---
title: v4.11.0
type: major
---

**Highlights:**

* **Optimized BOM Ingestion**. The logic that governs how uploaded BOMs are processed and ingested into Dependency-Track has been
overhauled to be more reliable and efficient. Further, BOM processing is now an atomic operation, such that errors
occurring midway do not cause a partial state to be left behind. De-duplication of components and services is more
predictable, and log messages emitted during processing contain additional context, making them easier to correlate.
Because the new implementation can have a big impact on how Dependency-Track behaves regarding BOM uploads,
it is disabled by default for this release. It may be enabled in the administration panel under
*Configuration* -> *Experimental*.
* **BOM Validation**. Historically, Dependency-Track did not validate uploaded BOMs and VEXs against the CycloneDX
schema. While this allowed BOMs to be processed that did not strictly adhere to the schema, it could also lead to confusion
when uploaded files were accepted, but then failed to be ingested during asynchronous processing. Starting with this
release, uploaded files will be rejected if they fail schema validation. Note that this may reveal issues in BOM
generators that currently produce invalid CycloneDX documents. Validation may be turned off in the
administration panel under *Configuration* -> *BOM Formats*.
  * *This feature was demoed in our April community meeting! Watch it [here](https://www.youtube.com/watch?v=3iIeajRJK8o&t=450s)*
* **Global Vulnerability Audit View**. This new interface allows users to discover and filter vulnerabilities that affect
their portfolio, across all projects. When portfolio access control is enabled, this view is limited to projects a user
has explicit access to. It is possible to inspect individual findings, or aggregates grouped by vulnerability,
making it possible to spot the most prevalent vulnerabilities.
  * *This feature was demoed in our April community meeting! Watch it [here](https://www.youtube.com/watch?v=3iIeajRJK8o&t=572s).*
* **Trivy Analyzer Integration**. It is now possible to leverage [Trivy] in [server mode] for vulnerability analysis.
  * Refer to the [analyzer's documentation]({{ site.baseurl }}{% link _docs/datasources/trivy.md %}) for further details,
  in particular the [known limitations]({{ site.baseurl }}{% link _docs/datasources/trivy.md %}#known-limitations).
  * *This feature was demoed in our April community meeting! Watch it [here](https://www.youtube.com/watch?v=3iIeajRJK8o&t=725s).*
* **Extended Localization**. The UI now supports 12 additional languages. Users can change their language preference
in their profile settings. While the Portuguese, Brazilian Portuguese, and Spanish translations were provided by a native speaker
(thanks [@fnxpt]!), the majority of languages are currently machine-translated. Translation improvements are a great
way to contribute to the project, please find additional details [here](https://github.com/DependencyTrack/frontend?tab=readme-ov-file#internationalization-i18n).
* **Official Helm Chart**. The Dependency-Track project now offers an official Helm chart for Kubernetes deployments.
Community input and contributions are highly requested. The chart repository can be found at
[https://github.com/DependencyTrack/helm-charts](https://github.com/DependencyTrack/helm-charts).
It is also available through [Artifact Hub](https://artifacthub.io/packages/helm/dependencytrack/dependency-track).

