DependencyTrack / DependencyTrack/dependency-track
Add warning for missing component identifiers (CPE or purl)
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Dependency-Track currently does not issue a warning when machine-readable identifiers, such as CPE or purl, are missing for third-party components. This absence of identifiers means that no security vulnerabilities can be identified for these components, potentially leaving projects exposed to untracked risks.
### Proposed Behavior
Dependency-Track should provide a visual hint or warning when a component lacks either a CPE or purl identifier. This feature could be configurable, allowing users to enable or disable the warning based on their needs. The warning will help users quickly identify components that may not be fully analyzed for security vulnerabilities.
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.