Support multiple configurable OSV data sources by sahibamittal · Pull Request #7113 · DependencyTrack/dependency-track

sahibamittal · 2026-08-25T10:48:24Z

Description

Replace the flat OSV runtime config with a list of independently configurable sources.
Compose one OsvVulnDataSource per enabled source, namespace watermark keys per source name.
Migrate legacy OSV configs and watermarks to a default source.

Addressed Issue

Closes #6331

Additional Details

Frontend: DependencyTrack/frontend#1783
Docs update: DependencyTrack/docs#237

Checklist

I have read and understand the contributing guidelines
This PR fixes a defect, and I have provided tests to verify that the fix is effective
This PR implements an enhancement, and I have provided tests to verify that it works as intended
This PR introduces changes to the database model, and I have updated the migration changelog accordingly
This PR introduces new or alters existing behavior, and I have updated the documentation accordingly
This PR is a substantial change (per the ADR criteria), and I have added an ADR under docs/adr/

Signed-off-by: Sahiba Mittal <sahiba.mittal@citi.com>

owasp-dt-bot · 2026-08-25T10:48:37Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

codacy-production · 2026-08-25T10:49:50Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 24 complexity

Metric Results

Complexity 24

View in Codacy

🟢 Coverage 89.33% diff coverage · +0.00% coverage variation

Metric Results

Coverage variation ✅ +0.00% coverage variation (-1.00%)

Diff coverage ✅ 89.33% diff coverage (70.00%)

View coverage diff in Codacy

Coverage variation details

Coverable lines Covered lines Coverage

Common ancestor commit (8e0f33f) 44902 39270 87.46%

Head commit (501058f) 44956 (+54) 39319 (+49) 87.46% (+0.00%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

Coverable lines Covered lines Diff coverage

Pull request (#7113) 75 67 89.33%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

Signed-off-by: Sahiba Mittal <sahiba.mittal@citi.com>

nscuro

Mostly looks good with a few issues to fix and tweaks to make.

But this also introduces a new hazard where multiple feeds can contribute information for the same vulnerability. They'd override each other's data because our data model (i.e. VULNERABILITY.SOURCE column) is not granular enough to discern "OSV" from "OSV, feed XYZ". Should be documented.

Separately, so you know of any public OSV feed that this could be tested with? I checked Chainguard but they appear to use a different feed format that OSV? https://packages.cgr.dev/chainguard/osv/all.json

nscuro · 2026-09-02T10:07:21Z

+        if (currentDataSource == null) {
+            throw new IllegalStateException("No current data source to mark processed");
+        }
+        currentDataSource.markProcessed(bom);


MirrorVulnDataSourceActivity buffers up to 25 BOVs before marking them as processed. If during this buffering currentDataSource has transitioned from source A to source B, all BOVs are attributed to source B.

nscuro · 2026-09-02T10:08:58Z

+            for (final var source : config.getSources()) {
+                if (source.getName() == null || source.getName().isBlank()) {
+                    throw new InvalidRuntimeConfigException("No data source name provided");
+                }
+                if (!source.isEnabled()) {
+                    continue;
+                }
+                if (source.getDataUrl() == null) {
+                    throw new InvalidRuntimeConfigException("No data URL provided");
+                }
+                if (source.getEcosystems() == null || source.getEcosystems().isEmpty()) {
+                    throw new InvalidRuntimeConfigException("At least one ecosystem must be specified");
+                }


Add a validation that no duplicate source names can exist, so sources can't corrupt each other's watermarks etc.

nscuro · 2026-09-02T10:12:27Z

+            try {
+                dataSource.close();
+            } catch (final Exception e) {
+                LOGGER.warn("Failed to close data source: {}", dataSource, e);


OsvVulnDataSource doesn't implement toString so this will log something like OsvVulnDataSource@1a2b3c. Did you mean to call dataSource.getDataSourceName()?

nscuro · 2026-09-02T10:22:48Z

+          "name": {
+            "type": "string",
+            "title": "Name",
+            "description": "The name of the OSV data source.",
+            "minLength": 1
+          },


This is a free-text string that is used in watermark keys and other places. We should restrict this to a certain length and characters.

nscuro · 2026-09-02T10:23:18Z

+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+
+@WireMockTest


WireMock isn't used here.

nscuro · 2026-09-02T10:25:38Z

+/**
+ * @since 5.0.0
+ */
+final class OsvCompositeVulnDataSource implements VulnDataSource {


Consider adding the name of the current source to SLF4J's MDC so log statements show what source is currently being processed. Must be cautious though that the new MDC field doesn't leak, so probably best to only set it around calls to currentDataSource.

nscuro · 2026-09-02T10:29:57Z

-      "format": "uri"
-    },
-    "ecosystems": {
+    "sources": {


Nit: consider using the term "feed" for this instead, i.e. users would be consuming from the default and the Chainguard feeds using the OSV data source.

