DependencyTrack / DependencyTrack/dependency-track
Add Risk Score to Project Vulnerabilities graph
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 9h 4m
- Merged PRs (30d)
- 229
Description
### Current Behavior
You provide a nice graph to show the total number of Vulnerabilities grouped by their level. You also show the current Risk Score at the bottom of the graph.

### Proposed Behavior
It would be nice to have the Risk Score also shown in the graph to also see the improvements made over time. It could be an independent graph, but in my opinion it would be best to have it included in the same graph with its own y-axis. At the moment, fixing a critical vulnerability only decreases one graph by 1, same as it would be a medium one. Showing the Risk Score would be reflect also the importance of your improvements with bigger jumps and it would provide you the values of the past.

### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Research direction
Start by locating the Project Vulnerabilities graph and the code that supplies its historical vulnerability counts and Risk Score. Determine whether historical Risk Score data is available; done means the graph shows Risk Score over time with its own scale or axis while preserving the vulnerability-level series.
Written by the indexing model from the issue text.
Assessment
- Domain
- data-visualization, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100