https://korea-wg.openchainproject.org/en/tags/dependency-track/Recent content in Dependency-Track on OpenChain KWGHugoenhttps://korea-wg.openchainproject.org/en/guide/tools/7-dependency-track/Mon, 01 Jan 0001 00:00:00 +0000https://korea-wg.openchainproject.org/en/guide/tools/7-dependency-track/<p>Dependency-Track is an open source SBOM management and vulnerability analysis platform managed by OWASP. It continuously monitors component-level vulnerabilities based on uploaded SBOMs (CycloneDX, SPDX) and automatically evaluates policy violations.</p> <ul> <li>GitHub: <a href="https://github.com/DependencyTrack/dependency-track">https://github.com/DependencyTrack/dependency-track</a></li> <li>Official docs: <a href="https://docs.dependencytrack.org/">https://docs.dependencytrack.org/</a></li> <li>License: Apache-2.0</li> </ul> <h2 id="features">Features</h2> <ul> <li><strong>SBOM-based continuous monitoring</strong>: Automatically tracks the latest vulnerabilities per component after uploading SBOMs in SPDX or CycloneDX format</li> <li><strong>Multiple vulnerability data sources</strong>: NVD, OSV, GitHub Advisories, VulnDB, and more</li> <li><strong>Policy engine</strong>: Define rules for license policies, vulnerability severity thresholds, and component allowlists for automatic evaluation</li> <li><strong>REST API</strong>: Integrate with CI/CD pipelines to automatically upload SBOMs and receive feedback at build time</li> <li><strong>Web UI dashboard</strong>: View per-project risk scores, vulnerability status, and license distribution at a glance</li> <li><strong>Notifications</strong>: Send new vulnerability alerts via Slack, email, Webhook, and other channels</li> </ul> <h2 id="installation">Installation</h2> <p>Using Docker Compose is the simplest approach:</p>https://korea-wg.openchainproject.org/en/guide/tools/8-cdxgen-dt/Mon, 01 Jan 0001 00:00:00 +0000https://korea-wg.openchainproject.org/en/guide/tools/8-cdxgen-dt/<p>For companies just starting with open source management, we recommend the <strong>cdxgen + Dependency-Track</strong> combination as a toolset that can establish a basic automation environment within a single day.</p> <p>This guide walks you through every step, from installation and configuration to setting up a license and vulnerability inspection environment and running day-to-day operations.</p> <h2 id="why-cdxgen--dependency-track">Why cdxgen + Dependency-Track</h2> <p>Open source management comes down to two essentials.</p> <ol> <li><strong>Know what is inside</strong> — generating an SBOM (Software Bill of Materials)</li> <li><strong>Continuously monitor risk</strong> — detecting vulnerabilities (CVEs) and license policy violations</li> </ol> <p>cdxgen handles the first, and Dependency-Track handles the second. Both tools are <strong>free open source</strong> under the Apache-2.0 license.</p>