Skip to content

2025-04-07-v4.13.0.md

Latest commit

 

History

History
195 lines (169 loc) · 12.3 KB

2025-04-07-v4.13.0.md

File metadata and controls

195 lines (169 loc) · 12.3 KB
Raw
title v4.13.0
type major

Highlights:

  • API Key Overhaul. API keys are no longer stored as plain text values in the database, but as SHA3-256 hashes. It will no longer be possible to view the full, plain text API keys in the administration panel. Instead, full keys will only be shown once after their creation. To allow keys to be identifiable despite this change, the API key format was adjusted to include a public identifier portion. Keys generated by version 4.13.0 and later will follow the format odt_<publicId>_<key>, where publicId consists of 8 random characters, and key of the usual 32 random characters. The public ID is intended to identify API keys without disclosing their secret. It will be visible in the UI, and it will also appear in logs.
    • Keys generated by earlier versions of Dependency-Track will continue to work, in their case the first 5 characters are assumed to be the public ID.
    • This feature was discussed and demoed in our February community meeting! Watch it here
  • Collection Projects. Dependency-Track has had support for project hierarchies for a while, but until now their utility was still somewhat limited. Collection projects change this, as they allow parent projects to act as aggregates of their children. While they are a major improvement to the project hierarchy mechanism, there is still more work to be done. And the team is always looking for feedback on how to make it better.
    • This feature was discussed and demoed in our January community meeting! Watch it here
  • Scheduled Summary Notifications. Instead of publishing notifications immediately when a new vulnerability or policy violation is identified, it is now possible to configure scheduled summary notifications. This aids in reducing alert fatigue. Refer to the [notifications documentation] for more details.
  • Reduced Memory Footprint. The persistence framework used by Dependency-Track to interact with the database comes with overambitious caching enabled per default. Disabling this cache mechanism has been a recommendation the team gave to users struggling with memory requirements for a while. After evaluating whether it provides any justifiable benefit at all, it was decided to turn this feature off entirely. Users with large portfolios should see a noticeable drop in heap utilization and pressure on the garbage collector.
  • Observability Improvements. Logs emitted while handling REST API requests now include context about the authenticated user, the path of the endpoint being called, as well as the request method. This makes it easier to trace where problems are occurring, and who initiated the requests that cause them.

Features:

Fixes:

  • Fix failure to synchronize vulnerability aliases when the source of a vulnerability is unrecognized - apiserver/#4767
  • Fix possible NPE during affected version attribution sync - apiserver/#4798
  • Fix occasional JsonParseException during NVD API mirroring - apiserver/#4814
  • Fix UpgradeInitializer halting the entire process upon failure - apiserver/#4818
  • Fix column visibility preference not considered for project list - frontend/#1169
  • Fix tag autocomplete dropdown library style overriding issue - frontend/#1213

Upgrade Notes:

Please make a database backup before upgrading! Some changes in this release are irreversible,
and you won't be able to roll back simply by downgrading the application version!

  • Existing API keys will be automatically hashed during this upgrade. It will not be possible to view them in plain text ever again after the upgrade completed. Outside of making a database backup, consider noting down all the keys you might need somewhere safe before performing this upgrade.
  • Dependency-Track instances will automatically share minimal telemetry information on a daily basis. Find a list of collected data, as well as instructions for opting out, in the [telemetry documentation].

For a complete list of changes, refer to the respective GitHub milestones:

We thank all organizations and individuals who contributed to this release, from logging issues to taking part in discussions on GitHub & Slack to testing of fixes.

Special thanks to everyone who contributed code to implement enhancements and fix defects:

@2000rosser, @AndreVirtimo, @Gepardgame, @Granjow, @LaVibeX, @MM-msr, @Malaydewangan09, @Rudra-Garg, @SaberStrat, @StefanFl, @VinodAnandan, @Zargath, @ad8-adriant, @dhfherna, @jayolee, @mge-mm, @mikael-carneholm-2-wcar, @mjwrona, @rbt-mm, @rkg-mm, @stohrendorf, @valentijnscholten

dependency-track-apiserver.jar
Algorithm Checksum
SHA-1 c5ef70f1e8df186a929a7c2ad24962a3b97af379
SHA-256 0f2af7a93a21850da62c2b2e86babfb0b0f18abd80f380dfb80bf84c59f605e4
dependency-track-bundled.jar
Algorithm Checksum
SHA-1 feeac3362ae6ea5d42cf6dde7e5e079599372eaa
SHA-256 a81e61f1e21a732474a11345d71e7853d50ec2faea1f7d44bacfb29902673ebd
frontend-dist.zip
Algorithm Checksum
SHA-1 5f18d23205cff4627ff6330bca9f70f71810da89
SHA-256 e64676821351096cce62735d28a15b2ae62c4ba66c1b295ab119a9b83f94eef0
Software Bill of Materials (SBOM)

[telemetry documentation]: {{ site.baseurl }}{% link _docs/getting-started/telemetry.md %} [notifications documentation]: {{ site.baseurl }}{% link _docs/integrations/notifications.md %}#configuring-scheduled-notifications