DependencyTrack / DependencyTrack/dependency-track
Add non-tracked component vulnerability analysis
Open
enhancement
needs milestone
p2
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
The `/v1/vulnerability/component/{ident}` endpoint allows the specifying a hash or component uuid to retrieve the vulnerabilities.
Enhance this endpoint to support Package URL.
Also, enhance this endpoint to support non-tracked components - or components that are not currently in the database. If a PURL is specified and the component is not tracked, this enhancement should use existing logic to perform a scan.
The cache manager should be used to cache responses if the component is not tracked.
Contributor guide
Assessment
This issue has not been assessed yet.