DependencyTrack / DependencyTrack/dependency-track
`AGGREGATE_LATEST_VERSION_CHILDREN` in deeper hirachies
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
We have projects nested multiple levels deep and want to have the collection projects use `AGGREGATE_LATEST_VERSION_CHILDREN`.
This works for the deepest level, but all levels above that ignore the contained collection projects as they can not be marked as latest.
In the image i would expect the top level project to have a sum of all non collection projects, as they are all marked as latest.
### Steps to Reproduce
1. Create collection projects multiple levels deep with collection logic `AGGREGATE_LATEST_VERSION_CHILDREN`
2. Add a project with vulnerabilities to the lowest level
### Expected Behavior
I would expect collection projects to be counted as well.
Not sure if it makes sense to limit to only collection projects with `AGGREGATE_LATEST_VERSION_CHILDREN`.
I can have a try at implementing this.
### Dependency-Track Version
5.x
### Browser
Other
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Research direction
Start by reproducing the multi-level collection-project setup described in the issue with AGGREGATE_LATEST_VERSION_CHILDREN and a vulnerable project at the lowest level. Trace how collection projects are counted at each hierarchy level; done means the top-level project includes the expected sum of all non-collection projects marked as latest, with the applicable collection-project scope clarified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100