Dynamic report does not suppress vulnerabilities about dependency-track HOT 5 CLOSED

Can you clarify.

If a finding is suppressed, does it still show as being vulnerable in the report? If so, this is a defect that needs correcting.

If you're referring to the absence of the suppressed vulnerability nodes in the dynamically generated report, this is a known issue. The data model currently doesn't support it, nor did I envision this being a requirement. Is this a feature you envision using? If so, I'll flag it as an enhancement.

from dependency-track.

I think I'm referring to the defect.
The thing is that I add the suppression item in the suppressions.xml file, and in the next daily report it still appears as a vulnerability in the dynamic report created by the application.
However, in the report created by the dependency-check, and stored in the app dir, the vulnerability does not appear, and the vulnerabilities suppressed counter is increased by one (This does not happen in the report created by the application).

from dependency-track.

I see where the issues are. I need to fix this so that the historic data of the vulnerability remains but the current vulnerabilities (as of now) account for suppressions. This should reflect in the dashboard graph as well (a decrease in vulnerabilities when suppressions are used).

from dependency-track.

FYI, I have branched the project to make the source tree more clear.

• The only stable version (which can also be downloaded in a ready-to-deploy war) is 1.0.x.
• The master and 1.0-stable branches are in sync and should provide an easy way to compile your own war resulting in a working application.
• The 2.0-dev-springboot branch is unstable and has many issues. I do not intend to ever release this version. Just too many issues overall. This work was previously performed in the master branch but has since been reverted and separated to its own branch.
• All new development is being done in the 3.0-dev branch and is a complete rewrite of Dependency-Track from the ground up using modern technologies and an API-first design. It also doesn't rely on Spring.

from dependency-track.

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

from dependency-track.