Dependency-Track 5.1.0 Is Out

Dependency-Track 5.1.0 is now available. It is the first feature release since 5.0 shipped in June.

The headline feature is known exploited vulnerability tracking. Dependency-Track now mirrors KEV catalogs and flags the findings that attackers are already using.

27 people contributed changes in this release, 21 of them for the first time.

Highlights of Dependency-Track 5.1.0

• Known exploited vulnerabilities. Dependency-Track mirrors the CISA and ENISA EU KEV catalogs out of the box and can mirror the VulnCheck community catalog with a free API token. A KEV column and filter appear in the portfolio vulnerability list, project findings, the EPSS view, and the audit views. Matching runs on CVE ID and resolves through vulnerability aliases, so a CISA assertion against CVE-2021-44228 also flags the GHSA record for the same flaw. KEV status feeds component policies and notification filters, so it can drive an alert or a policy violation.

  

  

• VEX documents that name the affected component. Earlier exports pointed every analysis at the project as a whole. That lost track of which component a decision was about, and it broke down when one vulnerability affected several components with different verdicts. Exports now reference the affected components and carry their identities in the document. Imports no longer demand an exact match on the vulnerability source name, which is what kept documents from other tools from applying cleanly. CISA’s guidance asks for the subcomponents a vulnerability originates from, which is what an export now names.

• A portfolio analysis that no longer runs in one burst. 5.0 scheduled an analysis for every project once a day, which meant tens of thousands of runs created inside a minute and upload-triggered analyses stuck behind them for minutes. Each project now records when it was last analyzed, and the task runs continuously, picking up whatever has gone stale and keeping a bounded number of its own analyses in flight. A project that gets analyzed often on upload never becomes due at all.

• More sources of vulnerability intelligence. Japan Vulnerability Notes (JVN) joins the mirrored data sources, covering domestic vendor advisories that never reach the NVD. Checkmarx SCA joins Snyk and OSS Index as an optional analyzer. The GitHub Advisories mirror can now authenticate as a GitHub App instead of with a personal access token.

• CycloneDX 1.7 and better container image results. Dependency-Track accepts CycloneDX 1.7 BOMs, and the export dialog now carries a spec version selector. Dependency-Track also compares Red Hat package versions correctly now, removing a known source of false positives on UBI-based container images.

• Bounded costs on large portfolios. A single database query that runs longer than 60 seconds now gets aborted instead of tying up a connection indefinitely. Portfolio-wide finding lists no longer count the entire result set before returning the first page, so those views report a lower bound instead of an exact total. Project and component metrics updates cost less to run, and package metadata resolution no longer rescans the whole portfolio on every trigger.

• A frontend that fits the work. The project view collects upload, re-analysis, and export into the project header, shows the last BOM import and last analysis as relative timestamps under the project name, and puts type, format, and spec version behind a single Export button. Administrators can configure a site-wide banner, useful for flagging a maintenance window or marking an instance as staging. Korean brings the frontend to 15 languages.

  

Prioritizing by known exploitation

Prioritization usually starts with severity ratings, which are predictions about how much damage a vulnerability could do if someone worked out how to use it. A KEV assertion reports something that has already happened. In a portfolio with thousands of open findings, that is the more useful thing to filter on.

CISA’s binding directive for US federal agencies ties remediation deadlines to catalog membership rather than to severity scores. The EU Cyber Resilience Act puts actively exploited vulnerabilities on a reporting clock of their own, with the first of those obligations arriving in September 2026. The specifics differ by jurisdiction and will keep changing, but both assume an organization can tell, quickly, which of the software it ships carries a vulnerability someone is already using.

Which catalogs to enable is left to the operator. CISA KEV and ENISA EU KEV are free, government-curated, and on by default. VulnCheck’s community catalog covers vulnerabilities absent from CISA KEV and often records exploitation earlier, but it requires an API token and is community-maintained, so it remains opt-in.

Upgrading

5.1.0 upgrades in place from any 5.0.x release. Read the upgrade notes before starting.

Availability

Dependency-Track 5.1.0 is available now as container images from Docker Hub and the GitHub Container Registry. Builds now ship with SLSA provenance attestations. Documentation and the full upgrade notes are at the project documentation site. Full release notes are published for the API server and the frontend. Dependency-Track is free and open source under the OWASP Foundation.