DependencyTrack / DependencyTrack/frontend

Display Consolidated Component Occurrences

Open
#1,303 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Vue
Stars
171
Forks
250
Avg merge
10h 56m
Merged PRs (30d)
84

Description

### Current Behavior

### **Background**
In our product-level SBOMs, we often encounter the same component (e.g., `log4j-core@2.17.1`) appearing in multiple container images. To reduce duplication, we are planning to use the `evidence.occurrences.location` field to consolidate these findings into a **single component entry**, even if the component appears in multiple images or multiple times within the same image.

### **Supporting Files**
- [duplicated.json](https://github.com/user-attachments/files/21621190/duplicated.json): Current approach with 5 separate `log4j` components.
- [deduped.json](https://github.com/user-attachments/files/21621191/deduped.json): Proposed approach with 1 `log4j` component and 5 `occurrences`.

### Proposed Behavior

We’d like DT to:
- **Showcase this consolidated representation** clearly in the UI.
- Indicate that the component is found in **multiple images or locations**, even though it appears only once in the SBOM.
- Optionally, provide a way to **view the specific image paths** listed under `evidence.occurrences.location`.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/frontend/issues) for whether this enhancement was already requested

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.