"source" is a bit overloaded since the overarching thing is already a source, vulnerabilities also have a source field.

sahibamittal · 2026-09-17T10:49:03Z

But this also introduces a new hazard where multiple feeds can contribute information for the same vulnerability. They'd override each other's data because our data model (i.e. VULNERABILITY.SOURCE column) is not granular enough to discern "OSV" from "OSV, feed XYZ". Should be documented.

Docs updated DependencyTrack/docs#237

Separately, so you know of any public OSV feed that this could be tested with? I checked Chainguard but they appear to use a different feed format that OSV? https://packages.cgr.dev/chainguard/osv/all.json

Not likely public, they provide OSV feed via API which is auth protected (via token).

Signed-off-by: Sahiba Mittal <sahiba.mittal@citi.com>

Support multiple configurable OSV data sources

6fabd43

Signed-off-by: Sahiba Mittal <sahiba.mittal@citi.com>

sahibamittal mentioned this pull request Aug 25, 2026

Enable multi OSV data source config on UI DependencyTrack/frontend#1783

Open

2 tasks

sahibamittal marked this pull request as ready for review August 27, 2026 14:37

sahibamittal added 2 commits August 27, 2026 15:42

Merge branch 'main' into issue-6331-Support-Multiple-OSV-Sources

caf3816

Cleanup formatting

82f7098

Signed-off-by: Sahiba Mittal <sahiba.mittal@citi.com>

nscuro requested changes Sep 2, 2026

View reviewed changes

sahibamittal added 5 commits September 17, 2026 14:09

Rename OSV sources to feeds; add MDC logging

6cd14e5

Signed-off-by: Sahiba Mittal <sahiba.mittal@citi.com>

Track origin osv data source for Bom

eb80dd5

Signed-off-by: Sahiba Mittal <sahiba.mittal@citi.com>

Merge remote-tracking branch 'upstream/main' into pr/7113

046216c

Allow space in osv feed name

ef4861f

Signed-off-by: Sahiba Mittal <sahiba.mittal@citi.com>

Update OsvCompositeVulnDataSourceTest.java

501058f

Signed-off-by: Sahiba Mittal <sahiba.mittal@citi.com>

sahibamittal requested a review from nscuro September 18, 2026 10:13

Navigation Menu

Uh oh!

Support multiple configurable OSV data sources - #7113

Support multiple configurable OSV data sources#7113
sahibamittal wants to merge 8 commits into
DependencyTrack:mainfrom
sahibamittal:issue-6331-Support-Multiple-OSV-Sources

sahibamittal commented Aug 25, 2026 •

edited

Loading

Uh oh!

owasp-dt-bot commented Aug 25, 2026 •

edited

Loading

Uh oh!

codacy-production Bot commented Aug 25, 2026 •

edited

Loading

Uh oh!

nscuro left a comment

Uh oh!

nscuro Sep 2, 2026

Uh oh!

nscuro Sep 2, 2026

Uh oh!

nscuro Sep 2, 2026

Uh oh!

nscuro Sep 2, 2026

Uh oh!

nscuro Sep 2, 2026

Uh oh!

nscuro Sep 2, 2026

Uh oh!

nscuro Sep 2, 2026

Uh oh!

sahibamittal commented Sep 17, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

sahibamittal commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Addressed Issue

Additional Details

Checklist

Uh oh!

owasp-dt-bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

codacy-production Bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

nscuro left a comment

Choose a reason for hiding this comment

Uh oh!

nscuro Sep 2, 2026

Choose a reason for hiding this comment

Uh oh!

nscuro Sep 2, 2026

Choose a reason for hiding this comment

Uh oh!

nscuro Sep 2, 2026

Choose a reason for hiding this comment

Uh oh!

nscuro Sep 2, 2026

Choose a reason for hiding this comment

Uh oh!

nscuro Sep 2, 2026

Choose a reason for hiding this comment

Uh oh!

nscuro Sep 2, 2026

Choose a reason for hiding this comment

Uh oh!

nscuro Sep 2, 2026

Choose a reason for hiding this comment

Uh oh!

sahibamittal commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sahibamittal commented Aug 25, 2026 •

edited

Loading

owasp-dt-bot commented Aug 25, 2026 •

edited

Loading

codacy-production Bot commented Aug 25, 2026 •

edited

Loading

sahibamittal commented Sep 17, 2026 •

edited

Loading