DependencyTrack / DependencyTrack/dependency-track

"Vulnerable Dependency Introduced" Alerts: Identify/Link Source Project

Open
#592 0 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior:
As of Dependency-Track v3.6.0 (#448), alerts for "New Vulnerability Identified" and "Vulnerable Dependency Introduced" include link(s).
* Email alerts: links to vulnerability and component
* Slack alerts: link to vulnerability

The vulnerability links have turned out to be very useful. However, they are not quite enough when it comes to "Vulnerable Dependency Introduced" where it can be really hard to tell **which** project has the introduced vulnerability when the total number of affected projects may be (say) 20 or so.

There's several times when I want to catch this. Two use cases:
* A new project version was created without including the audit history. ie, this is a teachable moment.
* A new project was created. In our microservice environment, a single vulnerability in a **new** project indicates quite simply that our archetype is not up to date.... and that needs to be actioned ASAP.

### Proposed Behavior:
Alerts for "Vulnerable Dependency Introduced" should include a link to the project, ideally also naming the project and version (because sometimes, just seeing the latter info is sufficient and you would not need to click through).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.