DependencyTrack / DependencyTrack/dependency-track
Support limiting to tags for scheduled summary notifications
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 9h 4m
- Merged PRs (30d)
- 229
Description
### Current Behavior
Hello,
We are using Dependency-Track v4.13.2. We have many projects and we would like to be alerted in slack chnanel based on the tag selection.
If we don't Limit to the Scheduled notification alert we get error in the application log based on your message
`The alert must be limited to one or more projects in order for summaries to work. When selecting projects to limit the alert to, consider that choosing too many projects can cause summaries to grow too large for certain destinations, leading to them being rejected.`
That is why we splitted into several tags , but if we don't add all the projects here , the tag filter doesn't work
when we add the projects under Limit to projects we get notification , but the purpose of chosing tags is to avoid the overwork adding new projects all the time.
Can you please investigate
Do you have more detailed templates for slack because what we get is not clear which project , what vulnerability , which tag, which version
teh default format is
DependencyTrackNotifier
APP 3:54 PM
NEW_VULNERABILITIES_SUMMARY
INFORMATIONAL | PORTFOLIO
New Vulnerabilities Summary
No new vulnerabilities identified since 2025-06-05T13:28:09Z.
3:54
NEW_POLICY_VIOLATIONS_SUMMARY
INFORMATIONAL | PORTFOLIO
New Policy Violations Summary
No new policy violations identified since 2025-06-05T13:28:09Z.
### Steps to Reproduce
1. Creat many projects with 2,3 tags
2. Creat Scheduled Notification with publisher slack
3. Limit to one of the tags
4. Notification is not sent
### Expected Behavior
Notificationalert should be sent
we expect to limit the dependency trck project only using the specified tag
we would like to have better and more clear alert notification in slack thread
### Dependency-Track Version
4.13.2
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
16.8
### Browser
Google Chrome
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Research direction
Start by tracing the scheduled notification path for tag-based project selection and the Slack summary publisher, using the reproduction steps as the behavioral baseline. Confirm that a tag-only scope sends summaries for matching projects without manually listing them; the clearer Slack message format is described as a separate requested enhancement.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100