DependencyTrack / DependencyTrack/dependency-track

system wide vulnerability management

Open
#1,495 20 comments 15 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

Hi,
I would congratulate with you because that is a great project but I'm going to describe some "usability problems" that for me needs an improvement to make this project even better:

Our environment:
- dependencytrack version: 4.4
- a lot of projects
- use cases:
- in a CI environment: CI pipeline will fail if a vulnerability >= high will be found 
- to analyze stale projects for new vulnerabilities based on latest uploaded bom

Usability problems:

1) A new vulnerability used by almost all projects has been published but not fixed yet (e.g. https://github.com/advisories/GHSA-57j2-w4cx-62h2). If a fix on our projects needs to be released it will be blocked by CI pipeline check. Right now I must suppress and manage that vulnerability on every project. It would be great if we can also manage vulnerabilities "globally": managing vulnerabilities on every project is not sustainable and leads to errors.
2) Right now we can suppress/manage a vulnerability on every project but there is not a view of active/made suppressions (I need to track it somewhere else and if combined with problem 1 that is a huge management problem). It would be great if there was a recap view with all managed/suppressed vulnerabilities so we can figure out what is suppressed and need to be patched when a fix will be released

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.