DependencyTrack / DependencyTrack/dependency-track

Audit Trail persists if component goes away

Open
#2,558 2 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Currently, if you upload an SBOM that no longer contains a component, then that component disappears from the component list and audit vulnerabilities (obviously). The problem is that if that component gets added back in, it reappears in the components but all of the previous audit trail is gone. This particularly concerning if you accidently uploaded an empty SBOM. All the audit trail would be gone.

### Proposed Behavior

To prevent accidental loss of data and to provide an archive of past issues, the audit trail should persist even if the component disappears. If the component reappears in the SBOM, it should automatically relink to the appropriate audit trail. Thank you!

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.