DependencyTrack / DependencyTrack/dependency-track
"Vulnerable Dependency Introduced" Alerts: Identify/Link Source Project
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior:
As of Dependency-Track v3.6.0 (#448), alerts for "New Vulnerability Identified" and "Vulnerable Dependency Introduced" include link(s).
* Email alerts: links to vulnerability and component
* Slack alerts: link to vulnerability
The vulnerability links have turned out to be very useful. However, they are not quite enough when it comes to "Vulnerable Dependency Introduced" where it can be really hard to tell **which** project has the introduced vulnerability when the total number of affected projects may be (say) 20 or so.
There's several times when I want to catch this. Two use cases:
* A new project version was created without including the audit history. ie, this is a teachable moment.
* A new project was created. In our microservice environment, a single vulnerability in a **new** project indicates quite simply that our archetype is not up to date.... and that needs to be actioned ASAP.
### Proposed Behavior:
Alerts for "Vulnerable Dependency Introduced" should include a link to the project, ideally also naming the project and version (because sometimes, just seeing the latter info is sufficient and you would not need to click through).
Contributor guide
Assessment
This issue has not been assessed yet.