endor-dependency-finding-provenance

Trace vulnerability provenance by correlating finding UUIDs, target dependency coordinates, and file paths against a specific commit scope. This verifies whether a vulnerability is fixed, present, or inconclusive without mixing namespaces or coordinate families.

Coordinate gaps in SBOM exports occur when API results and CSV exports are not properly reconciled. You can compare API rows against exports to explain missing data, orphaned related-resource errors, and resolve mismatches.

Verify a fixed dependency finding by tracing the lineage between PackageVersion and DependencyMetadata records for the specific SHA. This produces scope, evidence, conclusion, and confidence while separating API rows from the final conclusion.

Reconcile dependency findings with SBOM exports by applying coordinate-level matching and exact namespace pinning. This separates scope, API rows, and conclusions to accurately explain gaps, missing data, or orphaned resource errors.

Yes, you can investigate dependency lineage across project-scoped namespaces, but exact namespace pinning is required. This ensures coordinate-level matching remains accurate and prevents mixing coordinate families during the investigation.

Tracing dependency lineage requires exact namespace pinning and coordinate-level matching. Without proper evidence separation between scope, API rows, and conclusions, results for a specific branch or commit may be inconclusive.