DependencyTrack / DependencyTrack/dependency-track
Policies based on Version Distance check do not work
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
I have configured a policy based on a version distance of 1 on the patch number.
This policy is simply not generating any info policy violation (addressable in the Policy Violation Audit page), even if the system is reporting outdated components (a yellow triangle in the Version column of the Project/Components page). I am interested in policy violations in order to implement notifications to the developers.
I have tried letting the fields empty instead of setting a "0" value, with same effect.
I am not sure if it is a bug in Dependency track or there is a problem in how I configure the policy.
### Steps to Reproduce
1. Create a SBOM with a reference to an outdated component, like spring-web 6.1.21
2. Import it into dependency track.
3. Create a policy based on version distance, use a patch number difference of 1.
### Expected Behavior
Thre should be policy violations in the audit page.
### Dependency-Track Version
4.13.3
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
_No response_
### Browser
Mozilla Firefox
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.