---
title: v4.6.0
type: major
---

**Highlights:**

* **Vulnerability Aliases**. By ingesting data from multiple sources of vulnerability intelligence, 
there will be cases where different advisories describe the same vulnerability. 
For example, [CVE-2022-31197](https://nvd.nist.gov/vuln/detail/CVE-2022-31197) and 
[GHSA-r38f-c4h4-hqq2](https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-r38f-c4h4-hqq2) describe the same defect, 
yet their descriptions and risk ratings differ. Dependency-Track 4.6 now recognizes when multiple advisories alias each other, 
and includes this information in notifications and REST API responses. Aliases will additionally be considered when 
calculating portfolio metrics, so that duplicate vulnerabilities do not skyrocket the risk scoring. 
Further improvements to aliases will be coming in future releases.
* **OSV Integration (Beta)**. Dependency-Track now optionally mirrors vulnerability intelligence data from the Open Source 
Vulnerabilities database ([OSV](https://osv.dev/)). OSV normalizes and enriches data from multiple other
vulnerability databases. Mirroring can be limited to a configurable selection of ecosystems.
* **New Policy Conditions**.
  * Using the tag condition, policies can be restricted to projects with certain properties or priorities (e.g. *high-risk*, *internet-facing*, etc.)
  * Using the CWE condition, policies can assist in prioritizing findings of certain weaknesses
  * Using the component hash condition, policies can be used to flag usage of malicious or tainted packages
* **Performance**. Various improvements, most prominently regarding metrics updates.
Organizations, especially those with large portfolios of multiple thousands of projects, will see a drastic reduction 
in runtime and resource usage.
* **Observability**. By exposition of system metrics via the Prometheus text-based format, operators can now monitor 
their instances using Prometheus, Grafana, or other compatible observability stacks. Metrics exposition is optional 
and must be enabled, refer to the [monitoring] documentation for details.
* **Customization**. Users with advanced customization needs can now create and modify notification templates, 
as well as specify custom intervals for recurring tasks. Refer to the [notifications] and [recurring tasks]
documentation for details.
* **Authentication for Internal Repositories**. Dependency-Track can now authenticate with artifact repositories
like Nexus Repository Manager or Artifactory to fetch information about internal artifacts.

**Features:**

* Added support for authentication with internal package repositories - [#881]
* Added support for configuration of [recurring tasks] intervals - [#1542]
* Added support for policy violation badges - [#1690]
* Added support for disabling alerts - [#1173]
* Added support for CWEs in policy conditions - [#1768]
* Added support for component hashes in policy conditions - [#1775]
* Added support for tags in policy conditions - [#1565]
* Added support for fuzzy CPE matching - [#1799]
* Added support for notification publishing via Mattermost - [#1702]
* Added support for reimporting findings to an existing DefectDojo test instead of creating a new test upon each upload - [#1622]
* Added support for ingesting and displaying component author information - [#1726]
* Added support for vulnerability aliases - [#1912]
* Added support for custom notification templates - [#275]
* Added experimental [OSV integration] - [#931]
* Added support for Prometheus [metrics exposition] - [#1796]
* Refactored metrics update functionality to be faster and more efficient - [#1704]
* Upgraded to Java 17 - [#1804]
* Removed source maps from frontend production build - [#192]
* Added name of the authenticated user to the profile menu in the UI - [#167]
* Added support for performing cross-site frontend requests with cookies - [#156]
* Added columns for CVSS and EPSS to the component vulnerabilities view - [#1948]
* Added listing of affected projects to email notification templates - [#2005]

**Fixes:**

* Resolved defect that made it impossible to delete a project when assigned to a policy - [#1852]
* Resolved defect related non-thread-safe usage of the internal Lucene search index - [#1791]
* Resolved defect that caused the subject of email notifications saying `null` in certain situations - [#1818]
* Resolved defect that caused the VulnDB analyzer failing to mark components as vulnerable - [#1780]
* Resolved defect where the `affectedComponents` field of vulnerabilities would not be populated - [#1766]
* Resolved defect that caused vulnerability details taking too long to load - [#1765]
* Resolved defect that caused an internal server error when uploading a VEX document via HTTP `PUT` - [#1836]
* Resolved defect that caused an internal server error when creating a vulnerability without CWEs - [#1664]
* Resolved defect that caused an internal server error when submitting analysis details with more than 255 characters - [#1661]
* Resolved defect that caused an internal server error when importing a SaaSBOM - [#1790]
* Resolved defect that caused NVD mirroring notifications not working correctly - [#1429]
* Resolved defect that caused VEX import not ingesting analyses for internal vulnerabilities - [#1692]
* Resolved defect that caused excessive memory utilization when identifying internal components - [#1947]
* Resolved defect that caused wrong project tags to be displayed after switching versions - [#188]
* Resolved defect that caused component licenses to not be displayed on some occasions - [#223]
* Resolved defect that caused horizontal scroll bars to be displayed unnecessarily in the UI - [#248]
* Resolved defect that made it impossible to provide component hashes in uppercase - [#1174]
* Resolved defect that prevented vulnerabilities in PHP components to be identified based on GitHub Advisories data - [#1998]
* Resolved defect that caused a `NumberFormatException` to be thrown when resolving CWEs for findings - [#2029]
* Resolved projects search filter not working when viewing projects by tag - [#405]
* Resolved notifications with group `NEW_VULNERABLE_DEPENDENCY` not working at all - [#1611]
* Resolved multiple minor UI defects related to API key management - [#240]
* Resolved UI defect that caused vulnerability details not being displayed when only the CVSS vector, but not the scores were returned by the API - [#239]
* Resolved UI defect that caused an incorrect tooltip being displayed for the email field in the email configuration test modal - [#161]
* Resolved UI defect that caused the policy management view to not be updated when restricting a policy to a project - [#169]
* Resolved UI defect that caused input fields losing focus after saving - [#98]

