In modern enterprise DevOps and platform engineering, the software supply chain is vast and complex. Binary artifact repositories like JFrog Artifactory store thousands of container images, language packages (npm, PyPI, Maven), and Helm charts alongside critical CI/CD build execution logs and SBOM dependencies.

When vulnerabilities arise (such as zero-day CVEs in upstream dependencies) or release rollbacks occur, platform engineers and security analysts need to rapidly answer connected questions:

Which Docker images deployed in staging were compiled from Git commit 9f8a2b ?

What published modules declare dependencies on a specific vulnerable package version?

What is the SHA-256 cryptographic checksum and build timeline for our payment microservice release?

Because software supply chains are intrinsically hierarchical and relational ( Repository $\rightarrow$ Artifact $\rightarrow$ Module $\rightarrow$ Build Run $\rightarrow$ Dependencies ), flat text search often misses the full dependency context.

As…