DependencyTrack / DependencyTrack/dependency-track

Track Status / Support Life Cycle of packages (supported/unsupported/abondoned/...)

Open
#4,476 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Status / Support Life Cycle of packages is not tracked by Dependency Track

### Proposed Behavior

Some package repositories provide information about packages that are abondoned (Composer). Other repositories might also provide information about whether packages are supported or unsupported.

It would be good if these could be tracked by Dependency Track, for example to add risk scores or flags to packages that are abandoned.

Some example from Compose / Packagist:

https://packagist.org/p2/laminas/laminas-text.json
`"abandoned": true`

https://packagist.org/p2/laminas/laminas-mail.json

`"abandoned": "symfony/mailer"`

`symfony-mailer` is suggested as replacement for the abandoned `laminas-mail`.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.