DependencyTrack / DependencyTrack/dependency-track
Support Multiple OSV Sources with sub tabs and ecosystem scoping
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Currently, the OSV vulnerability source configuration supports a single OSV data source (Google) and a set of mandatory ecosystem filters.
As OSV-compatible vulnerability feeds are becoming available from multiple providers (e.g., Chainsaw, Red Hat, IBM etc), it would be beneficial to support configuring multiple OSV sources independently on UI.
### Proposed Behavior
Introduce multiple OSV source configurations under the existing OSV section.
Within the existing OSV vulnerability source page, add horizontal tabs (or a tab-like selector) representing configured OSV sources.
Each OSV source should maintain its own configuration.
**Benefits**
- Supports multiple OSV-compatible providers simultaneously.
- Allows provider-specific ecosystem filtering.
- Provides a scalable foundation for future OSV-based data sources.
NOTE: Maintain backward compatibility by automatically migrating the existing single OSV configuration into a default source entry during upgrade.
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Research direction
Start by reading the existing OSV vulnerability source page and its single-source configuration, then trace the upgrade path that loads that configuration. Done means multiple independently configurable OSV sources appear as sub tabs, each has ecosystem scoping, and the existing configuration migrates into a default source entry without breaking upgrades.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- full-stack
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100