**Features:**

* Add global vulnerability audit view - [apiserver/#2472]
* Add support for vulnerability analysis with Trivy - [apiserver/#3259]
* Return processing token when cloning a project - [apiserver/#3260]
* Only show projects that haven't been added to the team yet when configuring ACLs - [apiserver/#3261]
* Clarify OpenID Connect group mapping to teams - [apiserver/#3269]
* Add option to configure token for Webhook notifications - [apiserver/#3275]
* Add notifications for user creation and deletion - [apiserver/#3275]
* Pre-process CWE dictionary, drop `CWE` table - [apiserver/#3284]
* Add "Show in Dependency Graph" button in "Affected Projects" list - [apiserver/#3285]
* Document risk score calculation - [apiserver/#3347]
* Make processing of uploaded BOMs atomic - [apiserver/#3357]
* Improve performance of BOM processing - [apiserver/#3357]
* Add more context to logs emitted during BOM processing - [apiserver/#3357]
  * BOM format, spec version, serial number, and version
  * Project UUID, name, and version
* Store severities in database instead of computing them ad-hoc in-memory - [apiserver/#3408]
* Add OIDC docs for large enterprise configuration using Azure AD - [apiserver/#3414]
* Make subject prefix for email notifications configurable - [apiserver/#3422]
* Support toggling between active / inactive projects in the "Affected Projects" list - [apiserver/#3425]
* Add attribution notice to NVD documentation - [apiserver/#3490]
* Bump CWE dictionary to v4.13 - [apiserver/#3491]
* Align retry configuration and behavior across analyzers - [apiserver/#3494]
* Add support for component properties - [apiserver/#3499]
* Add auto-generated changelog to GitHub releases - [apiserver/#3502]
* Bump SPDX license list to v3.23, bringing in 91 new licenses - [apiserver/#3508]
* Validate uploaded BOMs against CycloneDX schema prior to processing them - [apiserver/#3522]
* Improve observability of Lucene search indexes - [apiserver/#3535]
* Add support for Hackage repositories - [apiserver/#3549]
* Add support for Nix repositories - [apiserver/#3549]
* Add *required permissions* to OpenAPI descriptions of endpoints - [apiserver/#3557]
* Add support for exporting findings in SARIF format - [apiserver/#3561]
* Ingest vulnerability alias information from VulnDB - [apiserver/#3588]
* Properly validate UUID request parameters to prevent internal server errors - [apiserver/#3590]
* Document pagination query parameters in OpenAPI specification - [apiserver/#3625]
* Document sorting query parameters in OpenAPI specification - [apiserver/#3631]
* Gracefully handle unique constraint violations - [apiserver/#3648]
* Log debug information upon possible secret key corruption - [apiserver/#3651]
* Add support for worker pool drain timeout - [apiserver/#3657]
* Fall back to no authentication when OSS Index API token decryption fails - [apiserver/#3661]
* Include project details in MS Teams notification for *BOM_PROCESSING_FAILED* - [apiserver/#3666]
* Show component count in projects list - [frontend/#683]
* Add current *fail*, *warn*, and *info* values to bottom of policy violation metrics - [frontend/#707]
* Remove unused policy violation widget - [frontend/#710]
* Use consistent coloring for "Suppressed" metrics - [frontend/#712]
* Show policy violations by state and classification - [frontend/#717]
* Show footer counters in "Portfolio Vulnerabilities" metrics  - [frontend/#718]
* Improve UX of the project active / inactive toggle - [frontend/#721]
* Show publisher name when expanding rows in the "Alerts" table - [frontend/#728]
* Improve tooltip clarity for project vulnerabilities - [frontend/#733]
* Show badges on "Policy Violations" tab - [frontend/#744]
* Add ESLint and prettier for consistent code formatting - [frontend/#752]
* Display *created* and *last used* timestamps for API keys - [frontend/#768]
* Display API key comments and make them editable - [frontend/#768]
* Add *internal* column to component search view - [frontend/#775]
* Add *classification* badge to component details to highlight *internal* components - [frontend/#776]
* Add *group* to component breadcrumb - [frontend/#777]
* Add *deprecated* column to license list - [frontend/#792]
* Use *concise* endpoint to populate license list - [frontend/#793]
* Display *comment* field of external references - [frontend/#803]
* Add support for 12 new languages, and localization based on browser language or custom preference - [frontend/#805]
* Improve contrast ratio on progress bars - [frontend/#816]
* Add language picker to profile dropdown - [frontend/#824]
* Display EPSS score and percentile on vulnerability view - [frontend/#832]

