DependencyTrack / DependencyTrack/dependency-track
Add notifications for comments posted on vulnerability analyses
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Currently, no notifications (at least no webhook notifications) are sent when a comment is posted on a vulnerability analysis. Notifications are only sent when the state is changed or the vulnerability is suppressed.
### Proposed Behavior
I want to be able to configure notifications for comments on detected vulnerabilities. I would like to have a custom notification group for this, for example `VULNERABILITY_ANALYSIS_COMMENT`, that I can enable for an alert. The notification should include the comment, timestamp and who posted the comment.
I would like to have this behaviour so that I can stay up to date on when other users comment on found vulnerabilities and keep the discussion going if needed. This issue might be slightly related to https://github.com/DependencyTrack/dependency-track/issues/4744, but I believe the enhancement I'm requesting is separate from https://github.com/DependencyTrack/dependency-track/issues/4744.
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Research direction
No implementation files or tests are named. Start by tracing the existing notifications for vulnerability state changes and suppressions, and review related issue #4744 to understand the boundary. Done means comments on vulnerability analyses can trigger a configurable notification group containing the comment, timestamp, and author.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100