DependencyTrack / DependencyTrack/dependency-track

Provide Links to www.npmjs.com for npm modules with purl

Open
#2,448 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

https://www.npmjs.com/ is a resource that provides useful information that is not otherwise available in Dependency-Track. For example, the full list of versions, plus current tags.

Thus, where DT reports for angular 14.2.4 only that the latest version is 15.1.4, the npmjs website shows that there is no version 15 LTS and that the LTS for version 14 is 14.2.10

### Proposed Behavior

Where purl is available for npm component identity and the component is not internal, use the purl to generate a URL for the component that can be displayed as a link on the component.

Thus...

`pkg:npm/%40schematics/angular@14.2.4`

Would link to:

`https://www.npmjs.com/package/@schematics/angular/v/14.2.4`

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.