DependencyTrack / DependencyTrack/dependency-track

`AGGREGATE_LATEST_VERSION_CHILDREN` in deeper hirachies

Open
#6,554 4 comments 0 reactions 0 assignees View on GitHub
defect p2 size/S
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

We have projects nested multiple levels deep and want to have the collection projects use `AGGREGATE_LATEST_VERSION_CHILDREN`.
This works for the deepest level, but all levels above that ignore the contained collection projects as they can not be marked as latest.

In the image i would expect the top level project to have a sum of all non collection projects, as they are all marked as latest.

Image

### Steps to Reproduce

1. Create collection projects multiple levels deep with collection logic `AGGREGATE_LATEST_VERSION_CHILDREN`
2. Add a project with vulnerabilities to the lowest level

### Expected Behavior

I would expect collection projects to be counted as well.
Not sure if it makes sense to limit to only collection projects with `AGGREGATE_LATEST_VERSION_CHILDREN`.

I can have a try at implementing this.

### Dependency-Track Version

5.x

### Browser

Other

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the multi-level collection-project setup described in the issue with AGGREGATE_LATEST_VERSION_CHILDREN and a vulnerable project at the lowest level. Trace how collection projects are counted at each hierarchy level; done means the top-level project includes the expected sum of all non-collection projects marked as latest, with the applicable collection-project scope clarified.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.