DependencyTrack / DependencyTrack/dependency-track
Display GHSA affected/patched versions
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
Show affected and fixed version ranges for GitHub Advisory vulnerabilities.
### Current Behavior:
In Dependency Track v4.4, GHSA vulnerability details (e.g. overview, references) are shown, but the information about affected and patched/fixed version is missing. For instance, [GHSA-mv2r-q4g5-j8q5](https://github.com/advisories/GHSA-mv2r-q4g5-j8q5) is currently shown like this:
Note that it is not clear which version of `Microsoft.Data.OData` the issue is about, or which version includes the fix.
### Proposed Behavior:
Display the affected and fixed/patched versions inside Dependency Track UI, similar to https://github.com/advisories/GHSA-mv2r-q4g5-j8q5:
Contributor guide
Assessment
This issue has not been assessed yet.