LoginSign Up
← Back to all sparks
D

Dependency-Track

INFRA · APIS
Velocity0.0

Continuous SBOM analysis platform for software supply chain risk

dependencytrack.org ↗

A v5 release candidate train carrying a database migrator that has to work on the first try.

sbomsupply-chain-securitymajor-version-rcdatabase-migrationcel-policy-enginecyclonedx
◆Current state
Dependency-Track is deep in a 5.0.0 release candidate series, cutting rc.2 through rc.5 within a single week. A large share of every release is the v4-migrator: BIGINT casts during extract, ANALYZE on staging tables before transform, component dedup before joining repo metadata, cross-schema type dependencies, trigger deactivation, permission table bootstrap. Nearly every commit in the window is authored by a single maintainer.
◆Where it's heading
This is a major version defined by what it removes and how safely it moves people across. rc.2 dropped the compatibility shim translating v4-era alpine.* and unprefixed property names to dt.* equivalents, and made the API server refuse to start on a legacy key rather than silently misconfigure. Around that migration work, the policy engine keeps gaining inputs — component hash mismatch conditions, latest version publish timestamps exposed to CEL — and latest-version detection is being tuned per ecosystem so Maven reports stable releases rather than prereleases.
◆Prediction
Expect further release candidates focused on migrator robustness before 5.0.0 goes stable, since four of them in one week were still finding extract and transform bugs in the same code path.

◆Recent moves

  1. 2mo ago

    Dependency-Track 5.0.0-rc.5 adds hash mismatch policy conditions

    Extends the policy engine with component hash mismatch conditions and exposes latest-version publish timestamps to CEL, giving policies a time dimension they lacked. The migrator gains completion logs and row-count diff annotations in its verify phase — instrumentation for an operation users only get to run once.

    View source ↗
  2. 2mo ago

    Dependency-Track 5.0.0-rc.4 caps uncompressed repository responses

    Tunes latest-version detection per ecosystem — Cargo, Ruby Gems, and Maven now preferring stable releases over prereleases — and enforces separate limits on compressed and uncompressed repository responses, a decompression-bomb defense. Also fixes ineffective assignment of random BOM refs during import.

    View source ↗
  3. 2mo ago

    Dependency-Track 5.0.0-rc.3 bumps CycloneDX proto to 1.7.1

    Bumps the CycloneDX proto to v1.7.1 and clears six migrator defects, including cross-schema type dependencies and an overly strict schema name validation. The density of migrator fixes across consecutive candidates shows where the risk in this major version sits.

    View source ↗
  4. 2mo ago

    Dependency-Track 5.0.0-rc.2 drops the legacy alpine.* config shim

    Drops the shim that translated v4-era alpine.* and unprefixed configuration properties into their dt.* equivalents, and makes the API server refuse to start when it finds a legacy key rather than starting misconfigured. A deliberate hard failure chosen over a silent one.

    View source ↗