DependencyTrack / DependencyTrack/dependency-track

Re-implement fuzzy analysis for internal scanner

Open
#6,195 0 comments 0 reactions 0 assignees View on GitHub
enhancement help wanted p3 size/M
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

The internal vulnerability scanner in DT v4 relies on Lucene indexes that the API server maintains.

Because we ~moved the vulnerability analysis logic out to a separate service, we don't have access to those indexes~ removed Lucene due to its incompatibility with horizontally scaled architectures, this no longer works.

Find a way to re-implement fuzzy vulnerability analysis.

> [!NOTE]
> The implementation of the Lucene-based fuzzy analysis in v4 is located here: https://github.com/DependencyTrack/dependency-track/blob/4.14.x/src/main/java/org/dependencytrack/search/FuzzyVulnerableSoftwareSearchManager.java

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.