Skip to content

Upgrading to v5.2.0

  • Service accounts reserve the svc: username prefix. This release adds service accounts. Existing users whose username starts with svc:, in any letter case, collide with that reservation.

    If such a user exists, the database migration fails and its error message lists the affected users. To find them before you upgrade, run this query against the database:

    SELECT "USERNAME", "TYPE" FROM "USER" WHERE "USERNAME" ILIKE 'svc:%';

    Rename or delete affected managed users. Rename affected LDAP and OIDC users in your identity provider, then delete them from Dependency-Track. After the upgrade, LDAP and OIDC logins with a svc: username fail, and the REST API rejects new users with that prefix.

    Team API keys keep working without changes.

  • Cargo package metadata comes from the sparse index. Earlier versions queried the crates.io API, which enforces rate limits. The Cargo resolver now reads the sparse registry index instead, which a CDN serves without rate limits. A database migration changes the URL of the default crates.io repository from https://crates.io to https://index.crates.io, unless you changed that URL. Deployments with restricted egress must allow index.crates.io.

    Custom Cargo repositories keep their URL. Point each of them to the sparse index of its registry, for example the URL after the sparse+ prefix in your Cargo config.toml. See Cargo's Using an Alternate Registry guide for details.

    The resolver now sends a Cargo repository token in the Authorization header as-is, like Cargo does. Earlier versions added a Bearer prefix. If your registry expects the prefix, add it to the token you configured. Repositories with a username still use basic authentication.