Field possibly erroneously set as `Schema.RequiredMode.REQUIRED`

Open Beginner friendly
#6,018 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
68/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
java
Domain
api

Research direction

Start in src/main/java/org/dependencytrack/model/RepositoryMetaComponent.java around lines 84-90 and inspect the schema annotation for published, then trace the /v1/repository/latest response behavior. Done means the OpenAPI requiredness matches whether published is actually returned, or the endpoint consistently supplies a value.

Written by the indexing model from the issue text.

Description

defect in triage
Current Behavior

https://github.com/DependencyTrack/dependency-track/blob/626a0cbf1525fe75d1e00ef3423086173ce58963/src/main/java/org/dependencytrack/model/RepositoryMetaComponent.java#L84-L90

Comment says it's optional and from a quick search through the code base it appears to indeed be conditionally set, not set at all, etc.

This may cause issues for generated OpenAPI clients which assume that the field is always set.

Steps to Reproduce

An API call to /v1/repository/latest may return data such as:

{
    "repositoryType": "NPM",
    "name": "buffer",
    "latestVersion": "6.0.3",
    "lastCheck": 1775555220982
}

in which published is absent.

Expected Behavior

Either published to always have some value (0?) or, for it not be set as required.

Dependency-Track Version

4.13.3

Dependency-Track Distribution

Container Image

Database Server

N/A

Database Server Version

No response

Browser

N/A

Checklist
Dominant language
Java
Stars
4.2k
Forks
817
Avg merge
7h 47m
Merged PRs (30d)
270

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from DependencyTrack/dependency-track

All issues in DependencyTrack/dependency-track

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.