**Fixes:**

* Fix policy violations not being considered when cloning a project - [apiserver/#3248]
* Fix `StackOverflowError` when processing BOMs with deeply nested component structures - [apiserver/#3357]
* Fix inconsistent component de-duplication during BOM processing, causing varying components counts in successive uploads - [apiserver/#3357]
* Fix components erroneously being de-duplicated when only a single attribute of their [component identity] is identical - [apiserver/#3357]
* Fix components defined in the BOM node `metadata.component.components` not being imported - [apiserver/#3357]
* Fix withdrawn GitHub Advisories being mirrored - [apiserver/#3394]
* Fix broken image in OIDC documentation - [apiserver/#3411]
* Fix VulnDB parser being unable to import vulnerability records when `nvd_additional_information` is empty - [apiserver/#3437]
* Fix `URISyntaxException` when NPM PURL contains special characters - [apiserver/#3456]
* Fix finding attribution date not being retained when cloning a project - [apiserver/#3488]
* Fix Cargo repository metadata analyzer not being invoked - [apiserver/#3511]
* Fix type of `purl` fields in Swagger docs - [apiserver/#3512]
* Fix CI build status badge - [apiserver/#3513]
* Fix `bom` and `vex` request fields not being visible in OpenAPI spec - [apiserver/#3557]
* Fix unclear error response when base64 encoded `bom` and `vex` values exceed character limit - [apiserver/#3558]
* Fix unhandled `NotFoundException`s causing a `HTTP 500` response - [apiserver/#3559]
* Fix inability to store PURLs longer than 255 characters - [apiserver/#3560]
* Disable automatic API key generation for newly created teams - [apiserver/#3574]
* Fix severity not being set for vulnerabilities from VulnDB - [apiserver/#3595]
* Fix `JDOFatalUserException` for long reference URLs from OSS Index - [apiserver/#3650]
* Fix unhandled `ClientErrorException`s causing a `HTTP 500` response - [apiserver/#3659]
* Fix unique constraint violation during NVD mirroring via feed files - [apiserver/#3664]
* Fix `VUE_APP_SERVER_URL` being ignored - [frontend/#682]
* Fix visibility of "Vulnerabilities" and "Policy Violations" columns not being toggle-able individually - [frontend/#686]
* Fix finding search routes - [frontend/#689]
* Fix CI build status badge - [frontend/#699]
* Fix incorrect calculation of "Audited Violations" and "Audited Vulnerabilities" percentages - [frontend/#704]
* Fix percentage calculation to consistently round to two decimal places - [frontend/#708]
* Fix percentage calculation edge cases - [frontend/#719]
* Fix "Outdated Only" button being disabled when dependency graph is not available - [frontend/#725]
* Fix redundant requests to `/api/v1/component` when loading project page - [frontend/#726]
* Fix column visibility preferences triggering redundant requests - [frontend/#727]
* Fix `@<version>` being appended when rendering CPEs in "Affected Components" view - [frontend/#748]
* Fix aliases not being displayed in vulnerabilities list - [frontend/#766]
* Fix link to *portfolio access control* view - [frontend/#774]
* Fix *Download BOM* button requiring higher privileges than necessary - [frontend/#812]

**Upgrade Notes:**

* To enable the optimized BOM ingestion, toggle the *BOM Processing V2* option in the administration panel
under *Configuration* -> *Experimental*
* Validation of uploaded BOMs and VEXs is enabled per default, but can be disabled in the administration panel
under *Configuration* -> *BOM Formats* -> *BOM Validation*
* The `CWE` table is dropped automatically upon upgrade, it has been unused since v4.5
* The default logging configuration ([logback.xml]) was updated to include the [Mapped Diagnostic Context] (MDC)
  * Users who [customized their logging configuration] are recommended to follow this change
* Severities of vulnerabilities that previously had `NULL` severities in the database will be computed
and updated automatically upon upgrade, based on CVSSv2, CVSSv3, and OWASP Risk Rating scores
  * Database updates are batched, the entire procedure should complete 30s to 1min
* The following configuration properties were renamed:
  * `ossindex.retry.backoff.max.duration` → `ossindex.retry.backoff.max.duration.ms`
  * `snyk.retry.exponential.backoff.multiplier` → `snyk.retry.backoff.multiplier`
  * `snyk.retry.exponential.backoff.initial.duration.seconds` → `snyk.retry.backoff.initial.duration.ms`
  * `snyk.retry.exponential.backoff.max.duration.seconds` → `snyk.retry.backoff.max.duration.ms`
* Configuration properties for retry durations are now specified in milliseconds instead of seconds
* The following default values for configuration properties have changed:
  * `ossindex.retry.backoff.max.duration.ms`: 600000ms (10min) → 60000ms (1min)
* The `name` tag of the `resilience4j_retry_calls_total` for OSS Index has changed from `ossIndexRetryer` to `ossindex-api`
* The types of the following columns are changed from `VARCHAR(255)` to `VARCHAR(786)` automatically upon upgrade:
  * `COMPONENT.PURL`
  * `COMPONENT.PURLCOORDINATES`
  * `COMPONENTANALYSISCACHE.TARGET`
  * `PROJECT.PURL`

For a complete list of changes, refer to the respective GitHub milestones:

* [API server milestone 4.11.0](https://github.com/DependencyTrack/dependency-track/milestone/25?closed=1)
* [Frontend milestone 4.11.0](https://github.com/DependencyTrack/frontend/milestone/16?closed=1)

We thank all organizations and individuals who contributed to this release, from logging issues to taking part in discussions on GitHub & Slack to testing of fixes.

