DependencyTrack / DependencyTrack/dependency-track

Add Dependency-Track as default project

Open
#1,559 9 comments 2 reactions 0 assignees View on GitHub
enhancement needs milestone p2
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior:
When starting a fresh instance of Dependency-Track, there are no projects in the portfolio.

### Proposed Behavior:
Add Dependency-Track as default project to every new portfolio, with the SBOM that has been generated during the build (should be in the resources folder).

When a new critical CVE-vulnerability is reported, companies want to know whether any of the applications within their application landscape are affected by this vulnerability. Dependency-Track is part of this application landscape, so I think it should be part of the portfolio.

This project can also be used as an example project for users who want to quickly try out Dependency-Track without generating an SBOM themselves.

Maybe the project can be made read-only, but this would take more effort to implement. I’m also not sure whether the front-end and API server should be added as separate projects, or all components should be added to the same project.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.