DependencyTrack / DependencyTrack/dependency-track
False Alerts on Old Versions of Dependencies in Slack Notifications
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
In our Production environment we have observed that alerts for vulnerabilities are being triggered based on outdated versions of dependencies that have already been patched. These alerts do not reflect the latest SBOM uploads and are referencing old versions that are no longer in use. The outdated versions are not visible in the OWASP Dependency-Track UI but appear in Slack notifications.
### Steps to Reproduce
1. Deploy a service with a vulnerable version of a dependency (e.g., pkg:npm/vite@5.2.2).
2. Patch the vulnerability by updating the dependency to a non-vulnerable version.
3. Upload the updated SBOM to OWASP Dependency-Track.
4. Monitor Slack notifications for vulnerability alerts referencing the old, vulnerable version despite the update.
### Expected Behavior
Alerts for vulnerabilities should be based on the most recent SBOM uploads, reflecting the current versions of dependencies. Once a vulnerability is patched and the SBOM is updated, there should be no alerts referencing old versions of the dependencies.
**Here are two examples of the issue:**
1. A service currently at version c776dc233eaed received an alert for a vulnerability in pkg:npm/vite@5.2.2, which is an old version from March 22.
2. Another service currently at version 79 received an alert for a vulnerability in pkg:npm/vite@5.1.6, which is an old version from March 20.
These alerts are not consistent with the current state of the services and do not appear in the OWASP Dependency-Track UI, only in Slack notifications. This issue occurs sporadically and not on a regular basis.
Thank you for your assistance in resolving this issue.
### Dependency-Track Version
4.10.x
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
15.5
### Browser
Google Chrome
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.