---
title: v4.10.0
type: major
---

Dependency-Track has historically relied on file-based data feeds to mirror contents of the National Vulnerability
Database (NVD). These feeds are being [retired on December 15th 2023](https://nvd.nist.gov/General/News/change-timeline),
although they [may be available up until December 18th](https://groups.google.com/a/list.nist.gov/g/nvd-news/c/a4bDL8nofOk).

As a consequence, this release includes support for mirroring the NVD via its REST API instead. This integration
will be optional for Dependency-Track v4.10, but mandatory for later releases. Users are encouraged to enable
REST API mirroring now, to ensure a smooth transition. Refer to the [NVD datasource documentation] to learn more.

**Features:**

* Add support for mirroring the NVD via its REST API - [apiserver/#3175]
  * Refer to the [NVD datasource documentation] for details
* Add retries with exponential backoff for NVD feed downloads - [apiserver/#3154]
* Add support for CycloneDX `metadata.supplier`, `metadata.manufacturer`, `metadata.authors`, and `component.supplier` - [apiserver/#3090], [apiserver/#3179]
* Add support for authenticating with public / non-internal repositories - [apiserver/#2876]
* Add support for fetching latest versions from GitHub - [apiserver/#3112]
  * Applicable to components with `pkg:github/<owner>/<repository>@<version>` package URLs
* Improve efficiency of search index operations - [apiserver/#3116]
* Add option to emit log for successfully published notifications, and improve logging around notifications in general - [apiserver/#3211]
* Use Java 21 JRE in container images - [apiserver/#3089]
* Tweak container health check to prevent `wget` zombie processes on slow hosts - [apiserver/#3245]
* Expose `alpine_event_processing_seconds` metric for monitoring of event processing durations
* Add average event processing duration to Grafana dashboard - [apiserver/#3173]
* Add guidance for `413 Content Too Large` errors upon BOM upload - [apiserver/#3167]
* Improve OIDC documentation - [apiserver/#3186]
* Add "Show in Dependency-Graph" button to component search results - [frontend/#572]

**Fixes:**

* Fix false positives in CPE matching due to ambiguous *vendor*-*product* relations - [apiserver/#3209]
* Fix failure to delete policy violations when they have an audit trail - [apiserver/#3228]
* Fix teams not being assignable to alerts with custom email publishers - [apiserver/#3232]
* Fix inability to rebuild search indexes for more than one entity type at a time - [apiserver/#2987]
* Fix trailing comma in default Slack notification template - [apiserver/#3172]
* Fix NPE when affected node in OSV does not define a package - [apiserver/#3194]
* Fix NPE for BOM_PROCESSING_FAILED notifications when parsing of the BOM failed - [apiserver/#3198]
* Fix gradual performance degradation of portfolio vulnerability analysis - [apiserver/#3222]
* Fix erroneous warning log during VEX import - [apiserver/#3233]
* Fix `project.active` defaulting to `false` when creating projects via REST API - [apiserver/#3244]
* Fix OIDC login button moving before it can be clicked - [frontend/#616]
* Fix input fields losing focus while editing alerts - [frontend/#619]
* Fix switching between project versions being broken on tabs other than "Overview" - [frontend/#659]
* Fix notification level not being modifiable for existing alerts - [frontend/#661]

**Upgrade Notes:**

* The `CPE` table is no longer needed and will be dropped automatically upon upgrade - [apiserver/#3117]
* A warning will be logged when mirroring the NVD through its legacy data feeds
  * Refer to the [NVD datasource documentation] to learn how to switch to API-based mirroring
* As the Grafana dashboard is not managed by Dependency-Track, users wishing to update it will need
  to re-import it into their Grafana instance.

For a complete list of changes, refer to the respective GitHub milestones:

* [API server milestone 4.10.0](https://github.com/DependencyTrack/dependency-track/milestone/25?closed=1)
* [Frontend milestone 4.10.0](https://github.com/DependencyTrack/frontend/milestone/16?closed=1)

We thank all organizations and individuals who contributed to this release, from logging issues to taking part in discussions on GitHub & Slack to testing of fixes.

