DependencyTrack / DependencyTrack/dependency-track

Add notifications for comments posted on vulnerability analyses

Open
#7,041 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Currently, no notifications (at least no webhook notifications) are sent when a comment is posted on a vulnerability analysis. Notifications are only sent when the state is changed or the vulnerability is suppressed.

### Proposed Behavior

I want to be able to configure notifications for comments on detected vulnerabilities. I would like to have a custom notification group for this, for example `VULNERABILITY_ANALYSIS_COMMENT`, that I can enable for an alert. The notification should include the comment, timestamp and who posted the comment.

I would like to have this behaviour so that I can stay up to date on when other users comment on found vulnerabilities and keep the discussion going if needed. This issue might be slightly related to https://github.com/DependencyTrack/dependency-track/issues/4744, but I believe the enhancement I'm requesting is separate from https://github.com/DependencyTrack/dependency-track/issues/4744.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Research direction

No implementation files or tests are named. Start by tracing the existing notifications for vulnerability state changes and suppressions, and review related issue #4744 to understand the boundary. Done means comments on vulnerability analyses can trigger a configurable notification group containing the comment, timestamp, and author.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.