DependencyTrack / DependencyTrack/dependency-track
Improved Usage of Outdated Dependency Version Identification
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
Dependency Track has provided support for "Outdated Dependency Version Identification" since v3.1 (see #126), displaying "risk" icons in Project -> Dependencies
- yellow warning triangle: outdated component, mouse-over text provides latest version number.
- green warning triangle: component is up to date
There are a couple of accessibility problems with this...
- use of colour alone to differentiate icons can cause issues for those who are colour blind.
- information (latest version) hard to access without a lot of mouse-work. This impacts all users... consider a project with a couple of hundred dependencies where 100 are out if date. Also, (but I have not tested) I wonder whether usability on tablets/mobiles might be problematic.
I suggest:
- Display latest version in a separate column.
- Indicate when a later version addresses a threat. ie, if one sees 2 components with threats and only 1 has a fix, then it's clear which is immediately (or easily) actionable.
- Display this column (and fix availability) on the audit screen.
- Display also on components screen. It's here that one can get a nice global picture and then zoom in (click on component and then on projects")
Contributor guide
Assessment
This issue has not been assessed yet.