DependencyTrack / DependencyTrack/dependency-track
Find a way to include original BOMs (or references to them) in notifications
Open
enhancement
p3
size/M
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
Due to payload size issues (BOMs can be 10s up to 100s of MiB large), we had to exclude original BOM and VEX contents from notifications of the following groups:
* `BOM_CONSUMED`
* `BOM_PROCESSED`
* `VEX_CONSUMED`
* `VEX_PROCESSED`
We should provide an alternative that still allows notification consumers to get a hold of the original documents.
Contributor guide
Assessment
This issue has not been assessed yet.