repository·main·Indexed 26 days ago
https://github.com/dependencytrack/dependency-trackAn intelligent Component Analysis platform that leverages Software Bill of Materials (SBOM) to identify and mitigate software supply chain risks. This documentation covers the REST API v2, the dex durable execution engine for workflows-as-code, data migration from v4 to v5 using the v4-migrator, and development environment configurations including Docker Compose, Kafka mTLS, and benchmarking.
Dependency-Track uses a resource-grouped layout for its OpenAPI specification. This structure organizes API definitions around the resources (tags) they represent to improve discoverability and maintainability.
Layout Structure:
openapi.yaml has a corresponding directory under resources/. This directory contains:schemas/ subdirectory containing schemas owned by that resource.shared/{parameters,responses,schemas}/.secret.yaml).**/schemas/** directories to prevent collisions in generated Java classes. If disambiguation is needed, a resource prefix is used (e.g., list-vuln-policy-bundles-response-item.yaml).Dependency-Track uses concurrency keys (e.g., import-bom:<project uuid>) to ensure that background workflows—such as BOM imports, vulnerability analysis, or policy evaluations—do not run concurrently for the same project. This prevents race conditions on project findings and metrics.
To maintain performance at scale (handling backlogs of >200k runs), the engine uses concurrency key wakeups. Instead of scanning the entire backlog on every poll, the scheduler inspects a specialized dex_workflow_concurrency_key_wakeup table containing 'hints' about keys that recently had an event (like a new run being created or an old one completing) that might make them schedulable.
EPSS (Exploit Prediction Scoring System) data is managed by a single authoritative source (the FIRST mirror) and stored in a dedicated EPSS table keyed by CVE ID.
To ensure non-CVE vulnerabilities can benefit from EPSS data, Dependency-Track resolves EPSS values at read time using the alias schema.
Resolution Rules:
Dependency-Track has transitioned from a legacy in-memory event system to a more robust scheduling model. This change affects how tasks are coordinated in clustered deployments and how operators manage settings.
db-scheduler to run once per cluster on a cron schedule. This replaces the old system that required ShedLock and manual lock time management.dex). This engine provides persistence, retries, and observability for complex workflows.db-scheduler to detect dead nodes, providing faster recovery than the previous claim-window-based approach.Dependency-Track manages vulnerability findings through a relationship between components and vulnerabilities. A finding is considered active if it has at least one FINDINGATTRIBUTION record where DELETED_AT is NULL. If all associated attributions have a DELETED_AT timestamp, the finding is considered inactive.
Key behaviors:
DELETED_AT timestamp. This preserves the audit trail and historical metrics.DELETED_AT column is unset (set to NULL), making the finding active again.Dependency-Track uses a consolidated user table to manage different types of users: MANAGED, LDAP, and OIDC. This single-table approach uses a discriminator column (TYPE) to distinguish between user types and enforces data integrity through database-level check constraints.
| User Type | Required Fields |
|---|---|
| MANAGED | username, email, password, last_password_change, non_expiry_password, force_password_change, suspended |
| LDAP | username, email, ldap_dn |
| OIDC | username, email, oidc_subject_identifier |
All users share common relationships with permission and team entities.
openapi-generator to produce JAX-RS interfaces and Java DTOs. The API design follows the Zalando RESTful API Guidelines.Dependency-Track is a multi-module Maven project. The architecture is divided into functional modules, shared building blocks, shared infrastructure, and support libraries. Understanding this structure is essential for locating specific features, APIs, or infrastructure components.
api: Contains the OpenAPI specification for REST API v2 (Spec-first).apiserver: The main application. It hosts REST API v1 (under org.dependencytrack.resources.v1) and REST API v2 (under org.dependencytrack.resources.v2).notification: Notification API, publishers, and templating.package-metadata: Resolves package metadata from package repositories.vuln-analysis: Vulnerability analyzers (e.g., OSS Index, Snyk, Trivy, internal database).vuln-data-source: Adapters for vulnerability feeds (e.g., NVD, GitHub, OSV).cache: Cache API and providers (e.g., memory, database).dex: Durable execution engine.file-storage: File storage API and providers (e.g., local, memory, s3).plugin: Plugin API and runtime used to load providers like notification publishers or vulnerability analyzers.secret-management: Secret storage.alpine: The framework upon which apiserver is built.