OWASP Dependency-Track v5.2.1 released

OWASP Dependency-Track is a component analysis platform that tracks the vulnerabilities in the software you ship, based on your SBOMs.

Version 5.2.1 is a bugfix release on top of v5.2.0. Highlights include:

Fix for an ineffective ACL check on /v1/finding/project/{uuid}/analyze
Fix for BOM validation failing when the XML contains CDATA
Fix for tag maintenance failing when a tag is only used by collection projects
Fix for a missing collection tag in project lookup responses
BOM upload tokens now resolve to root workflow runs only
Pipe-separated UUIDs accepted on the dependency graph path
Analyzers are skipped if checking whether they are enabled fails
Unknown or retired vulnerability sources are mapped to UNKNOWN in the v4 migrator
eMudhra removed from the container image's cacerts
Alpine base image bumped to 3.24.3

As usual, the project notes to read the upgrade notes before upgrading your instance.

Full changelog and release notes: GitHub releases

Happy tracking! :-)

• News
• Tools