Synthèse
Existing Dependency-Track 4.x deployments continue to receive security and high severity fixes on the 4.14.x line for at least roughly six months after this release. v5 does not upgrade in place: it runs on its own PostgreSQL cluster and ingests v4 data through an offline, one time migrator, so teams should plan a maintenance window. Operators should note the headline breaking changes. PostgreSQL is now the only supported database, replacing H2, MySQL, and Microsoft SQL Server. Notification payl
Existing Dependency-Track 4. x deployments continue to receive security and high severity fixes on the 4. 14. x line for at least roughly six months after this release. v5 does not upgrade in place: it runs on its own PostgreSQL cluster and ingests v4 data through an offline, one time migrator, so teams should plan a maintenance window.
Operators should note the headline breaking changes. PostgreSQL is now the only supported database, replacing H2, MySQL, and Microsoft SQL Server. Notification payloads move to Protobuf, so existing templates need updating. The REST API enforces pagination by default and changes some response schemas. The bundled container image and the executable WAR are discontinued in favor of separate API server and frontend container images.
Lucene based fuzzy vulnerability matching is removed. Full upgrade and migration guides, including a rehearsal procedure and a parallel run option, are available in the documentation. “This release was two years in the making, and not a line of it happened in isolation,” said Niklas Düster, co-leader of OWASP Dependency-Track and lead architect of v5. “Countless individuals and organizations contributed code, infrastructure, funding, and feedback, and many ran the early builds in production so we could scale v5 against real workloads. We are deeply grateful to every one of them.
Dependency-Track v5 is a community effort, and it shows.