Software Composition Perspective
The Software Composition perspective gives you visibility into third-party dependencies and their known vulnerabilities and policy violations.
It is populated in either of two ways:
- by connecting a Software Composition Analysis (SCA) tool such as JFrog Xray, or
- by uploading vulnerability reports that your builds produce.
Both sources can be used together, and the views described below show data from either.
The perspective consists of the following views:
- Builds View: Lists all builds imported from the SCA tool or uploaded as vulnerability reports, lets you browse their versions, and inspect detailed scan results including components, vulnerabilities, violations, and associated code commits.
- Violations View: Provides a consolidated overview of policy violations across the latest build versions. From here you can mark violations as tolerated or false positive.
- SBOM View: Lists all components (third-party dependencies) contained in the SBOMs uploaded to the project.
- Exclusion Rules View: Shows all rules that exclude specific violations from being reported. Rules can be created in Teamscale or imported from the SCA tool, and optionally require approval before taking effect.
Exclusion Approval Workflow
Teamscale supports an optional two-step approval workflow for violation exclusions. When enabled, newly created exclusion rules enter a Pending state and require approval by another user before they take effect. This is the same workflow used for finding exclusions and can be enabled independently for Software Composition violations in the project options under Exclusion Workflow.