DependencyTrack / DependencyTrack/dependency-track
Risk Outdated component shows a current version that seems misleading
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Cdxgen version 6.0.12 used to create a SBOM against that was ingested to Dependency Track v4.7.0
The component jQuery has version 3.2.1 but it is highlighted as risk: outdated component, latest version shows 1.7.4
Screenshot below

Snippet of the sbom
"components": [
{
"publisher": "",
"group": "",
"name": "jQuery",
"version": "3.2.1",
"description": "jQuery: The Write Less, Do More, JavaScript Library (packaged for Node.JS)",
"licenses": [],
"purl": "pkg:npm/jQuery@3.2.1",
"externalReferences": [
{
"type": "website",
"url": "https://github.com/coolaj86/node-jquery"
},
{
"type": "vcs",
"url": "git://github.com/coolaj86/node-jquery.git"
}
],
"type": "library",
"bom-ref": "pkg:npm/jQuery@3.2.1",
"properties": [
{
"name": "SrcFile",
"value": "/var/jenkins_home/workspace/cdxgen-sbom-repo/shiftleft-java-demo/src/main/resources/static/jquery.min.js"
}
]
},
### Steps to Reproduce
1. Clone repo https://github.com/ShiftLeftSecurity/shiftleft-java-demo
2. Generate a CycloneDX SBOM using cdxgen v6.0.12
3. Ingest the SBOM to Dependency Track v4.7.0
### Expected Behavior
The Risk Outdated component shown for the current version vis-a-vis latest version should not be misleading
### Dependency-Track Version
4.7.0
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
13.2-alpine
### Browser
Google Chrome
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.