← Directory

Dependency-Track-API-Server

API Server to be used with Dependency-Track Front-End Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and…

  • Security
API Server to be used with Dependency-Track Front-End Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). This approach provides capabilities that traditional Software Composition Analysis (SCA) solutions cannot achieve. For more details about Dependency-Track see the projects website at dependencytrack.org Please note this application is not lightweight and uses 8-12GB of ram to run

Platform availability

Available on 1 of 9 platforms

  • Unraid
  • TrueNAS (not listed)
  • Umbrel (not listed)
  • ZimaOS (not listed)
  • Proxmox (not listed)
  • Helm (not listed)
  • Mac (not listed)
  • Windows (not listed)
  • Linux (not listed)

Health score?A 0-100 score computed nightly from four factors: maintained (40%: recent commits and steady activity), popular (25%: GitHub stars, log scale), easy to install (20%: platforms, install notes, setup guides, Docker image) and light to run (15%: minimum RAM, ARM support). When the source code has been checked, a fifth factor, security check (20%: automated scan for committed secrets, unsafe desktop-app settings, known-vulnerable dependencies and project hygiene; any serious finding caps it at 20), is added. Factors without data are left out and the rest are rescaled.

68/100 Good

Maintained
100last commit 8 days ago
Popular
734,265 GitHub stars
Easy to install
351 install platform, install notes, Docker image
Light to run
204.5 GB minimum RAM, runs on ARM

Availability: platform listings confirmed today, links checked 16 days ago

GitHub stars
4,265
Open issues
1032
Last commit
2026-10-06
Latest release
5.1.2
License
Apache-2.0
Activity
steady

Checked 8 days ago - source: GitHub (DependencyTrack/dependency-track)

Resources & Compatibility

Minimum requirements: 4.5 GB RAM. ARM (e.g. Raspberry Pi) is supported.

Checked 17 days ago - source: Docker Hub image tags and published docs

First-install notes

  • Add the plugin to your Gradle build In your Gradle build file (the file where you list project settings and libraries), add the ca.cutterslade.analyze plugin, and apply it in the root build file if you have several related projects. Without it, the dependency-analysis tasks are missing, so the checks cannot run. source
  • Start in warn mode Set flags like warnUsedUndeclared and warnUnusedDeclared to true so the analyze tasks report problems as warnings instead of failing the build. This lets you fix missing or extra libraries gradually without stopping every compile. source
  • What a failed analysis means If an analysis task fails with usedUndeclaredArtifacts or unusedDeclaredArtifacts, the code is using a library that was not declared, or declaring libraries the code does not use. Update the dependency list to match the code so the build can pass. source

Fetched 16 days ago - each note links to its source

Alternatives (1)

  • FOSSA - FOSSA offers automated license scanning, dependency analysis and reports at each commit.

Checked 3 days ago - source: AlternativeTo

Common questions

Where is the API server's main configuration file, and what can it define?

The central configuration file is application.properties, and it resides in the classpath of the WAR by default. It controls performance tuning parameters and is used for optional external database sources and directory services.

How can I set up a self-hosted instance behind a reverse proxy?

A self-hosted instance can be set up with Docker Compose and Caddy. The same guide covers integrating non-Dockerized source-code projects and Dockerized container projects.

What should I know before moving from v4 to v5?

v4 is in maintenance mode on the 4.14.x branch and reaches end-of-life in December 2026. Migration from v4 to v5 is covered by the V5_MIGRATION.md document.

How can I run a quick local test?

The quickstart tutorial runs a local instance with Docker Compose in a few minutes.

Answers sourced from docs.dependencytrack.org, gist.github.com, github.com

Community

Collected 16 days ago - public community threads