Special thanks to everyone who contributed code to implement enhancements and fix defects:  
[@AbdelHajou], [@Nikemare], [@acdha], [@dimitri-rebrikov], [@jadyndev], [@leec94], [@mehab], [@melba-lopez], [@rbt-mm], [@rkg-mm], [@willienel], [@ybelMekk]

###### [dependency-track-apiserver.jar](https://github.com/DependencyTrack/dependency-track/releases/download/4.10.0/dependency-track-apiserver.jar)

| Algorithm | Checksum                                                         |
|:----------|:-----------------------------------------------------------------|
| SHA-1     | c308b1f6a2d73fc2bba9da2cc33bf7e3ec49e851                         |
| SHA-256   | d06f4550e16451ccb7843c36534172744934a7dc69e1d48e970a6eec24e49dc3 |

###### [dependency-track-bundled.jar](https://github.com/DependencyTrack/dependency-track/releases/download/4.10.0/dependency-track-bundled.jar)

| Algorithm | Checksum                                                         |
|:----------|:-----------------------------------------------------------------|
| SHA-1     | b94fb9cbaa91c4e332bcec266e10a0f325f12e22                         |
| SHA-256   | cf27db44e637b4bc551c16e659e81890f4c5d4f3b4ea9893ebf1717bff98b999 |

###### [frontend-dist.zip](https://github.com/DependencyTrack/frontend/releases/download/4.10.0/frontend-dist.zip)

| Algorithm | Checksum                                                         |
|:----------|:-----------------------------------------------------------------|
| SHA-1     | 217bcaab3a7da2ae2fab3103055f9503aef5db07                         |
| SHA-256   | 2f6f524c45afcc4a90128cab22a557bf41b88c716aaf0992eb6bb2239ce1469c |

###### Software Bill of Materials (SBOM)

* API Server: [bom.json](https://github.com/DependencyTrack/dependency-track/releases/download/4.10.0/bom.json)
* Frontend: [bom.json](https://github.com/DependencyTrack/frontend/releases/download/4.10.0/bom.json)

[apiserver/#2876]: https://github.com/DependencyTrack/dependency-track/pull/2876
[apiserver/#2987]: https://github.com/DependencyTrack/dependency-track/issues/2987
[apiserver/#3089]: https://github.com/DependencyTrack/dependency-track/pull/3089
[apiserver/#3090]: https://github.com/DependencyTrack/dependency-track/pull/3090
[apiserver/#3112]: https://github.com/DependencyTrack/dependency-track/pull/3112
[apiserver/#3116]: https://github.com/DependencyTrack/dependency-track/pull/3116
[apiserver/#3117]: https://github.com/DependencyTrack/dependency-track/issues/3117
[apiserver/#3154]: https://github.com/DependencyTrack/dependency-track/pull/3154
[apiserver/#3167]: https://github.com/DependencyTrack/dependency-track/pull/3167
[apiserver/#3172]: https://github.com/DependencyTrack/dependency-track/pull/3172
[apiserver/#3173]: https://github.com/DependencyTrack/dependency-track/pull/3173
[apiserver/#3175]: https://github.com/DependencyTrack/dependency-track/pull/3175
[apiserver/#3179]: https://github.com/DependencyTrack/dependency-track/pull/3179
[apiserver/#3186]: https://github.com/DependencyTrack/dependency-track/pull/3186
[apiserver/#3194]: https://github.com/DependencyTrack/dependency-track/pull/3194
[apiserver/#3198]: https://github.com/DependencyTrack/dependency-track/pull/3198
[apiserver/#3209]: https://github.com/DependencyTrack/dependency-track/pull/3209
[apiserver/#3211]: https://github.com/DependencyTrack/dependency-track/pull/3211
[apiserver/#3222]: https://github.com/DependencyTrack/dependency-track/pull/3222
[apiserver/#3228]: https://github.com/DependencyTrack/dependency-track/pull/3228
[apiserver/#3232]: https://github.com/DependencyTrack/dependency-track/pull/3232
[apiserver/#3233]: https://github.com/DependencyTrack/dependency-track/pull/3233
[apiserver/#3244]: https://github.com/DependencyTrack/dependency-track/pull/3244
[apiserver/#3245]: https://github.com/DependencyTrack/dependency-track/pull/3245

[frontend/#572]: https://github.com/DependencyTrack/frontend/pull/572
[frontend/#616]: https://github.com/DependencyTrack/frontend/pull/616
[frontend/#619]: https://github.com/DependencyTrack/frontend/pull/619
[frontend/#659]: https://github.com/DependencyTrack/frontend/pull/659
[frontend/#661]: https://github.com/DependencyTrack/frontend/pull/661

[NVD datasource documentation]: {{ site.baseurl }}{% link _docs/datasources/nvd.md %}#mirroring-via-nvd-rest-api

[@AbdelHajou]: https://github.com/AbdelHajou
[@Nikemare]: https://github.com/Nikemare
[@acdha]: https://github.com/acdha
[@dimitri-rebrikov]: https://github.com/dimitri-rebrikov
[@jadyndev]: https://github.com/jadyndev
[@leec94]: https://github.com/leec94
[@mehab]: https://github.com/mehab
[@melba-lopez]: https://github.com/melba-lopez
[@rbt-mm]: https://github.com/rbt-mm
[@rkg-mm]: https://github.com/rkg-mm
[@willienel]: https://github.com/willienel
[@ybelMekk]: https://github.com/ybelMekk