Versions Compared

Old Version 5

changes.mady.by.user Unknown User (engelen)

Saved on

compared with

New Version 6

changes.mady.by.user Unknown User (engelen)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: note that VEX can be used in DependencyTrack

...

Various scanning tools exist to flag advisories in dependencies, which can be run by us, but also by users of our software. To improve the accuracy of such tools, it would be great if we could share the analysis of whether an advisory in a dependency affects our project in a machine-readable way. VEX (and to some extent VDR) file formats are meant for this. The ecosystem around these tools is still very much in development, if you want to experiment with these feel free to email security@apache.org.

VEX documents can be consumed by our DependencyTrack instance. You can read more about this on the page about SBOM Software Bill of Materials.