Special thanks to everyone who contributed code to implement enhancements and fix defects:  
[@2000rosser], [@AnthonyMastrean], [@LaVibeX], [@MangoIV], [@Robbilie], [@VithikaS], [@a5a351e7], [@acdha], [@aravindparappil46],
[@baburkin], [@fnxpt], [@kepten], [@leec94], [@lukas-braune], [@malice00], [@mehab], [@mge-mm]
[@mikkeschiren], [@mykter], [@rbt-mm], [@rkesters], [@rkg-mm], [@sahibamittal], [@sebD], [@setchy], [@validide]

###### [dependency-track-apiserver.jar](https://github.com/DependencyTrack/dependency-track/releases/download/4.11.0/dependency-track-apiserver.jar)

| Algorithm | Checksum                                                         |
|:----------|:-----------------------------------------------------------------|
| SHA-1     | a9dae58a25c8aeeb54134ff054214505eb170db9                         |
| SHA-256   | 03160957fced99c3d923bbb5c6cb352740da1970bd4775b52bb451b95c4cefaf |

###### [dependency-track-bundled.jar](https://github.com/DependencyTrack/dependency-track/releases/download/4.11.0/dependency-track-bundled.jar)

| Algorithm | Checksum                                                         |
|:----------|:-----------------------------------------------------------------|
| SHA-1     | 59b78c3f6b1979ba29c1bd754b7dc1005101fc49                         |
| SHA-256   | 1a34808cd6c7a9bf7b181e4f175c077f1ee5d5a9daf327b330db9b1c63aac2d3 |

###### [frontend-dist.zip](https://github.com/DependencyTrack/frontend/releases/download/4.11.0/frontend-dist.zip)

| Algorithm | Checksum                                                                            |
|:----------|:------------------------------------------------------------------------------------|
| SHA-1     | 80cddddaf5c9c73676065d4ab6fe7b3eff3ec8de                                            |
| SHA-256   | 9c51c337f4b2a7e78730c70473cd24070773a0982d1c0ee6c13f9a6f18a756d5  frontend-dist.zip |

###### Software Bill of Materials (SBOM)

* API Server: [bom.json](https://github.com/DependencyTrack/dependency-track/releases/download/4.11.0/bom.json)
* Frontend: [bom.json](https://github.com/DependencyTrack/frontend/releases/download/4.11.0/bom.json)