**Security:**

* Fixed a defect that could cause API keys to be logged in clear text when handling API requests using keys with insufficient permissions - [GHSA-gh7v-4hxp-gqp4]

**Upgrade Notes:**

* The new baseline Java version is 17 ([#1804])
  * Java versions later than 17 may work as well, but haven't been tested
  * Users deploying DT via [executable WAR] will need to upgrade Java accordingly
  * Users deploying DT via [containers] don't need to do anything
* The embedded H2 database has been upgraded to major version 2
  * Manual upgrade steps are required, refer to the [H2 v2 migration guide]
  * **Without the manual migration, Dependency-Track 4.6 will not work with H2 databases created by earlier versions**
  * **Reminder**: H2 is not, and never has been, supported for production usage
* With [#1429], handling of notification levels has changed 
  * Previously, an alert with level `ERROR` would trigger on notifications with levels `ERROR`, `WARNING`, and `INFORMATIONAL`
  * Now, an alert with level `ERROR` will only trigger on notifications with level `ERROR`
  * An alert with level `WARNING` will trigger on notifications with level `WARNING` and `ERROR` etc.
  * The new behavior is similar to how structured logging libraries work
  * This change primarily affects notifications of the `SYSTEM` scope, which are used to report statuses of various tasks, e.g. `DATASOURCE_MIRRORING`
  * Notifications in the `PORTFOLIO` scope (e.g. `NEW_VULNERABILITY`) all have the `INFORMATIONAL` level
  * Users who configured alerts with scope `PORTFOLIO` and level `ERROR` should change the level to `INFORMATIONAL` after the upgrade

For a complete list of changes, refer to the respective GitHub milestones:

* [API server milestone 4.6](https://github.com/DependencyTrack/dependency-track/milestone/21?closed=1)
* [Frontend milestone 4.6](https://github.com/DependencyTrack/frontend/milestone/8?closed=1)

We thank all organizations and individuals who contributed to this release.  
Special thanks to everyone who contributed code to implement enhancements and fix defects:

*@AbdelHajou, @awegg, @dGuerr, @k3rnelpan1c-dev, @maaheeb, @officerNordberg, @rbt-mm, @rkg-mm, @s-spindler, @sahibamittal, @stephan-strate, @syalioune, @tmehnert, @yangsec888*

###### [dependency-track-apiserver.jar](https://github.com/DependencyTrack/dependency-track/releases/download/4.6.0/dependency-track-apiserver.jar)

| Algorithm | Checksum                                                         |
|:----------|:-----------------------------------------------------------------|
| SHA-1     | e40fb14764fb5eb9fcd654472434c3701c44f208                         |
| SHA-256   | 29d422816b593ddef89b07e9bc1c72a5cfb141eaea4a1d59615309089bab03ea |

###### [dependency-track-bundled.jar](https://github.com/DependencyTrack/dependency-track/releases/download/4.6.0/dependency-track-bundled.jar)

| Algorithm | Checksum                                                         |
|:----------|:-----------------------------------------------------------------|
| SHA-1     | 9e1b283c442e1bfb2c5c4ea23b1a1590cf7afc5d                         |
| SHA-256   | 1e6ba17e6dc1f6422826a020ece5ec6ae2bef1aa9ae563f57653ed6bc0944f14 |

###### [frontend-dist.zip](https://github.com/DependencyTrack/frontend/releases/download/4.6.0/frontend-dist.zip)

| Algorithm | Checksum                                                         |
|:----------|:-----------------------------------------------------------------|
| SHA-1     | 0f8967a4f777d33fd285d7fe8786f08690ffedd9                         |
| SHA-256   | 14791981d23850b72e39cee8c6378c6e25de0f8f5ee46b5c244c28bd6262db9a |

