few minutes.

Documentation

User-facing documentation is rendered at https://dependencytrack.github.io/docs/ and maintained in the docs repository.

Contributing

Community

Dependency-Track is an open source project maintained by a community of contributors. Join the monthly community meeting to hear project updates, ask questions, and meet other users and maintainers.

Extension points exported contracts — how you extend this code

CacheProvider (Interface)

@since 5.0.0 [10 implementers]

cache/api/src/main/java/org/dependencytrack/cache/api/CacheProvider.java

NotificationPublisherFactory (Interface)

@since 5.0.0 [9 implementers]

notification/api/src/main/java/org/dependencytrack/notification/api/publishing/NotificationPublisherFactory.java

Plugin (Interface)

@since 5.0.0 [26 implementers]

plugin/api/src/main/java/org/dependencytrack/plugin/api/Plugin.java

FileStorageProvider (Interface)

@since 5.0.0 [11 implementers]

file-storage/api/src/main/java/org/dependencytrack/filestorage/api/FileStorageProvider.java

NvdDataFeed (Interface)

@since 5.0.0 [30 implementers]

vuln-data-source/nvd/src/main/java/org/dependencytrack/vulndatasource/nvd/NvdDataFeed.java

VulnDataSource (Interface)

A source of vulnerability intelligence data. Data is exchanged in the CycloneDX Bill of Vulnerabilities (BOV) format [8 …

vuln-data-source/api/src/main/java/org/dependencytrack/vulndatasource/api/VulnDataSource.java

IConfigProperty (Interface)

Interface definition for configuration properties. @author Steve Springett @since 1.4.3 [6 implementers]

alpine/alpine-model/src/main/java/alpine/model/IConfigProperty.java

AuthenticationService (Interface)

Interface that defines an authentication service. @author Steve Springett @since 1.0.0 [10 implementers]

alpine/alpine-server/src/main/java/alpine/server/auth/AuthenticationService.java

Core symbols most depended-on inside this repo

put

called by 2197

cache/api/src/main/java/org/dependencytrack/cache/api/Cache.java

called by 2021

vuln-analysis/internal/src/main/java/org/dependencytrack/vulnanalysis/internal/Coordinate.java

build

called by 1534

apiserver/src/main/java/org/dependencytrack/common/MultipartBodyPublisher.java

get

called by 1431

cache/api/src/main/java/org/dependencytrack/cache/api/Cache.java

persist

called by 1361

alpine/alpine-infra/src/main/java/alpine/persistence/AbstractAlpineQueryManager.java

getStatus

called by 1180

apiserver/src/main/java/org/dependencytrack/resources/v1/problems/ProblemDetails.java

add

called by 830

dex/engine/src/main/java/org/dependencytrack/dex/engine/support/Buffer.java

toString

called by 748

apiserver/src/main/java/org/dependencytrack/model/Project.java

Shape

Method 9,540

Class 1,683

Interface 101

Enum 92

Function 5

Languages

Java100%

TypeScript1%

Modules by API surface

apiserver/src/test/java/org/dependencytrack/resources/v1/ProjectResourceTest.java151 symbols

apiserver/src/main/java/org/dependencytrack/persistence/QueryManager.java133 symbols

apiserver/src/main/java/org/dependencytrack/model/Component.java117 symbols

apiserver/src/main/java/org/dependencytrack/model/Vulnerability.java96 symbols

dex/engine/src/test/java/org/dependencytrack/dex/engine/DexEngineImplTest.java93 symbols

apiserver/src/main/java/org/dependencytrack/model/Project.java77 symbols

apiserver/src/test/java/org/dependencytrack/resources/v1/TagResourceTest.java74 symbols

dex/engine-api/src/main/java/org/dependencytrack/dex/engine/api/DexEngineConfig.java69 symbols

apiserver/src/main/java/org/dependencytrack/model/PortfolioMetrics.java65 symbols

apiserver/src/main/java/org/dependencytrack/model/VulnerableSoftware.java63 symbols

apiserver/src/main/java/org/dependencytrack/model/ProjectMetrics.java63 symbols

apiserver/src/test/java/org/dependencytrack/resources/v1/BomResourceTest.java61 symbols

Datastores touched

dtrackDatabase · 1 repos

(mysql)Database · 1 repos

dbDatabase · 1 repos

dexDatabase · 1 repos

nopeDatabase · 1 repos

For agents

$ claude mcp add dependency-track \
  -- python -m otcore.mcp_server <graph>

⬇ download graph artifact