Features:

• Application context is now configurable in the Docker container
• SVG badges may now be retrieved via the project name and version
• Added Hex repository support for Erlang, Elixir, and other BEAM languages
• Added configurable support for defining components as internal which are not subject to external analysis
• Increased CPE analysis precision for components with CPEs containing a value in the update field

Fixes:

• Fixed defect in /api/v1/project that returned a server error if the ‘name’ parameter was specified
• Fixed defect resulting in invalid gzip response body when Accept-Encoding was not specified
• Fixed defect resulting in licenses not being loaded if Dependency-Track is deployed to a directory containing a space
• Changed behavior when parsing an invalid CPE to display a single line warning rather than the full stack trace
• Fixed defect resulting in a project not being able to be deleted when that project was part of a notification rule
• Fixed encoding issue affecting project names containing special characters

Security:

• GHSA-4gqv-hcmg-jw33 Cross-Site Scripting (XSS): Persistent
• GHSA-6j82-qv49-r46p Cross-Site Scripting (XSS): Persistent

Upgrade Notes:

• Support for consuming Dependency-Check v4.x XML reports has been removed
• The following can safely be (optionally) dropped upon a successful upgrade (consult log):
  • Tables:
    • SCANS_COMPONENTS
    • SCAN
  • Columns:
    • LAST_SCAN_IMPORTED (in PROJECT table)

dependency-track-embedded.war #

Algorithm	Checksum
SHA-1	e946c65ec0ff5ba12e843789b917caab635bfe62
SHA-256	bd02a522a8c9beeb8dd7964f07eb27a7a02ce8bbf6a7c8af3378bb26fc98a087

dependency-track.war #

Algorithm	Checksum
SHA-1	22da81fb91b5641fcb805c74063c11e521fe0ad4
SHA-256	9207e25b19d34b57804f25e9881e663ebb56333520b039c5ccfd93209295b0a1