feat: dependency graph visualization

[kato83]

Summary

Add a dependency graph view showing the tree structure of components in an SBOM, highlighting which dependencies are vulnerable and through which path.

Motivation

When a vulnerability is found in a transitive dependency, developers need to know:

• Which direct dependency pulls it in?
• Are there multiple paths to the vulnerable package?
• Can I update a single direct dependency to resolve it?

Currently mayu shows a flat list of findings. A graph view would provide the context needed for efficient remediation.

Proposed Features

Dependency Tree View

• Display the full dependency tree from the SBOM
• Highlight vulnerable nodes with severity color coding
• Show the path from root → direct dependency → ... → vulnerable package
• Collapse/expand nodes for large trees

Data Source

• CycloneDX: dependencies array provides the graph structure
• SPDX: relationships with DEPENDS_ON type

UI

• Interactive tree/graph visualization (collapsible nodes)
• Click a vulnerable node to see finding details
• Filter: show only paths containing vulnerabilities
• Search: find a specific package in the tree

API

GET /api/v1/sbom/versions/:id/dependencies
{
  "root": "pkg:npm/my-app@1.0.0",
  "nodes": [...],
  "edges": [...],
  "vulnerable_paths": [
    ["my-app", "express", "qs", "CVE-2024-..."]
  ]
}

Implementation Notes

• Requires parsing the dependencies section of CycloneDX (currently only components is parsed)
• SPDX relationship parsing needed for SPDX SBOMs
• Graph rendering: consider D3.js force-directed graph or tree layout
• Start with tree view (simpler), consider force-directed graph as enhancement
• Large SBOMs (1000+ nodes) need virtualization or level-of-detail rendering