DependencyTrack / DependencyTrack/dependency-track

Add Policy Evaluator for Patched Version Availability (Patchable vs Non-Patchable)

Open
#5,731 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Dependency-Track policies cannot evaluate vulnerabilities based on whether a patched version exists.

As a result, policies/SLA checks treat all vulnerabilities similarly, even when no upgrade/patch is available.

### Proposed Behavior

Add a new policy evaluator that checks whether vulnerabilities associated with a component have a patched version available.

Policies should be able to trigger when:

1. Patched version is present, or
2. Patched version is not present

based on configured condition (IS / IS_NOT) and expected value (true / false).

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.