---
title: v4.9.1
type: patch
---

**Fixes:**

* Fix failure to import BOMs in XML format when they contain multiple `metadata>tools` nodes - [apiserver/#3125]
* Fix failure to parse BOMs in XML format when the `metadata>component` nodes has `properties` - [apiserver/#3125]
* Fix failure to parse BOMs in XML format when the `component>hashes` node is empty - [apiserver/#3141]
* Fix impossible SQL query conditions causing DB indexes to be bypassed - [apiserver/#3126]
* Fix failure to start the application when using a logging config with JSON output - [apiserver/#3129]
* Fix NGINX failing to start when IPv6 is not available - [frontend/#623]
* Fix NGINX entrypoint failing to detect mounted `config.json` under containerd - [frontend/#624]
* Fix external references being cleared when updating a project via UI - [frontend/#628]

For a complete list of changes, refer to the respective GitHub milestone:

* [API server milestone 4.9.1](https://github.com/DependencyTrack/dependency-track/milestone/34?closed=1)
* [Frontend milestone 4.9.1](https://github.com/DependencyTrack/frontend/milestone/17?closed=1)

We thank all organizations and individuals who contributed to this release, from logging issues to taking part in discussions on GitHub & Slack to testing of fixes.

Special thanks to everyone who contributed code to implement enhancements and fix defects:  
[@muellerst-hg]

###### [dependency-track-apiserver.jar](https://github.com/DependencyTrack/dependency-track/releases/download/4.9.1/dependency-track-apiserver.jar)

| Algorithm | Checksum                                                         |
|:----------|:-----------------------------------------------------------------|
| SHA-1     | 99da5f705c3b0048ecf621e8c738a87147c693d9                         |
| SHA-256   | 5d925f08f85fe7f39231357c4a4c8057fd354e048b7c9407efb20af78033ecec |

###### [dependency-track-bundled.jar](https://github.com/DependencyTrack/dependency-track/releases/download/4.9.1/dependency-track-bundled.jar)

| Algorithm | Checksum                                                         |
|:----------|:-----------------------------------------------------------------|
| SHA-1     | 487801d69bffb2e8def5aad9aa55c34be8cddcb2                         |
| SHA-256   | 19ac4ede2932ff54c42e0466cdf7d5b410f7a44784562f237fc5b4b8891a8dc8 |

###### [frontend-dist.zip](https://github.com/DependencyTrack/frontend/releases/download/4.9.1/frontend-dist.zip)

| Algorithm | Checksum                                                         |
|:----------|:-----------------------------------------------------------------|
| SHA-1     | d45d09a8ffb4c36f2fac78149d5f7cefe31a280b                         |
| SHA-256   | 6bc0bf9ecb8e7dc26eb3bfe9beecc41c5d11e5ccb902f19f0445aaa5860a1980 |

###### Software Bill of Materials (SBOM)

* API Server: [bom.json](https://github.com/DependencyTrack/dependency-track/releases/download/4.9.1/bom.json)
* Frontend: [bom.json](https://github.com/DependencyTrack/frontend/releases/download/4.9.1/bom.json)

[apiserver/#3125]: https://github.com/DependencyTrack/dependency-track/pull/3125
[apiserver/#3126]: https://github.com/DependencyTrack/dependency-track/pull/3126
[apiserver/#3129]: https://github.com/DependencyTrack/dependency-track/pull/3129
[apiserver/#3141]: https://github.com/DependencyTrack/dependency-track/pull/3141
[frontend/#623]: https://github.com/DependencyTrack/frontend/pull/623
[frontend/#624]: https://github.com/DependencyTrack/frontend/pull/624
[frontend/#628]: https://github.com/DependencyTrack/frontend/pull/628

[@muellerst-hg]: https://github.com/muellerst-hg