DependencyTrack / DependencyTrack/dependency-track

Make use of "Last BOM Import" as input for Policy engine

Open
#2,052 2 comments 5 reactions 0 assignees View on GitHub
enhancement p3
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior:

As of Dependency-Track v4.6.0, the policy engine does not yet support checking for anything relating to age.

### Proposed Behavior:
Use "Last BOM Import" date an input for the Policy engine. This way, one would be able to define freshness rules and alert on them if need be. This is totally separate from checking for components being out of date (or just old)... this is checking for possible pipeline problems...

- BOM not updated because the project has been archived and no one updated Dependency-Track
- BOM update because of changes in build process. ie, the BOM is **supposed** to be uploaded - but something has broken.

This suggestion is not mine... it comes from @syalioune in https://github.com/DependencyTrack/frontend/issues/147

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.