DependencyTrack / DependencyTrack/dependency-track
Problems with analyzing dotnet projects
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Dependency track seems to have a problem with analyzing dotnet projects. Here I have made 2 example projects by uploading their CycloneDX SBOMs.
The 1st one probably contains a component with an empty name entry in it's SBOM (which is a known and reported issue - https://github.com/DependencyTrack/dependency-track/issues/2821)
The 2nd one has the components and their versions enumerated, but shows no vulnerabilities in any of them (a bit too suspicious?)
Also when viewing the suggested updated version icon, the version is not making sense in relation to the listed one from the SBOM (i.e. 4.3.2 is higher version than 7.0.1023.36312)
### Steps to Reproduce
1. Upload an SBOM from a dotnet project that has named components, but no vulnerabilities (example attached)
[example.cdx.json.txt](https://github.com/DependencyTrack/dependency-track/files/12649969/example.cdx.json.txt)
### Expected Behavior
Would expect DT to list versions/suggested versions correctly and also to match them to known vulnerabilities
### Dependency-Track Version
4.8.2
### Dependency-Track Distribution
Container Image
### Database Server
N/A
### Database Server Version
_No response_
### Browser
Mozilla Firefox
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.