Skip to content

Upgrading to v5.0.5

  • Custom notification templates need updating. The default templates of the email, Mattermost, Microsoft Teams, and Slack publishers referenced variables that do not exist in the v5 notification model, so POLICY_VIOLATION and PROJECT_AUDIT_CHANGE notifications rendered empty values or failed to publish. Dependency-Track replaces its own default templates on startup, but templates you cloned or customized keep the broken references. Apply these renames to affected templates:

    Old New
    subject.policyViolation.policyCondition subject.policyViolation.condition
    subject.violationAnalysis subject.analysis

  • The upgrade forces a full OSV mirror. Dependency-Track converted some OSV version ranges incorrectly, which matched components against vulnerabilities that do not affect them. The upgrade purges the watermarks that the OSV vulnerability data source uses to track incremental progress. Existing OSV data stays in place, but the next mirror run processes the full OSV data set instead of only recent changes, and overwrites the affected records. Expect that run to take longer than usual.

    Corrected data is not available until the OSV mirror runs, which happens daily at 03:00 UTC by default. To get the corrected data sooner, use Mirror now as described in Triggering an initial mirror.