dependency-check / dependency-check/DependencyCheck
Enhancement: Add Dependency Tree
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
From email with @stevespringett:
"I understand the whole dependency-of-dependency has a vulnerability situation… It’s all too common.
What might be a good solution for this is to use the following build scenario:
- Use DC Maven plugin to perform a check
- Use DC Jenkins plugin (publisher step only) to visualize results
- Use maven-dependency-plugin to create a dependency tree
What would be nice is if either the Dependency-Check Maven or Jenkins plugin included the dependency tree as part of the result. As the author of the Jenkins plugin, I can say that I have not investigated this possibility, although I think it would be extremely valuable."
The output could be a tree of dependencies, each with the sum of the CVSS scores of any inherited vulnerabilities and links to the details (as in the present version). That would make it easy for the reviewer to target the nodes on the tree (which are dependencies) that introduce the most vulnerabilities and remediate those.
Contributor guide
Assessment
This issue has not been assessed yet.