dependencytrack/dependency-track: technical due diligence, read from its repository

The median source file here is 80 lines. 14 files exceed 1,000 lines, the largest being 6,056. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

The newest release, 5.2.1, is not on the branch this survey read; the newest release on it is 5.2.0. The shipped product may differ from what this report describes. Survey the release branch too.

4 places in product code build SQL by formatting or joining strings rather than passing parameters. In each, what the code shows going in is a table or column name, a constant, or something the line does not show, not a request's value. Ask whether any value reaches these strings, rather than a parameter.

The newest was published on 2025-11-17. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. Whether 4 of them are fixed in the code you ship could not be told from this history: its version is only known to be at least 5.2.0. Answer lives in: the release you run, set against each fixed version.

Nothing in the service initialises an error reporter (Sentry, Rollbar, Bugsnag, Honeybadger or an APM agent). An exception in production reaches a person only if someone is reading the logs, which usually means a customer reports it first.