Skip to content

Add new multi-source OSV configuration in docs #237

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sahibamittal wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add new multi-source OSV configuration in docs #237

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
93bef49
Add new multi-source OSV configuration in docs
sahibamittal Aug 25, 2026
7c19daa
Fix lint
sahibamittal Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions docs/concepts/about-vulnerability-data-sources.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ sources](../guides/administration/configuring-vulnerability-sources.md).

## Mirrored sources

Dependency-Track can mirror three public data sources into its own database:
Dependency-Track can mirror public and private data sources in its own database. The main sources are:

- **[National Vulnerability Database (NVD)](https://nvd.nist.gov/)** is the canonical CVE feed maintained by NIST. It
contains over 200,000 CVE records spanning the early nineties to the present and describes affected products as
Expand All @@ -24,13 +24,18 @@ Dependency-Track can mirror three public data sources into its own database:
PyPA, RustSec, the Go team, distribution security teams, and others into one PURL-keyed dataset, and it covers
ecosystems and distributions that NVD and GHSA do not (for example crates.io, Hex, Pub, Alpine, and Debian).

OSV now supports named sources instead of a single flat setting. The default source mirrors the public Google
dataset, and you can add internal mirrors, alternate sources, or custom ecosystem subsets. Each configured source
has its own enabled state, URL, ecosystem selection, and watermarking.

### Picking sources

The three feeds overlap heavily for open source ecosystems. Most operators do not need all three:

- **GHSA and OSV cover much of the same ground.** OSV ingests GitHub advisories and adds advisories from other curators
(PyPA, RustSec, Go, distribution security teams). OSV also lets you mirror per ecosystem, which is finer-grained
control than GHSA offers. If you want one source for open source packages, prefer OSV.
(PyPA, RustSec, Go, and distribution security teams). When you run more than one OSV source, you can mirror the
public dataset alongside a private mirror or a custom ecosystem split without treating them as one feed. This gives
you finer-grained control than GHSA offers. If you want one source for open source packages, prefer OSV.
- **GHSA** is useful on its own if you stay close to the GitHub ecosystem or want the data exactly as GitHub publishes
it, without the aggregation layer that OSV adds.
- **NVD** is the only mirrored source that meaningfully covers non-package software identified by CPE. Enable it when
Expand Down