DependencyTrack / DependencyTrack/dependency-track

Project uniqueness should not include the version

Open
#2,050 7 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

The enhancement may already be reported! Please search for the enhancement before creating one.

### Current Behavior:
Currently a project is identified by the project name and the version. You have the possibility to add teams, notifications, tags and much more to the project. However, whenever e new version is released a completely new project was generated. This includes that the team assignment or the tags are lost.
For now I see only one option to do not use the version for the sbom upload, or use always the same.

### Proposed Behavior:
I would expect, that the project would be identified by the name and all relevant settings like tags, team assignment, notifications, ... will be reused also in newer project versions, otherwise the Portfolio Access Control on Teams and many other information are lost and useless.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.