---
title: v4.13.5
type: patch
---

**Important Notice:**

Sonatype has started to enforce an authentication requirement for OSS Index.

The [OSS Index analyzer] has historically been enabled by default for Dependency-Track,
and configuration of credentials for authentication was not strictly necessary.

This has now changed, and users who wish to continue using OSS Index will
need to register for a free account, and configure credentials in the analyzer's settings.

Please refer to [Sonatype's announcement] for further details.

In the midterm, we'll be looking into enabling OSV per default
to compensate for this change.

**Fixes:**

* Fix CPE matching not being fully case-insensitive - [apiserver/#5299]
* Improve detection whether version of a github PURL is a commit SHA or release tag - [apiserver/#5350]
* Make OSS Index credentials required - [apiserver/#5351]
* Fix occasional NullPointerException when mirroring the NVD via REST API - [apiserver/#5352]
* Fix `/api/v1/tag/policy/{uuid}` endpoint returning more tags than are assigned to a policy - [apiserver/#5353]
* Fix possible failure of NVD mirroring due to corrupted timestamp files - [apiserver/#5354]
* Fix BOM validation failing due to unrecognized new SPDX license IDs - [apiserver/#5355]
* Fix new SPDX license IDs not being recognized - [apiserver/#5356]
* Fix high CPU utilization when watchdog logger is configured - [apiserver/#5357]
* Fix NullPointerException in GithubMetaAnalyzer when analyzing GitHub Actions - [apiserver/#5359]
* Fix connection reset during OSV mirroring - [apiserver/#5360]
* Fix compatibility of custom NuGet repositories with JFrog Artifactory - [apiserver/#5381]
* Fix custom NuGet repositories not working with Sonatype Nexus - [apiserver/#5381]
* Fix possible disclosure of private NuGet repository credentials to api.nuget.org - [apiserver/#5381] / [GHSA-83g2-vgqh-mgxc]

For a complete list of changes, refer to the respective GitHub milestones:

* [API server milestone 4.13.5](https://github.com/DependencyTrack/dependency-track/milestone/59?closed=1)
* [Frontend milestone 4.13.5](https://github.com/DependencyTrack/frontend/milestone/44?closed=1)

We thank all organizations and individuals who contributed to this release, from logging issues to taking part in discussions on GitHub & Slack to testing of fixes.

Special thanks to everyone who contributed code to implement enhancements and fix defects:  

[@colinfyfe], [@framayo], [@jonbally], [@snieguu], [@stohrendorf]

###### dependency-track-apiserver.jar

| Algorithm | Checksum |
|:----------|:---------|
| SHA-1     | f38abe7b93f7cb88f3bba4c78c30a9ce7dc45c0d         |
| SHA-256   | bf55097e63b46ed16042024636b855f676ba67e6e5824e7da80f3cec863a3f77         |

###### dependency-track-bundled.jar

| Algorithm | Checksum |
|:----------|:---------|
| SHA-1     | 5aea8e0662f8aa4d9e53b52c14367c5345602e34         |
| SHA-256   | 4a373de4d5aca924fb533ebfc7e1eb4fb5a249d81c948bd367a52fa53125a610         |

###### frontend-dist.zip

| Algorithm | Checksum                                                         |
|:----------|:-----------------------------------------------------------------|
| SHA-1     | e441f28a656b710766a9fd85360872bc9330d14c                         |
| SHA-256   | fb67bf767e2142b72dbd226b984a1faee9e491d108ccfd29860a49e0b5b15a12 |

###### Software Bill of Materials (SBOM)

* API Server: [bom.json](https://github.com/DependencyTrack/dependency-track/releases/download/4.13.5/bom.json)
* Frontend: [bom.json](https://github.com/DependencyTrack/frontend/releases/download/4.13.5/bom.json)

[apiserver/#5299]: https://github.com/DependencyTrack/dependency-track/pull/5299
[apiserver/#5350]: https://github.com/DependencyTrack/dependency-track/pull/5350
[apiserver/#5351]: https://github.com/DependencyTrack/dependency-track/pull/5351
[apiserver/#5352]: https://github.com/DependencyTrack/dependency-track/pull/5352
[apiserver/#5353]: https://github.com/DependencyTrack/dependency-track/pull/5353
[apiserver/#5354]: https://github.com/DependencyTrack/dependency-track/pull/5354
[apiserver/#5355]: https://github.com/DependencyTrack/dependency-track/pull/5355
[apiserver/#5356]: https://github.com/DependencyTrack/dependency-track/pull/5356
[apiserver/#5357]: https://github.com/DependencyTrack/dependency-track/pull/5357
[apiserver/#5359]: https://github.com/DependencyTrack/dependency-track/pull/5359
[apiserver/#5360]: https://github.com/DependencyTrack/dependency-track/pull/5360
[apiserver/#5381]: https://github.com/DependencyTrack/dependency-track/pull/5381

[GHSA-83g2-vgqh-mgxc]: https://github.com/DependencyTrack/dependency-track/security/advisories/GHSA-83g2-vgqh-mgxc

[OSS Index analyzer]: {{ site.baseurl }}{% link _docs/datasources/ossindex.md %}
[Sonatype's announcement]: https://ossindex.sonatype.org/doc/auth-required

[@colinfyfe]: https://github.com/colinfyfe
[@framayo]: https://github.com/framayo
[@jonbally]: https://github.com/jonbally
[@snieguu]: https://github.com/snieguu
[@stohrendorf]: https://github.com/stohrendorf
