[007xf]

Description

Document the proposed component policy violation update notifications, including the separate
opt-in group for approved or suppressed violations. Add a task-oriented guide and navigation,
and extend the group, filter, template, and policy expression references.

Addressed Issue

Companion documentation for DependencyTrack/dependency-track#7908, addressing
DependencyTrack/dependency-track#7649. The corresponding API server change must land before
these groups become available. The new documentation marks the feature as unreleased.

Frontend companion: DependencyTrack/frontend#2074.

Additional Details

The guide uses the frontend's alert workflow and a stable message expression containing all
matching KEV identifiers. The reference explains creation versus message changes, ordinary
versus reviewed subscriptions, preserved decisions, no historical replay, optional field presence,
and snake_case versus JSON/Pebble field names. Filter examples explicitly check captured values.

Document message-based limits, removals and wording changes, existing retry semantics,
notification-ID deduplication, permanent-failure diagnostics, and custom-template/consumer support.
Regenerate the notification schema and downloadable Protobuf file through the repository's
make generate-proto-docs target from the API server implementation. No generated file was
edited by hand, and the policy schema has no unrelated changes.

Validation:

• Native Protobuf documentation generation passed.
• Final strict make build passed on Python 3.14.7 with the locked dependencies.
• Final full make lint passed: Markdown checks covered 120 files with no errors, YAML and
  Python checks passed, and prose checks covered 119 files with no errors. The 392 existing
  prose warnings exactly match an isolated copy of the unchanged main branch using the same
  styles. No added line or new guide has a prose warning; lint rules are unchanged.
• Final rendered-content check: seven relevant pages and 372 local links/anchors, none broken.
• The documented Pebble excerpt ran against the production API server renderer with strict
  variables enabled. All six ordinary/reviewed, null-message, and optional-boolean cases passed.

Commands:

make generate-proto-docs APISERVER_DIR=../dependency-track
make lint
make build

The API server source is a sibling checkout containing the implementation proposed in
DependencyTrack/dependency-track#7908. The source schema matches the downloadable schema byte
for byte. The commit includes the contributor's DCO sign-off.