DependencyTrack / DependencyTrack/dependency-track

Decouple the concept of project from project versions

Open
#6,188 11 comments 1 reaction 0 assignees View on GitHub
breaking change enhancement p2 size/L
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Currently, multiple versions of the same project are represented as separate, independent records in the `PROJECT` table.

The concept of a project version is treated very loosely: the fact that two `PROJECT` records represent different versions of the same project is merely implied by both sharing the same `NAME` column.

This poses a challenge for features such as portfolio ACL, where it becomes increasingly impractical to explicitly grant access to individual project versions.

### Proposed Behavior

Decouple *project* from *project version*. Enable features such as portfolio ACL to apply to projects, rather than individual project version.

Most of what is currently associated with a project would switch to being associated with a project *version* instead. A rough sketch:

```mermaid
erDiagram
project {
bigint id pk
text name
}

project_version {
bigint id pk
bigint project_id fk
text name
}

component {
bigint id pk
bigint project_version_id fk
text name
text version
text purl
}

team {
bigint id pk
text name
}

project_version |o--o{ component: "contains"
project_version }|--|| project: "is version of"
project }o--o{ team: "is accessible by"
```

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/hyades/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/hyades/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.