[apiserver/#2472]: https://github.com/DependencyTrack/dependency-track/pull/2472
[apiserver/#3248]: https://github.com/DependencyTrack/dependency-track/pull/3248
[apiserver/#3259]: https://github.com/DependencyTrack/dependency-track/pull/3259
[apiserver/#3260]: https://github.com/DependencyTrack/dependency-track/pull/3260
[apiserver/#3261]: https://github.com/DependencyTrack/dependency-track/pull/3261
[apiserver/#3269]: https://github.com/DependencyTrack/dependency-track/pull/3269
[apiserver/#3275]: https://github.com/DependencyTrack/dependency-track/pull/3275
[apiserver/#3284]: https://github.com/DependencyTrack/dependency-track/pull/3284
[apiserver/#3285]: https://github.com/DependencyTrack/dependency-track/pull/3285
[apiserver/#3347]: https://github.com/DependencyTrack/dependency-track/pull/3347
[apiserver/#3357]: https://github.com/DependencyTrack/dependency-track/pull/3357
[apiserver/#3368]: https://github.com/DependencyTrack/dependency-track/pull/3368
[apiserver/#3394]: https://github.com/DependencyTrack/dependency-track/pull/3394
[apiserver/#3408]: https://github.com/DependencyTrack/dependency-track/pull/3408
[apiserver/#3411]: https://github.com/DependencyTrack/dependency-track/pull/3411
[apiserver/#3414]: https://github.com/DependencyTrack/dependency-track/pull/3414
[apiserver/#3422]: https://github.com/DependencyTrack/dependency-track/pull/3422
[apiserver/#3425]: https://github.com/DependencyTrack/dependency-track/pull/3425
[apiserver/#3437]: https://github.com/DependencyTrack/dependency-track/pull/3437
[apiserver/#3456]: https://github.com/DependencyTrack/dependency-track/pull/3456
[apiserver/#3488]: https://github.com/DependencyTrack/dependency-track/pull/3488
[apiserver/#3490]: https://github.com/DependencyTrack/dependency-track/pull/3490
[apiserver/#3491]: https://github.com/DependencyTrack/dependency-track/pull/3491
[apiserver/#3494]: https://github.com/DependencyTrack/dependency-track/pull/3494
[apiserver/#3499]: https://github.com/DependencyTrack/dependency-track/pull/3499
[apiserver/#3502]: https://github.com/DependencyTrack/dependency-track/pull/3502
[apiserver/#3508]: https://github.com/DependencyTrack/dependency-track/pull/3508
[apiserver/#3511]: https://github.com/DependencyTrack/dependency-track/pull/3511
[apiserver/#3512]: https://github.com/DependencyTrack/dependency-track/pull/3512
[apiserver/#3513]: https://github.com/DependencyTrack/dependency-track/pull/3513
[apiserver/#3522]: https://github.com/DependencyTrack/dependency-track/pull/3522
[apiserver/#3535]: https://github.com/DependencyTrack/dependency-track/pull/3535
[apiserver/#3549]: https://github.com/DependencyTrack/dependency-track/pull/3549
[apiserver/#3557]: https://github.com/DependencyTrack/dependency-track/pull/3557
[apiserver/#3558]: https://github.com/DependencyTrack/dependency-track/pull/3558
[apiserver/#3559]: https://github.com/DependencyTrack/dependency-track/pull/3559
[apiserver/#3560]: https://github.com/DependencyTrack/dependency-track/pull/3560
[apiserver/#3561]: https://github.com/DependencyTrack/dependency-track/pull/3561
[apiserver/#3574]: https://github.com/DependencyTrack/dependency-track/pull/3574
[apiserver/#3588]: https://github.com/DependencyTrack/dependency-track/pull/3588
[apiserver/#3590]: https://github.com/DependencyTrack/dependency-track/pull/3590
[apiserver/#3595]: https://github.com/DependencyTrack/dependency-track/pull/3595
[apiserver/#3625]: https://github.com/DependencyTrack/dependency-track/pull/3625
[apiserver/#3631]: https://github.com/DependencyTrack/dependency-track/pull/3631
[apiserver/#3648]: https://github.com/DependencyTrack/dependency-track/pull/3648
[apiserver/#3650]: https://github.com/DependencyTrack/dependency-track/pull/3650
[apiserver/#3651]: https://github.com/DependencyTrack/dependency-track/pull/3651
[apiserver/#3657]: https://github.com/DependencyTrack/dependency-track/pull/3657
[apiserver/#3659]: https://github.com/DependencyTrack/dependency-track/pull/3659
[apiserver/#3661]: https://github.com/DependencyTrack/dependency-track/pull/3661
[apiserver/#3664]: https://github.com/DependencyTrack/dependency-track/pull/3664
[apiserver/#3666]: https://github.com/DependencyTrack/dependency-track/pull/3666

