Skip to content

Consider OS distro during vulnerability matching #5782

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
nscuro wants to merge 1 commit into from
Closed

Consider OS distro during vulnerability matching #5782

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions dev/docker-compose.postgres.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,11 @@ services:

postgres:
image: postgres:14-alpine
command: >-
-c 'shared_preload_libraries=pg_stat_statements'
-c 'pg_stat_statements.track=all'
-c 'pg_stat_statements.max=10000'
-c 'track_activity_query_size=2048'
environment:
POSTGRES_DB: "dtrack"
POSTGRES_USER: "dtrack"
Expand All @@ -43,5 +48,16 @@ services:
- "postgres-data:/var/lib/postgresql/data"
restart: unless-stopped

pghero:
image: ankane/pghero
depends_on:
postgres:
condition: service_healthy
environment:
DATABASE_URL: "postgres://dtrack:dtrack@postgres:5432/dtrack"
ports:
- "127.0.0.1:8432:8080"
restart: unless-stopped
Comment on lines 31 to 60
Copy link

Copilot AI Feb 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The addition of pghero service and PostgreSQL configuration for pg_stat_statements monitoring is a development-only change that doesn't relate to the PR's stated purpose of OS distro vulnerability matching. Consider excluding these development environment changes from this PR or documenting them separately if they're needed for testing/debugging the new functionality.

Copilot uses AI. Check for mistakes.

volumes:
postgres-data: { }
3 changes: 2 additions & 1 deletion dev/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,9 @@ name: "dependency-track"

services:
apiserver:
image: dependencytrack/apiserver:snapshot-alpine
image: dependencytrack/apiserver:local-alpine
Copy link

Copilot AI Feb 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The code changes the image tag from snapshot-alpine to local-alpine which appears to be developer-specific. This change should likely be reverted or the file should not be included in this PR, as it's intended for local development environment configuration and this change might not work for other developers.

Suggested change
image: dependencytrack/apiserver:local-alpine
image: dependencytrack/apiserver:snapshot-alpine

Copilot uses AI. Check for mistakes.
environment:
EXTRA_JAVA_OPTIONS: "-Xmx2g"
Copy link

Copilot AI Feb 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The EXTRA_JAVA_OPTIONS environment variable for memory configuration appears to be developer-specific. Consider whether this should be included in this PR or if the entire docker-compose.yml changes should be excluded from version control or documented separately as optional development configuration.

Suggested change
EXTRA_JAVA_OPTIONS: "-Xmx2g"
# Optional: Configure JVM options (e.g., heap size) via EXTRA_JAVA_OPTIONS in your local environment.

Copilot uses AI. Check for mistakes.
# Speed up password hashing for faster initial login (default is 14 rounds).
ALPINE_BCRYPT_ROUNDS: "4"
TELEMETRY_SUBMISSION_ENABLED_DEFAULT: "false"
Expand Down
2 changes: 1 addition & 1 deletion src/main/java/org/dependencytrack/model/ConfigPropertyConstants.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,7 +85,7 @@ public enum ConfigPropertyConstants {
VULNERABILITY_SOURCE_GITHUB_ADVISORIES_ACCESS_TOKEN("vuln-source", "github.advisories.access.token", null, PropertyType.STRING, "The access token used for GitHub API authentication"),
VULNERABILITY_SOURCE_GITHUB_ADVISORIES_LAST_MODIFIED_EPOCH_SECONDS("vuln-source", "github.advisories.last.modified.epoch.seconds", null, PropertyType.INTEGER, "Epoch timestamp in seconds of the latest observed GHSA modification time"),
VULNERABILITY_SOURCE_GOOGLE_OSV_BASE_URL("vuln-source", "google.osv.base.url", "https://osv-vulnerabilities.storage.googleapis.com/", PropertyType.URL, "A base URL pointing to the hostname and path for OSV mirroring"),
VULNERABILITY_SOURCE_GOOGLE_OSV_ENABLED("vuln-source", "google.osv.enabled", null, PropertyType.STRING, "List of enabled ecosystems to mirror OSV"),
VULNERABILITY_SOURCE_GOOGLE_OSV_ENABLED("vuln-source", "google.osv.enabled", "Alpine;Debian;Ubuntu", PropertyType.STRING, "List of enabled ecosystems to mirror OSV"),
Copy link

Copilot AI Feb 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The default value for OSV enabled ecosystems changed from null to "Alpine;Debian;Ubuntu". This is a breaking change that will automatically enable OSV mirroring for these ecosystems for existing installations. This could cause unexpected network traffic, disk usage, and processing load for users upgrading to this version. Consider documenting this in the PR description and release notes, or providing a migration strategy.

Copilot uses AI. Check for mistakes.
VULNERABILITY_SOURCE_GOOGLE_OSV_ALIAS_SYNC_ENABLED("vuln-source", "google.osv.alias.sync.enabled", "false", PropertyType.BOOLEAN, "Flag to enable/disable alias synchronization for OSV"),
VULNERABILITY_SOURCE_EPSS_ENABLED("vuln-source", "epss.enabled", "true", PropertyType.BOOLEAN, "Flag to enable/disable Exploit Prediction Scoring System"),
VULNERABILITY_SOURCE_EPSS_FEEDS_URL("vuln-source", "epss.feeds.url", "https://epss.cyentia.com", PropertyType.URL, "A base URL pointing to the hostname and path of the EPSS feeds"),
Expand Down
Loading
Loading