###### Software Bill of Materials (SBOM)

* API Server: [bom.json](https://github.com/DependencyTrack/dependency-track/releases/download/4.6.0/bom.json)
* Frontend: [bom.json](https://github.com/DependencyTrack/frontend/releases/download/4.6.0/bom.json)

[#98]: https://github.com/DependencyTrack/frontend/issues/98
[#156]: https://github.com/DependencyTrack/frontend/issues/156
[#161]: https://github.com/DependencyTrack/frontend/issues/161
[#167]: https://github.com/DependencyTrack/frontend/issues/167
[#169]: https://github.com/DependencyTrack/frontend/issues/169
[#188]: https://github.com/DependencyTrack/frontend/issues/188
[#192]: https://github.com/DependencyTrack/frontend/issues/192
[#223]: https://github.com/DependencyTrack/frontend/issues/223
[#239]: https://github.com/DependencyTrack/frontend/pull/239
[#240]: https://github.com/DependencyTrack/frontend/pull/240
[#248]: https://github.com/DependencyTrack/frontend/issues/248
[#275]: https://github.com/DependencyTrack/dependency-track/issues/275
[#405]: https://github.com/DependencyTrack/dependency-track/issues/405
[#881]: https://github.com/DependencyTrack/dependency-track/issues/881
[#931]: https://github.com/DependencyTrack/dependency-track/issues/931
[#1173]: https://github.com/DependencyTrack/dependency-track/issues/1173
[#1174]: https://github.com/DependencyTrack/dependency-track/issues/1174
[#1429]: https://github.com/DependencyTrack/dependency-track/issues/1429
[#1542]: https://github.com/DependencyTrack/dependency-track/issues/1542
[#1565]: https://github.com/DependencyTrack/dependency-track/issues/1565
[#1611]: https://github.com/DependencyTrack/dependency-track/issues/1611
[#1622]: https://github.com/DependencyTrack/dependency-track/issues/1622
[#1661]: https://github.com/DependencyTrack/dependency-track/issues/1661
[#1664]: https://github.com/DependencyTrack/dependency-track/issues/1664
[#1690]: https://github.com/DependencyTrack/dependency-track/issues/1690
[#1692]: https://github.com/DependencyTrack/dependency-track/issues/1765
[#1702]: https://github.com/DependencyTrack/dependency-track/pull/1702
[#1704]: https://github.com/DependencyTrack/dependency-track/pull/1704
[#1726]: https://github.com/DependencyTrack/dependency-track/issues/1726
[#1765]: https://github.com/DependencyTrack/dependency-track/issues/1765
[#1766]: https://github.com/DependencyTrack/dependency-track/issues/1766
[#1768]: https://github.com/DependencyTrack/dependency-track/issues/1768
[#1775]: https://github.com/DependencyTrack/dependency-track/issues/1775
[#1780]: https://github.com/DependencyTrack/dependency-track/issues/1780
[#1790]: https://github.com/DependencyTrack/dependency-track/issues/1790
[#1791]: https://github.com/DependencyTrack/dependency-track/issues/1797
[#1796]: https://github.com/DependencyTrack/dependency-track/pull/1796
[#1799]: https://github.com/DependencyTrack/dependency-track/pull/1799
[#1804]: https://github.com/DependencyTrack/dependency-track/pull/1804
[#1818]: https://github.com/DependencyTrack/dependency-track/issues/1818
[#1836]: https://github.com/DependencyTrack/dependency-track/issues/1836
[#1852]: https://github.com/DependencyTrack/dependency-track/issues/1852
[#1912]: https://github.com/DependencyTrack/dependency-track/pull/1912
[#1947]: https://github.com/DependencyTrack/dependency-track/issues/1947
[#1948]: https://github.com/DependencyTrack/dependency-track/issues/1948
[#1998]: https://github.com/DependencyTrack/dependency-track/issues/1998
[#2005]: https://github.com/DependencyTrack/dependency-track/issues/2005
[#2029]: https://github.com/DependencyTrack/dependency-track/issues/2029
[GHSA-gh7v-4hxp-gqp4]: https://github.com/DependencyTrack/dependency-track/security/advisories/GHSA-gh7v-4hxp-gqp4

[containers]: {{ site.baseurl }}{% link _docs/getting-started/deploy-docker.md %}
[executable WAR]: {{ site.baseurl }}{% link _docs/getting-started/deploy-exewar.md %}
[H2 v2 migration guide]: {{ site.baseurl }}{% link _docs/getting-started/database-support.md %}#migrating-to-h2-v2
[metrics exposition]: {{ site.baseurl }}{% link _docs/getting-started/monitoring.md %}
[monitoring]: {{ site.baseurl }}{% link _docs/getting-started/monitoring.md %}
[notifications]: {{ site.baseurl }}{% link _docs/integrations/notifications.md %}
[recurring tasks]: {{ site.baseurl }}{% link _docs/getting-started/recurring-tasks.md %}
[OSV integration]: {{ site.baseurl }}{% link _docs/datasources/osv.md %}