DependencyTrack / DependencyTrack/dependency-track

Risk Outdated component shows a current version that seems misleading

Open
#2,398 2 comments 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Cdxgen version 6.0.12 used to create a SBOM against that was ingested to Dependency Track v4.7.0

The component jQuery has version 3.2.1 but it is highlighted as risk: outdated component, latest version shows 1.7.4
Screenshot below
image

Snippet of the sbom
"components": [
{
"publisher": "",
"group": "",
"name": "jQuery",
"version": "3.2.1",
"description": "jQuery: The Write Less, Do More, JavaScript Library (packaged for Node.JS)",
"licenses": [],
"purl": "pkg:npm/jQuery@3.2.1",
"externalReferences": [
{
"type": "website",
"url": "https://github.com/coolaj86/node-jquery"
},
{
"type": "vcs",
"url": "git://github.com/coolaj86/node-jquery.git"
}
],
"type": "library",
"bom-ref": "pkg:npm/jQuery@3.2.1",
"properties": [
{
"name": "SrcFile",
"value": "/var/jenkins_home/workspace/cdxgen-sbom-repo/shiftleft-java-demo/src/main/resources/static/jquery.min.js"
}
]
},

### Steps to Reproduce

1. Clone repo https://github.com/ShiftLeftSecurity/shiftleft-java-demo
2. Generate a CycloneDX SBOM using cdxgen v6.0.12
3. Ingest the SBOM to Dependency Track v4.7.0

### Expected Behavior

The Risk Outdated component shown for the current version vis-a-vis latest version should not be misleading

### Dependency-Track Version

4.7.0

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

13.2-alpine

### Browser

Google Chrome

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.