[frontend/#682]: https://github.com/DependencyTrack/frontend/pull/682
[frontend/#683]: https://github.com/DependencyTrack/frontend/pull/683
[frontend/#686]: https://github.com/DependencyTrack/frontend/pull/686
[frontend/#689]: https://github.com/DependencyTrack/frontend/pull/689
[frontend/#699]: https://github.com/DependencyTrack/frontend/pull/699
[frontend/#704]: https://github.com/DependencyTrack/frontend/pull/704
[frontend/#707]: https://github.com/DependencyTrack/frontend/pull/707
[frontend/#708]: https://github.com/DependencyTrack/frontend/pull/708
[frontend/#710]: https://github.com/DependencyTrack/frontend/pull/710
[frontend/#712]: https://github.com/DependencyTrack/frontend/pull/712
[frontend/#717]: https://github.com/DependencyTrack/frontend/pull/717
[frontend/#718]: https://github.com/DependencyTrack/frontend/pull/718
[frontend/#719]: https://github.com/DependencyTrack/frontend/pull/719
[frontend/#721]: https://github.com/DependencyTrack/frontend/pull/721
[frontend/#725]: https://github.com/DependencyTrack/frontend/pull/725
[frontend/#726]: https://github.com/DependencyTrack/frontend/pull/726
[frontend/#727]: https://github.com/DependencyTrack/frontend/pull/727
[frontend/#728]: https://github.com/DependencyTrack/frontend/pull/728
[frontend/#733]: https://github.com/DependencyTrack/frontend/pull/733
[frontend/#744]: https://github.com/DependencyTrack/frontend/pull/744
[frontend/#748]: https://github.com/DependencyTrack/frontend/pull/748
[frontend/#752]: https://github.com/DependencyTrack/frontend/pull/752
[frontend/#766]: https://github.com/DependencyTrack/frontend/pull/766
[frontend/#768]: https://github.com/DependencyTrack/frontend/pull/768
[frontend/#774]: https://github.com/DependencyTrack/frontend/pull/774
[frontend/#775]: https://github.com/DependencyTrack/frontend/pull/775
[frontend/#776]: https://github.com/DependencyTrack/frontend/pull/776
[frontend/#777]: https://github.com/DependencyTrack/frontend/pull/777
[frontend/#792]: https://github.com/DependencyTrack/frontend/pull/792
[frontend/#793]: https://github.com/DependencyTrack/frontend/pull/793
[frontend/#803]: https://github.com/DependencyTrack/frontend/pull/803
[frontend/#805]: https://github.com/DependencyTrack/frontend/pull/805
[frontend/#812]: https://github.com/DependencyTrack/frontend/pull/812
[frontend/#816]: https://github.com/DependencyTrack/frontend/pull/816
[frontend/#824]: https://github.com/DependencyTrack/frontend/pull/824
[frontend/#832]: https://github.com/DependencyTrack/frontend/pull/832

[@2000rosser]: https://github.com/2000rosser
[@AnthonyMastrean]: https://github.com/AnthonyMastrean
[@LaVibeX]: https://github.com/LaVibeX
[@MangoIV]: https://github.com/MangoIV
[@Robbilie]: https://github.com/Robbilie
[@VithikaS]: https://github.com/VithikaS
[@a5a351e7]: https://github.com/a5a351e7
[@acdha]: https://github.com/acdha
[@aravindparappil46]: https://github.com/aravindparappil46
[@baburkin]: https://github.com/baburkin
[@fnxpt]: https://github.com/fnxpt
[@kepten]: https://github.com/kepten
[@leec94]: https://github.com/leec94
[@lukas-braune]: https://github.com/lukas-braune
[@malice00]: https://github.com/malice00
[@mehab]: https://github.com/mehab
[@mge-mm]: https://github.com/mge-mm
[@mikkeschiren]: https://github.com/mikkeschiren
[@mprencipe]: https://github.com/mprencipe
[@mykter]: https://github.com/mykter
[@rbt-mm]: https://github.com/rbt-mm
[@rkesters]: https://github.com/rkesters
[@rkg-mm]: https://github.com/rkg-mm
[@sahibamittal]: https://github.com/sahibamittal
[@sebD]: https://github.com/sebD
[@setchy]: https://github.com/setchy
[@validide]: https://github.com/validide

[Mapped Diagnostic Context]: https://logback.qos.ch/manual/mdc.html
[Trivy]: https://trivy.dev/
[component identity]: https://docs.dependencytrack.org/analysis-types/component-identity/
[customized their logging configuration]: {{ site.baseurl }}{% link _docs/getting-started/monitoring.md %}#custom-logging-configuration
[logback.xml]: https://github.com/DependencyTrack/dependency-track/blob/master/src/main/docker/logback.xml
[server mode]: https://aquasecurity.github.io/trivy/v0.50/docs/references/modes/client-server/