DependencyTrack / DependencyTrack/dependency-track
Re-implement fuzzy analysis for internal scanner
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
The internal vulnerability scanner in DT v4 relies on Lucene indexes that the API server maintains.
Because we ~moved the vulnerability analysis logic out to a separate service, we don't have access to those indexes~ removed Lucene due to its incompatibility with horizontally scaled architectures, this no longer works.
Find a way to re-implement fuzzy vulnerability analysis.
> [!NOTE]
> The implementation of the Lucene-based fuzzy analysis in v4 is located here: https://github.com/DependencyTrack/dependency-track/blob/4.14.x/src/main/java/org/dependencytrack/search/FuzzyVulnerableSoftwareSearchManager.java
Contributor guide
Assessment
This issue has not been assessed yet.