DependencyTrack / DependencyTrack/dependency-track
Make use of "Last BOM Import" as input for Policy engine
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior:
As of Dependency-Track v4.6.0, the policy engine does not yet support checking for anything relating to age.
### Proposed Behavior:
Use "Last BOM Import" date an input for the Policy engine. This way, one would be able to define freshness rules and alert on them if need be. This is totally separate from checking for components being out of date (or just old)... this is checking for possible pipeline problems...
- BOM not updated because the project has been archived and no one updated Dependency-Track
- BOM update because of changes in build process. ie, the BOM is **supposed** to be uploaded - but something has broken.
This suggestion is not mine... it comes from @syalioune in https://github.com/DependencyTrack/frontend/issues/147
Contributor guide
Assessment
This issue has not been assessed yet.