DependencyTrack / DependencyTrack/dependency-track

Policies based on Version Distance check do not work

Open
#5,392 1 comment 1 reaction 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

I have configured a policy based on a version distance of 1 on the patch number.

Image

This policy is simply not generating any info policy violation (addressable in the Policy Violation Audit page), even if the system is reporting outdated components (a yellow triangle in the Version column of the Project/Components page). I am interested in policy violations in order to implement notifications to the developers.

I have tried letting the fields empty instead of setting a "0" value, with same effect.

I am not sure if it is a bug in Dependency track or there is a problem in how I configure the policy.

### Steps to Reproduce

1. Create a SBOM with a reference to an outdated component, like spring-web 6.1.21
2. Import it into dependency track.
3. Create a policy based on version distance, use a patch number difference of 1.

### Expected Behavior

Thre should be policy violations in the audit page.

### Dependency-Track Version

4.13.3

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Mozilla Firefox

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.