Composer: add vulnerability mirroring - cleanup

Signed-off-by: Valentijn Scholten <valentijnscholten@gmail.com>
DependencyTrack · Jan 5, 2025 · 1f39a95 · 1f39a95
1 parent 6489de1
commit 1f39a95
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/src/main/java/org/dependencytrack/tasks/repositories/ComposerAdvisoryMirrorTask.java b/src/main/java/org/dependencytrack/tasks/repositories/ComposerAdvisoryMirrorTask.java
@@ -197,6 +197,7 @@ boolean updateDatasource(final JSONObject jsonAdvisories, boolean syncAliases) {
                 List<VulnerableSoftware> vsList = mapVulnerabilityToVulnerableSoftware(qm, advisory);
                 qm.persist(vsList);
                 final Vulnerability finalSynchronizedVulnerability = synchronizedVulnerability;
+                //TODO VS make sure only DRUPAL or COMPOSER is used as attribution source
                 vsList.forEach(vs -> qm.updateAffectedVersionAttribution(finalSynchronizedVulnerability, vs,
                         vulnerabilitySource));
                 vsList = qm.reconcileVulnerableSoftware(synchronizedVulnerability, vsListOld, vsList,