dependency-check / dependency-check/DependencyCheck

Enhancement: Add Dependency Tree

Open
#201 5 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

From email with @stevespringett:

"I understand the whole dependency-of-dependency has a vulnerability situation… It’s all too common.

What might be a good solution for this is to use the following build scenario:
- Use DC Maven plugin to perform a check
- Use DC Jenkins plugin (publisher step only) to visualize results
- Use maven-dependency-plugin to create a dependency tree

What would be nice is if either the Dependency-Check Maven or Jenkins plugin included the dependency tree as part of the result. As the author of the Jenkins plugin, I can say that I have not investigated this possibility, although I think it would be extremely valuable."

The output could be a tree of dependencies, each with the sum of the CVSS scores of any inherited vulnerabilities and links to the details (as in the present version). That would make it easy for the reviewer to target the nodes on the tree (which are dependencies) that introduce the most vulnerabilities and remediate those.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.