Policy violation audit supress action sometimes not tracked

[schoofseggl]

Current Behavior

When auditing a policy violation I observed, that supress actions are not always tracked.

Steps to Reproduce

Have a new empty violation:

Click "supress" before selecting anything in the dropdown:

(trail stays emtpy)

Click supress again. Now an "unsupressed" action is tracked in the audit trail

Note: the order matters: If you FIRST select anything in the dropdown and THEN click supress, it's tracked.

Expected Behavior

Supress is always tracked in the audit trail

Dependency-Track Version

4.14.0

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

10

Browser

Google Chrome

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[msymons]

@schoofseggl, this might not be related... but note that the minimum supported version of PostgreSQL is >= 12.0 & you are using 10.0.

[stohrendorf]

It's likely missing that message here in case an analysis was never made before:

dependency-track/src/main/java/org/dependencytrack/resources/v1/ViolationAnalysisResource.java

Lines 166 to 170 in ff363a8

	analysis = qm.makeViolationAnalysis(component, violation, request.getAnalysisState(), request.isSuppressed());
	analysisStateChange = true; // this is a new analysis - so set to true because it was previously null
	if (ViolationAnalysisState.NOT_SET != request.getAnalysisState()) {
	qm.makeViolationAnalysisComment(analysis, String.format("%s → %s", ViolationAnalysisState.NOT_SET, request.getAnalysisState()), commenter);
	}