search

DependencyTrack / dependency-track

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.
https://dependencytrack.org/
Apache License 2.0
2.72k stars 580 forks source link

Limit alert to all versions of a project #803

Open dfn-certling opened 4 years ago

dfn-certling commented 4 years ago

Current Behavior:

Portfolio alerts can be limited to a list of projects. With each version of a project being essentially a separate project, alerts have to be modified to include new versions of a project.

Proposed Behavior:

With different teams responsible for different projects and users with permission PORTFOLIO_MANAGEMENT being able to create new project versions but not configure notifications without giving them access to the complete set of configuration options, it would be nice to be able to limit alerts to all versions of a given project. Thus creating new versions would automatically include notifications for the new version via the previously configured publisher.

codenox-vs commented 2 years ago

We have the exact same "issue". Our teams disabled notification since it is hard to impossible guess if the issues concerns them. Or is this there a best practice how to handle this better if more than one "team" is using the software?

heintmaSICKAG commented 2 years ago

I just found this enhancement and can confirm the necessity of this functionality. If you have a lot of projects it is nearly impossible to configure all the notifications. We have some ideas by scripting with the api - is this the best way to go?

ogmueller commented 2 years ago

In my opinion, it should be possible to limit alerts to a project including a version and to a project only (even better would be a regex for the version though, like "release/.*"). I believe something like "new" or latest" is not really relevant, because in most of the cases you want to be alerted, if any new BOM has been uploaded having a security issue, no matter how old the version is. if you have old versions in dtrack and you don't chance them, you will not get any notification anymore anyway.