DependencyTrack / DependencyTrack/frontend
Vulnerability Screen: Column for Component Version
- Dominant language
- Vue
- Stars
- 171
- Forks
- 250
- Avg merge
- 10h 56m
- Merged PRs (30d)
- 84
Description
### Current Behavior:
in v4.5.1, the page for an individual vulnerability has an "Affected Projects" screen that displays two columns: name and version (where both reference the project itself).
In the use case where one has a vulnerability X where DT reports that (say) 60 projects are affected but research has already established that this is only correct for a limited range of versions and everything else is a false positive... it is not currently possible to determine which is which from this screen. It is necessary to drill down to EVERY occurrence one by one and apply auditing where needed.
### Proposed Behavior:
* Add a sortable "component version" column to the page. I would be happy if the info were displayed as a PURL (so that everything can be in one column and not 2 or 3).
* It would be useful to render this info as a link to the component itself.
* Consider tweaking "version" column to rename it to "project version".... just for clarity.
With the new column it would then be easy to inspect the list of 60 projects and easily see which still need to have audit updates applied.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the individual vulnerability's Affected Projects screen described in the issue and inspect how its existing name and version columns are populated. Confirm whether component version data is available there, then verify that the new sortable column, component link, and clearer project-version label meet the proposed behavior.
Written by the indexing model from the issue text.
Assessment
- Domain
- frontend
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100