OWASP's Dependency-Track tool update: Key changes — and limitations

OWASP released Dependency-Track 4.12.0 with more granular tag-based controls, a global policy violation audit view, authenticated badges, and a modernized tech stack (Java 21, Jakarta EE 10, Jetty 12, OpenAPI v3) to improve performance and security. Experts commend the usability and visibility gains but stress that SCA and SBOM-only workflows have notable gaps—such as reliance on manual tagging, limited prioritization by business context or reachability, and lack of artifact/binary analysis—recommending organizations augment SCA with techniques like binary analysis and reproducible builds to better mitigate evolving software supply chain risks.