DependencyTrack / DependencyTrack/dependency-track

Improved Usage of Outdated Dependency Version Identification

Open
#257 2 comments 2 reactions 0 assignees View on GitHub
enhancement p2
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

Dependency Track has provided support for "Outdated Dependency Version Identification" since v3.1 (see #126), displaying "risk" icons in Project -> Dependencies

- yellow warning triangle: outdated component, mouse-over text provides latest version number.
- green warning triangle: component is up to date

There are a couple of accessibility problems with this...
- use of colour alone to differentiate icons can cause issues for those who are colour blind.
- information (latest version) hard to access without a lot of mouse-work. This impacts all users... consider a project with a couple of hundred dependencies where 100 are out if date. Also, (but I have not tested) I wonder whether usability on tablets/mobiles might be problematic.

I suggest:
- Display latest version in a separate column.
- Indicate when a later version addresses a threat. ie, if one sees 2 components with threats and only 1 has a fix, then it's clear which is immediately (or easily) actionable.
- Display this column (and fix availability) on the audit screen.
- Display also on components screen. It's here that one can get a nice global picture and then zoom in (click on component and then on projects")

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.