DependencyTrack / DependencyTrack/dependency-track
Provide Links to www.npmjs.com for npm modules with purl
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
https://www.npmjs.com/ is a resource that provides useful information that is not otherwise available in Dependency-Track. For example, the full list of versions, plus current tags.
Thus, where DT reports for angular 14.2.4 only that the latest version is 15.1.4, the npmjs website shows that there is no version 15 LTS and that the LTS for version 14 is 14.2.10
### Proposed Behavior
Where purl is available for npm component identity and the component is not internal, use the purl to generate a URL for the component that can be displayed as a link on the component.
Thus...
`pkg:npm/%40schematics/angular@14.2.4`
Would link to:
`https://www.npmjs.com/package/@schematics/angular/v/14.2.4`
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.