dependency-check / dependency-check/DependencyCheck
Reporting version info for maven dependencies
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
This is an enhancement idea specifically around the maven mojo - I'm willing to take a first cut at this work. Looking for feedback on a) would it be useful and b) discussion of solution.
First question, would it be useful to be able to present the available versions? I see there's a ```getVersionEvidence()``` method that exists on the ```Dependency``` class, but don't see it used in the system. Would it be useful to add this data for maven?
If the answer above is "yes", I have some follow-up questions:
- would you like to see _all_ available versions or just _future_ available versions, ie. if _all_ is [1.0, 2.0, 3.0, 4.0, 5.0] and _current_ is 3.0, then _future_ would be [4.0, 5.0]. (I think the "right" answer is complex here. It could be absolute latest. It could be any non-vulnerable version ... assuming there's a CVE. It could be latest available on my major release, assuming semantic versioning).
- what would you like to see as the name (string) of the available version. Do you want just the version number itself or the full GAV?
Contributor guide
Assessment
This issue has not been assessed yet.