DependencyTrack / DependencyTrack/dependency-track

Add a Clear Analysis Cache button

Open
#2,117 0 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior:
Currently the vulnerability analysis cache cannot be cleared by users or admins. The expiry time cannot be configured in the UI, only via the API.

### Proposed Behavior:
Add a way for users or admins to clear the analysis cache. This can be helpful if you need a accurate/current analysis result for the next vulnerability analysis run.

The use case is mainly for urgent vulnerabilities. Suppose you wake up to a log4j category vulnerability. But DT hasn't synced the vulnerability yet, it's not in the caches yet, so you don't see it in DT.
Same goes for metadata. A new release with a critical security fix might have been released, but it's not visible in DT yet due to caching and the task scheduler running the task only once per day.

Does it make sense to support this use case?

### Notes
- Should it be for admins only?
- Should it be the whole cache, or only for the specified component group/name or purl?
- Should it be per analyzer?
- The assumption is that this should be OK as outbound API calls are throttled by DT, and a similar things happens every 72 hours already when the cache is fully cleared.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.