Dependency-Track
Know exactly what is in your software
Dependency-Track is an open source platform used by over 20,000 organisations to inventory components. It helps teams find vulnerabilities and enforce policy across the software supply chain.
| Website | dependencytrack.org |
Company facts
| Social profiles | LinkedIn, X, YouTube, GitHub |
| Brand colour | #08061a |
Facilities and features
- API
- Integrations
What stands out
The product matches components against multiple vulnerability sources including NVD and GitHub Advisories.
“Match components against the NVD, GitHub Advisories, and OSV, plus OSS Index, Snyk, Trivy, and VulnDB.”Dependency-Track, own website
The product uses a CEL engine to evaluate policies and break builds on failure.
“A Common Expression Language (CEL) engine evaluates component policies and breaks the build on a fail.”Dependency-Track, own website
Worth knowing
Upgrading from version 4.x requires a migration guide rather than an in-place upgrade.
“v5 does not upgrade in place.”Dependency-Track, own website
Strengths and trade-offs
- The product matches components against multiple vulnerability sources including NVD and GitHub Advisories.
- The product uses a CEL engine to evaluate policies and break builds on failure.
Appears in
How Dependency-Track ranks
#6 in Best software composition analysis tools
How the score is made up: Evidence on its own site 20; How complete its published information is 18; Fit to this ranking's criteria 40; Buying information on its own site 12.
“An intelligent component analysis platform Dependency-Track helps organizations identify and reduce risk in the software supply chain,”Dependency-Track, own website
Alternatives to Dependency-Track
 CloudsmithControl and security for your AI-driven software supply chain | #1 in Best software composition analysis tools | 96.0 |
 CheckmarxApplication security testing platform with bug detection | #2 in Best software composition analysis tools | 94.0 |
 Mend.ioUnified governance for software and AI security | #3 in Best software composition analysis tools | 94.0 |
 Snyk | #4 in Best software composition analysis tools | 94.0 |
 SocketSocket for supply chain attack prevention | #5 in Best software composition analysis tools | 92.0 |
 Endor LabsCode without compromise for secure AI development | #7 in Best software composition analysis tools | 90.0 |
Questions about Dependency-Track
Where does Dependency-Track rank?
Dependency-Track is ranked #6 in Best software composition analysis tools (Lister Score 90.0).
What are the best alternatives to Dependency-Track?
The closest alternatives on Lister are Cloudsmith (#1 in Best software composition analysis tools), Checkmarx (#2 in Best software composition analysis tools) and Mend.io (#3 in Best software composition analysis tools).
Is this your company?
Claim Dependency-Track to suggest corrections to its listing (pricing, features, details) or ask about an enhanced profile. We review every claim before anything changes.