DependencyTrack / DependencyTrack/dependency-track

Add non-tracked component vulnerability analysis

Open
#374 6 comments 2 reactions 0 assignees View on GitHub
enhancement needs milestone p2
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

The `/v1/vulnerability/component/{ident}` endpoint allows the specifying a hash or component uuid to retrieve the vulnerabilities.

Enhance this endpoint to support Package URL.

Also, enhance this endpoint to support non-tracked components - or components that are not currently in the database. If a PURL is specified and the component is not tracked, this enhancement should use existing logic to perform a scan.

The cache manager should be used to cache responses if the component is not tracked.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.