Dependency-Track
Know exactly what is in your software
Ranked #6 in Best software composition analysis tools.
Dependency-Track is an open source platform used by over 20,000 organisations to inventory components. It helps teams find vulnerabilities and enforce policy across the software supply chain.
Company facts
| Social profiles | LinkedIn, X, YouTube, GitHub |
| Brand colour | #08061a |
Facilities and features
Its website also mentions:
- API
- Integrations
What stands out
The product matches components against multiple vulnerability sources including NVD and GitHub Advisories.
“Match components against the NVD, GitHub Advisories, and OSV, plus OSS Index, Snyk, Trivy, and VulnDB.”Dependency-Track, own website
The product uses a CEL engine to evaluate policies and break builds on failure.
“A Common Expression Language (CEL) engine evaluates component policies and breaks the build on a fail.”Dependency-Track, own website
Worth knowing
Upgrading from version 4.x requires a migration guide rather than an in-place upgrade.
“v5 does not upgrade in place.”Dependency-Track, own website
How it ranks
Dependency-Track is ranked 6th of 10 in Best software composition analysis tools (Lister Score 90.0).
#6 in Best software composition analysis tools · Lister Score 90.0
Dependency-Track helps teams find vulnerabilities and enforce policy across the software supply chain.
Matches components against multiple vulnerability sources including NVD and GitHub Advisories.
How the score is made up: fit to this ranking's criteria 40; evidence on its own site 20; how complete its published information is 18; buying information on its own site 12.
“An intelligent component analysis platform Dependency-Track helps organizations identify and reduce risk in the software supply chain,”Dependency-Track, own website
| Rank | Best software composition analysis tools | Score |
|---|---|---|
| 1 | Cloudsmith | 96.0 |
| 2 | Checkmarx | 94.0 |
| 3 | Mend.io | 94.0 |
| 4 | Snyk | 94.0 |
| 5 | Socket | 92.0 |
| 6 | Dependency-Track | 90.0 |
| 7 | Endor Labs | 90.0 |
| 8 | FOSSA | 88.0 |
| 9 | Legit Security | 88.0 |
| 10 | Veracode | 88.0 |
Frequently asked questions
How does Dependency-Track rank on Lister?
Dependency-Track is ranked 6th of 10 in Best software composition analysis tools (Lister Score 90.0).