Only display root of dependency graph in suggestions #332

New issue

Open

opened 2024-11-11 10:06:25 +00:00 by fricklerhandwerk · 0 comments

fricklerhandwerk commented

2024-11-11 10:06:25 +00:00

(Migrated from github.com)

Currently we show all packages that have a name matching, but many of them turn out to be dependants of the actual thing in question.

Note that we probably have to take into account both buildtime and runtime dependencies, and possibly handle them differently.

As a security team member, I want to see matching suggestions only for directly affected packages (and at most the number of reverse dependencies, or maybe a list/tree of them if I really care), in order to keep cognitive load at a minimum. Fixing the root fixes the others. Currently we show all packages that have a name matching, but many of them turn out to be dependants of the actual thing in question. Note that we probably have to take into account both buildtime and runtime dependencies, and possibly handle them differently. ![image](https://github.com/user-attachments/assets/428289b9-ddd3-4e3e-8873-4dab5a91a65b)