DependencyTrack / DependencyTrack/dependency-track

Support Multiple OSV Sources with sub tabs and ecosystem scoping

Open
#6,331 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Currently, the OSV vulnerability source configuration supports a single OSV data source (Google) and a set of mandatory ecosystem filters.

As OSV-compatible vulnerability feeds are becoming available from multiple providers (e.g., Chainsaw, Red Hat, IBM etc), it would be beneficial to support configuring multiple OSV sources independently on UI.

### Proposed Behavior

Introduce multiple OSV source configurations under the existing OSV section.

Within the existing OSV vulnerability source page, add horizontal tabs (or a tab-like selector) representing configured OSV sources.

Each OSV source should maintain its own configuration.

**Benefits**

- Supports multiple OSV-compatible providers simultaneously.
- Allows provider-specific ecosystem filtering.
- Provides a scalable foundation for future OSV-based data sources.

NOTE: Maintain backward compatibility by automatically migrating the existing single OSV configuration into a default source entry during upgrade.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Research direction

Start by reading the existing OSV vulnerability source page and its single-source configuration, then trace the upgrade path that loads that configuration. Done means multiple independently configurable OSV sources appear as sub tabs, each has ecosystem scoping, and the existing configuration migrates into a default source entry without breaking upgrades.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
full-stack
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.