Qualor vs Dependency-⁠Track

A Dependency-⁠Track alternative that isn't another server

Your main branch and the releases you ship keep their dependency list, re-checked when new vulnerability data arrives. In the server that already gates your code.

Get it on GitHubTry the live demo

Billing ServiceVulnerabilities by version

Branch or versionCriticalHighMedium
main0611
v2.3.01611
v2.2.09399
v2.1.0114010

Re-checked when new vulnerability data arrives. No new scan.

No SBOM to upload: Qualor reads dependencies from the scans you already run.

What one server gives you

One server instead of two

Dependency tracking shares one install, one sign-in and one set of projects with your quality gate and AI code review. One thing to upgrade, back up and secure.

Re-checks without a rescan

When new vulnerability data arrives, Qualor checks your main branch, the branches you choose and every tracked release again. No pipeline has to run, and old tags need no new scan.

Triage once, with VEX reasons

Mark a vulnerability not affected with one of the five VEX reasons, or accept it as won't fix. One decision covers the whole project: every branch and every release.

Business adds exploited vulnerabilities, alerts, and SBOM and VEX export. Plans and prices

The releases you ship, re-checked

A project's Vulnerabilities tab: Log4Shell and Spring4Shell as Critical and exploited, each with its fixed versions, exploit probability, the releases it is in and its status
Each vulnerability with its fix and the releases it is in, exploited ones first. New ones show up without a new scan.
A project's overview: the quality gate that failed and the condition that failed it, then the measures on new code and their trends
The gate that failed and why, the figures that matter, and where the code is heading.
A project's issues, filtered by severity and status, with the severity of each and the rule, file and line that found it
Filter by severity, status and rule, then triage in bulk.

Explore the live demo → Qualor checking its own code. No account needed.

Qualor fits when

  • You run a code quality server next to Dependency-Track and would rather run one.
  • Your CI already scans each merge request and release tag, and you'd rather not add an SBOM step to every project.
  • You want to know which shipped release a new vulnerability hits, without scanning old tags again.
  • Your developers triage vulnerabilities where they already triage code issues.

Dependency-Track may fit better when

  • You track software you don't build, from SBOMs your suppliers send.
  • You want a tool for dependencies only, with no code analysis or review.

Start with the scan you already run

The GitLab component and Qualor's GitHub workflow scan each release tag, so every version you ship keeps its dependency list from then on. Releases you shipped earlier take one scan each. Learn more

Get it on GitHubRead the guide

Questions

Can Qualor replace Dependency-Track?

For the software you build and ship, yes. Qualor keeps the dependencies of your main branch and of the releases you ship, re-checks them against fresh vulnerability data without a new scan, and lets your team triage with VEX reasons. Business adds exploited vulnerabilities, alerts, and SBOM and VEX export. Qualor reads dependencies from the scans you already run, so there is no SBOM to upload.

Dependency vulnerabilities

What about releases we shipped before?

Each one takes one scan. From then on, every release tag your CI scans keeps its dependency list.

Releases

Where does the vulnerability data come from?

From the Trivy vulnerability database. Qualor keeps its own copy up to date, from GitHub's registry or your mirror.

The vulnerability database

What is free, and what does Business add?

Dependency tracking, re-checks and triage with VEX reasons are free in every edition. Business adds exploited vulnerabilities, alerts, and SBOM and VEX export.

Plans and prices

Try it on your next merge request

Star on GitHubFollow the quick start

Not ready to install? Star it to find it again.

  • MIT licensed
  • Signed images
  • Latest release 0.15.0, 10 November 2026
  • The demo analyses Qualor itself