Comments (5)
Can you clarify.
If a finding is suppressed, does it still show as being vulnerable in the report? If so, this is a defect that needs correcting.
If you're referring to the absence of the suppressed vulnerability nodes in the dynamically generated report, this is a known issue. The data model currently doesn't support it, nor did I envision this being a requirement. Is this a feature you envision using? If so, I'll flag it as an enhancement.
from dependency-track.
I think I'm referring to the defect.
The thing is that I add the suppression item in the suppressions.xml file, and in the next daily report it still appears as a vulnerability in the dynamic report created by the application.
However, in the report created by the dependency-check, and stored in the app dir, the vulnerability does not appear, and the vulnerabilities suppressed counter is increased by one (This does not happen in the report created by the application).
from dependency-track.
I see where the issues are. I need to fix this so that the historic data of the vulnerability remains but the current vulnerabilities (as of now) account for suppressions. This should reflect in the dashboard graph as well (a decrease in vulnerabilities when suppressions are used).
from dependency-track.
FYI, I have branched the project to make the source tree more clear.
- The only stable version (which can also be downloaded in a ready-to-deploy war) is 1.0.x.
- The master and 1.0-stable branches are in sync and should provide an easy way to compile your own war resulting in a working application.
- The 2.0-dev-springboot branch is unstable and has many issues. I do not intend to ever release this version. Just too many issues overall. This work was previously performed in the master branch but has since been reverted and separated to its own branch.
- All new development is being done in the 3.0-dev branch and is a complete rewrite of Dependency-Track from the ground up using modern technologies and an API-first design. It also doesn't rely on Spring.
from dependency-track.
This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.
from dependency-track.
Related Issues (20)
- Included in exported SBOM release note information
- Populate Manufacturer field in downloaded SBOM's
- Switch to use authors instead of author
- Move from unsupported tools property to replacement
- Ubuntu 24.04 fails to start Dependency Track HOT 6
- Update the documentation around Docker Compose
- License Information gets lost after a new analysis HOT 2
- Ability to trigger the Policy Evaluation engine HOT 2
- Analyse arbitrary BOM-file HOT 2
- MS Teams is retiring webhooks - Power Automate workflows is the new black HOT 11
- Problem with importing new BOMs HOT 11
- Please consider adopting OpenSSF Scorecard
- Audit vulnerabilities not showing records of big projects HOT 3
- Adding new tags sporadically overwrites previous tags HOT 1
- Identify and classify unknown components
- Limit notifications to portfolio(s) instead of/alongside projects HOT 2
- Affected project in mail-notification doesn't show name HOT 3
- DT project-urls in notification mails for 'new vulnerable dependency' don't work HOT 2
- Configuring experimental BOM Processing V2 fails HOT 8
- Implement Graceful Handling of Maven Central HTTP 429
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from dependency-track.