DependencyTrack / DependencyTrack/dependency-track

Support limiting to tags for scheduled summary notifications

Open
#5,037 9 comments 1 reaction 0 assignees View on GitHub
enhancement p2 size/S
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
9h 4m
Merged PRs (30d)
229

Description

### Current Behavior

Hello,
We are using Dependency-Track v4.13.2. We have many projects and we would like to be alerted in slack chnanel based on the tag selection.
If we don't Limit to the Scheduled notification alert we get error in the application log based on your message
`The alert must be limited to one or more projects in order for summaries to work. When selecting projects to limit the alert to, consider that choosing too many projects can cause summaries to grow too large for certain destinations, leading to them being rejected.`
That is why we splitted into several tags , but if we don't add all the projects here , the tag filter doesn't work

Image

when we add the projects under Limit to projects we get notification , but the purpose of chosing tags is to avoid the overwork adding new projects all the time.
Can you please investigate
Do you have more detailed templates for slack because what we get is not clear which project , what vulnerability , which tag, which version
teh default format is

DependencyTrackNotifier
APP 3:54 PM
NEW_VULNERABILITIES_SUMMARY
INFORMATIONAL | PORTFOLIO
New Vulnerabilities Summary
No new vulnerabilities identified since 2025-06-05T13:28:09Z.
3:54
NEW_POLICY_VIOLATIONS_SUMMARY
INFORMATIONAL | PORTFOLIO
New Policy Violations Summary
No new policy violations identified since 2025-06-05T13:28:09Z.

### Steps to Reproduce

1. Creat many projects with 2,3 tags
2. Creat Scheduled Notification with publisher slack
3. Limit to one of the tags
4. Notification is not sent

### Expected Behavior
Notificationalert should be sent

we expect to limit the dependency trck project only using the specified tag
we would like to have better and more clear alert notification in slack thread

### Dependency-Track Version

4.13.2

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

16.8

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Research direction

Start by tracing the scheduled notification path for tag-based project selection and the Slack summary publisher, using the reproduction steps as the behavioral baseline. Confirm that a tag-only scope sends summaries for matching projects without manually listing them; the clearer Slack message format is described as a separate requested enhancement.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.