Issues

• Vulnerability policy does not downgrade severity

  defectpending more information
  DependencyTrack/dependency-track#7899 · Filter by author jbndbc opened on Nov 4, 2026
  1

• DefectDojo integration creates new tests when existing-test lookup fails

  defectintegration/defectdojop2size/S
  DependencyTrack/dependency-track#7875 · Filter by author Salavat997 opened on Nov 2, 2026

• Add project-level permissions

  enhancementp2size/L
  DependencyTrack/dependency-track#7873 · Filter by author ShuP1 opened on Nov 2, 2026 · 6.x
  2

• Global component search (/api/v2/components) times out for common search terms and for users with restricted portfolio access

  enhancementpending more informationperformance
  DependencyTrack/dependency-track#7833 · Filter by author Nihad74 opened on Oct 30, 2026 · 5.x
  5

• EPSS scores on GitHub Advisory vulnerabilities are never refreshed after initial mirror

  defectin triageintegration/github
  DependencyTrack/dependency-track#7832 · Filter by author sophie-cosgrove-gousto opened on Oct 30, 2026 · 4.x
  3

• Show who answers for a project and where it is served

  enhancement
  DependencyTrack/dependency-track#7830 · Filter by author lsmith77 opened on Oct 30, 2026

• Track deployments and rank artifacts by findings and reach

  enhancement
  DependencyTrack/dependency-track#7829 · Filter by author lsmith77 opened on Oct 30, 2026

• ResolvePackageMetadataActivity fails for large metadata like for pkg:npm/renovate

  enhancementp2
  DependencyTrack/dependency-track#7814 · Filter by author AndreasKoellisch opened on Oct 29, 2026 · 5.x
  1

• API server doesn't start if OIDC_CLIENT_ID is set even if DT_OIDC_CLIENT_ID is also set

  enhancement
  DependencyTrack/dependency-track#7806 · Filter by author gaeljw opened on Oct 28, 2026

• Remove API keys for teams

  p2size/Stechnical debt
  DependencyTrack/dependency-track#7803 · Filter by author nscuro opened on Oct 26, 2026 · 6.x
  1

• Docs: add Safeguard to Community Integrations

  enhancement
  DependencyTrack/dependency-track#7783 · Filter by author Safeguard-sh opened on Oct 25, 2026

• PUT /api/v1/analysis silently ignores empty or null analysisDetails

  defectin triage
  DependencyTrack/dependency-track#7740 · Filter by author frrusi opened on Oct 22, 2026
  1

• OSS Index analyzer drops Go findings when response coordinates normalize the version prefix

  defectintegration/ossindexp2size/S
  DependencyTrack/dependency-track#7739 · Filter by author Suhas2109 opened on Oct 22, 2026 · 5.x
  2

• Query timeout introduced with DT 5.1 prevents some scheduled notifications from being sent

  defectp2
  DependencyTrack/dependency-track#7731 · Filter by author migus-rs opened on Oct 21, 2026 · 5.x

• Suppressing vulnerabilities does not trigger metrics recalculation, leaving stale vulnerability counts

  defectp2size/M
  DependencyTrack/dependency-track#7721 · Filter by author lukasz-zaroda opened on Oct 19, 2026 · 5.x
  3

• Log enhancement to identify problem License

  enhancementp2size/S
  DependencyTrack/dependency-track#7669 · Filter by author ptdropper opened on Oct 13, 2026
  4

• Include KEV status in exported files

  enhancementgood first issuep2size/S
  DependencyTrack/dependency-track#7668 · Filter by author t-castelan opened on Oct 13, 2026 · 5.x
  4

• CycloneDX VEX: an affects BOM-Link is applied to every vulnerable component of the project, including components the VEX does not list

  defectp2size/S
  DependencyTrack/dependency-track#7653 · Filter by author imh0st opened on Oct 12, 2026 · 5.x

• V5´s "Attributed On"-logic and date assignment broken (API & Vulnerability Audit)?

  defectin triage
  DependencyTrack/dependency-track#7650 · Filter by author BoaThor opened on Oct 12, 2026

• No notification for a second KEV vulnerability on the same component

  defectin triage
  DependencyTrack/dependency-track#7649 · Filter by author banshee86vr opened on Oct 12, 2026

• OSV data source: import upstream identifiers (Chainguard CGA records carry their CVE there, not in aliases)

  enhancement
  DependencyTrack/dependency-track#7644 · Filter by author igorhrcek opened on Oct 9, 2026
  1

• OSV advisories scoped to one architecture (arch purl qualifier) are matched against components of any architecture

  defectgood first issuep2size/S
  DependencyTrack/dependency-track#7625 · Filter by author xavier-calland opened on Oct 8, 2026 · 5.x
  2

• Migrate OSS Index vuln analyzer to new (unbatched) Guide endpoints

  enhancementintegration/ossindexp2size/M
  DependencyTrack/dependency-track#7605 · Filter by author rogu-beta opened on Oct 6, 2026 · 5.3
  5

• Proposal: Migrate docs from Material for MkDocs to Zensical

  documentationenhancementhelp wantedp3size/S
  DependencyTrack/dependency-track#7597 · Filter by author schewara opened on Oct 6, 2026
  1

• A VEX entry whose affects[].ref cannot be resolved is skipped silently, and the import reports success

  defectp2
  DependencyTrack/dependency-track#7566 · Filter by author fahedouch opened on Oct 4, 2026 · 5.x
  1