OWASP Dependency-Track v5.0.3 released

OWASP Dependency-Track keeps track of what’s inside your software. Feed it an SBOM and it flags known vulnerabilities and policy violations component by component, then plugs into whatever security and dev tooling you already run.

Version 5.0.3 is a maintenance release backporting five enhancements and eleven bug fixes to the v5 branch, including query optimizations, scheduler and mirroring fixes, a Windows path handling fix, and corrections to VEX/VDR export.

Changelog for v5.0.3:

## What's Changed
### Enhancements 🚀
* Backport: Optimize portfolio-wide findings queries by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/6571
* Backport: Improve default data source config by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/6732
* Backport: dex: add missing indexes on workflow_run_id in task tables by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/6733
* Backport: dex: improve activity task scheduler polling efficiency for deep backlogs by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/6735
* Backport: Improve classification of retryable vuln analysis errors by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/6745
### Bug Fixes 🐛
* Backport: Fix getAffectedProjects endpoint not accounting for suppressed findings by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/6541
* Backport: Fix badges for collection projects showing no metrics by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/6540
* Backport: Fix excessive churn of vulnerable software associations during mirroring by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/6543
* Backport: Fix slow vulnerability database maintenance by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/6544
* Backport: Raise lock timeout for mirror-vuln-data-source activities and set explicit request timeouts for NVD downloads by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/6542
* Backport: exit the JVM when init tasks fail instead of hanging unready by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/6712
* Backport: Fix project sorting by version by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/6715
* Backport: Fix prepare-vuln-analysis activity failing when components have properties without value by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/6714
* Backport: Fix local file storage not anticipating Windows-style paths by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/6713
* Backport: Fix build workflow not running for PRs to release branches by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/6738
* Backport: Fix NPE and redundant queries in VEX/VDR export by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/6743
### Other Changes
* Backport: Use WireMock for NVD vuln data source tests by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/6612
* Backport: Add Squawk for migration linting by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/6737

Full Changelog: https://github.com/DependencyTrack/dependency-track/compare/5.0.2...5.0.3

Full release notes: GitHub releases

• News
• Tools