From 93bef4919e84efa50bfaae495a3a70738ef1eb50 Mon Sep 17 00:00:00 2001 From: Sahiba Mittal Date: Tue, 25 Aug 2026 17:55:00 +0100 Subject: [PATCH 1/2] Add new multi-source OSV configuration in docs Signed-off-by: Sahiba Mittal --- docs/concepts/about-vulnerability-data-sources.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/docs/concepts/about-vulnerability-data-sources.md b/docs/concepts/about-vulnerability-data-sources.md index 31c53f7..0d75168 100644 --- a/docs/concepts/about-vulnerability-data-sources.md +++ b/docs/concepts/about-vulnerability-data-sources.md @@ -11,7 +11,7 @@ sources](../guides/administration/configuring-vulnerability-sources.md). ## Mirrored sources -Dependency-Track can mirror three public data sources into its own database: +Dependency-Track can mirror several public and private data sources into its own database. The main sources are: - **[National Vulnerability Database (NVD)](https://nvd.nist.gov/)** is the canonical CVE feed maintained by NIST. It contains over 200,000 CVE records spanning the early nineties to the present and describes affected products as @@ -24,12 +24,18 @@ Dependency-Track can mirror three public data sources into its own database: PyPA, RustSec, the Go team, distribution security teams, and others into one PURL-keyed dataset, and it covers ecosystems and distributions that NVD and GHSA do not (for example crates.io, Hex, Pub, Alpine, and Debian). + OSV is now configured as one or more independent OSV-compatible data sources rather than a single flat setting. The + default source mirrors the public Google dataset, and you can add additional sources for internal mirrors, alternate + upstreams, or custom ecosystem subsets. Each configured source is managed independently, with its own enabled state, + URL, ecosystem selection, and watermarking. + ### Picking sources The three feeds overlap heavily for open source ecosystems. Most operators do not need all three: - **GHSA and OSV cover much of the same ground.** OSV ingests GitHub advisories and adds advisories from other curators - (PyPA, RustSec, Go, distribution security teams). OSV also lets you mirror per ecosystem, which is finer-grained + (PyPA, RustSec, Go, distribution security teams). When you support multiple OSV sources, you can mirror the public + dataset alongside a private mirror or a custom ecosystem split without treating them as a single monolithic feed, which is finer-grained control than GHSA offers. If you want one source for open source packages, prefer OSV. - **GHSA** is useful on its own if you stay close to the GitHub ecosystem or want the data exactly as GitHub publishes it, without the aggregation layer that OSV adds. From 7c19daad65f14505e9d8a561e66fb5a58952135b Mon Sep 17 00:00:00 2001 From: Sahiba Mittal Date: Tue, 25 Aug 2026 18:06:59 +0100 Subject: [PATCH 2/2] Fix lint Signed-off-by: Sahiba Mittal --- docs/concepts/about-vulnerability-data-sources.md | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/docs/concepts/about-vulnerability-data-sources.md b/docs/concepts/about-vulnerability-data-sources.md index 0d75168..8034c99 100644 --- a/docs/concepts/about-vulnerability-data-sources.md +++ b/docs/concepts/about-vulnerability-data-sources.md @@ -11,7 +11,7 @@ sources](../guides/administration/configuring-vulnerability-sources.md). ## Mirrored sources -Dependency-Track can mirror several public and private data sources into its own database. The main sources are: +Dependency-Track can mirror public and private data sources in its own database. The main sources are: - **[National Vulnerability Database (NVD)](https://nvd.nist.gov/)** is the canonical CVE feed maintained by NIST. It contains over 200,000 CVE records spanning the early nineties to the present and describes affected products as @@ -24,19 +24,18 @@ Dependency-Track can mirror several public and private data sources into its own PyPA, RustSec, the Go team, distribution security teams, and others into one PURL-keyed dataset, and it covers ecosystems and distributions that NVD and GHSA do not (for example crates.io, Hex, Pub, Alpine, and Debian). - OSV is now configured as one or more independent OSV-compatible data sources rather than a single flat setting. The - default source mirrors the public Google dataset, and you can add additional sources for internal mirrors, alternate - upstreams, or custom ecosystem subsets. Each configured source is managed independently, with its own enabled state, - URL, ecosystem selection, and watermarking. + OSV now supports named sources instead of a single flat setting. The default source mirrors the public Google + dataset, and you can add internal mirrors, alternate sources, or custom ecosystem subsets. Each configured source + has its own enabled state, URL, ecosystem selection, and watermarking. ### Picking sources The three feeds overlap heavily for open source ecosystems. Most operators do not need all three: - **GHSA and OSV cover much of the same ground.** OSV ingests GitHub advisories and adds advisories from other curators - (PyPA, RustSec, Go, distribution security teams). When you support multiple OSV sources, you can mirror the public - dataset alongside a private mirror or a custom ecosystem split without treating them as a single monolithic feed, which is finer-grained - control than GHSA offers. If you want one source for open source packages, prefer OSV. + (PyPA, RustSec, Go, and distribution security teams). When you run more than one OSV source, you can mirror the + public dataset alongside a private mirror or a custom ecosystem split without treating them as one feed. This gives + you finer-grained control than GHSA offers. If you want one source for open source packages, prefer OSV. - **GHSA** is useful on its own if you stay close to the GitHub ecosystem or want the data exactly as GitHub publishes it, without the aggregation layer that OSV adds. - **NVD** is the only mirrored source that meaningfully covers non-package software identified by CPE. Enable it when