Vulnerability Tree

[BlythMeister]

Current Behavior:

Vulnerability doesn't show the reason your project has that vulnerable component.
You need to work through the project dependencies manually to establish if you can actually take the required update.

Proposed Behavior:

On the vulnerability screen include the upward depenency tree to the top level item.

This way you will be able to identify why you have a reference to the vulnerable dependency.

[nscuro]

Great suggestion, thanks @BlythMeister!

[rkg-mm]

We are working on big improvements of the dependency-tree, to make it actually useful at all. This would cover stuff of DependencyTrack/frontend#85 and also further ideas.
Basically, we want to make the tree fully navigable, offer buttons in other views next to component name (e.g. vulnerability list, component list,...) which would open the tree expanded to all occurances of that component and probably highlighting them.
We also plan to offer a focus mode if you jumped in like this, which would hide anything not relevant to see the exact upwards path(s). A component could be included multiple times from different paths, which would be well visible then.

I think this would solve your requirement too, just a little different, since I have the same use case

[BlythMeister]

Yes that does sound great.

At the moment we can see a risk score and what the vulnerabilities are, but once we have that, it's many hours of manual looking for solutions (unless it's in a direct dependency)

[rkg-mm]

Yep, facing the same issue. Workaround until then: I look it up in the originally imported BOM.xml file, there the origination is visible, even though not quickly to look up.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.