dependency-check / dependency-check/azuredevops
separate warning threshold or CVSS score output
Open
enhancement
- Dominant language
- TypeScript
- Stars
- 53
- Forks
- 35
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
I would like to suggest adding a separate warning threshold.
I know there's warnOnCVSSViolation parameter, but unfortunately it's implemented as boolean only.
The idea is to be able to have different task result based on CVSS score.
e.g.
0-4 => ok
4-6 => warning
6-10 => fail
Alternatively, would it be possible to declare CVSS score as output variable? This way we could easily evaluate the score and break the pipe in a subsequent task ourself...
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.