DependencyTrack / DependencyTrack/dependency-track

Add warning for missing component identifiers (CPE or purl)

Open
#4,218 2 comments 2 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Dependency-Track currently does not issue a warning when machine-readable identifiers, such as CPE or purl, are missing for third-party components. This absence of identifiers means that no security vulnerabilities can be identified for these components, potentially leaving projects exposed to untracked risks.

### Proposed Behavior

Dependency-Track should provide a visual hint or warning when a component lacks either a CPE or purl identifier. This feature could be configurable, allowing users to enable or disable the warning based on their needs. The warning will help users quickly identify components that may not be fully analyzed for security vulnerabilities.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.