Active / Non-Active Projects

[nvima]

Hello dear community,

We have been using Dependency Track for a while now.
Unfortunately, the number of projects is increasing a lot because we store MR commits and tags.

I would like to tidy up our DT backend a bit and have stumbled across the "active" attribute.

My question would be, what exactly does setting projects to inactive do?
I could read in MR that projects disappear from the statistics.
Also, should certain tasks no longer be executed?
Does this mean that inactive projects are no longer analyzed?
Could you create projects with "inactive" and run them manually?

Are there other people who have several versions of their projects in Dependency Track? I would be interested to know how you handle this.

[sebstr1]

I also wonder what this means. I cant find documentation on what it means for a project to be "inactive" Have you reached any clarity in this?

[nvima]

As far as I understand, inactive projects are not regularly scanned for vulnerabilities.
However, you can still start a scan manually.
We set all our dirty tags to inactive and start a one-time scan in the pipeline during development.
We have set our clean tags to active so that we are notified if production has a vulnerability.

Inactive projects do not appear in the statistics either, which helps to keep the overall risk score low.