DependencyTrack / DependencyTrack/dependency-track
Fail to upload SBOM after 4.12.0 upgrade
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
When uploading an SBOM to one of our projects the SBOM will fail to upload with the below logs. Nothing is reported to the UI.
`2024-10-16 16:36:53,276 [] INFO [org.dependencytrack.tasks.BomUploadProcessingTask] Consuming uploaded BOM [bomSerialNumber=3aee0b40-098c-4c70-bbbb-93bb7d684259, bomFormat=CycloneDX, bomUploadToken=4aeb18b3-f86e-4e85-8bad-e89e6973e32a, projectName=Testing, bomSpecVersion=1.4, projectUuid=0c114618-e0c8-4bec-81c3-e66088bfabcb, projectVersion=null, bomVersion=1]
2024-10-16 16:36:53,302 [] INFO [org.dependencytrack.tasks.BomUploadProcessingTask] Consumed 2137 components (2137 before de-duplication), 0 services (0 before de-duplication), and 385 dependency graph entries [bomSerialNumber=3aee0b40-098c-4c70-bbbb-93bb7d684259, bomFormat=CycloneDX, bomUploadToken=4aeb18b3-f86e-4e85-8bad-e89e6973e32a, projectName=Testing, bomSpecVersion=1.4, projectUuid=0c114618-e0c8-4bec-81c3-e66088bfabcb, projectVersion=null, bomVersion=1]
2024-10-16 16:36:53,308 [] INFO [org.dependencytrack.tasks.BomUploadProcessingTask] Processing 2137 components [bomSerialNumber=3aee0b40-098c-4c70-bbbb-93bb7d684259, bomFormat=CycloneDX, bomUploadToken=4aeb18b3-f86e-4e85-8bad-e89e6973e32a, projectName=Testing, bomSpecVersion=1.4, projectUuid=0c114618-e0c8-4bec-81c3-e66088bfabcb, projectVersion=null, bomVersion=1]
2024-10-16 16:36:54,876 [] ERROR [org.dependencytrack.tasks.BomUploadProcessingTask] Failed to process BOM [bomUploadToken=4aeb18b3-f86e-4e85-8bad-e89e6973e32a, projectName=Testing, projectUuid=0c114618-e0c8-4bec-81c3-e66088bfabcb, projectVersion=null]
javax.jdo.JDOUserException: Cannot read fields from a deleted object
at org.datanucleus.api.jdo.state.PersistentDeleted.transitionReadField(PersistentDeleted.java:91)
at org.datanucleus.state.StateManagerImpl.transitionReadField(StateManagerImpl.java:1114)
at org.datanucleus.state.StateManagerImpl.isLoaded(StateManagerImpl.java:4139)
at org.dependencytrack.model.ComponentProperty.dnGetgroupName(ComponentProperty.java)
at org.dependencytrack.model.ComponentProperty.getGroupName(ComponentProperty.java:134)
at org.dependencytrack.model.ComponentProperty$Identity.(ComponentProperty.java:55)
at org.dependencytrack.persistence.ComponentQueryManager.lambda$synchronizeComponentProperties$1(ComponentQueryManager.java:875)
at java.base/java.util.stream.ReferencePipeline$2$1.accept(Unknown Source)
at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(Unknown Source)
at java.base/java.util.stream.AbstractPipeline.copyInto(Unknown Source)
at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(Unknown Source)
at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(Unknown Source)
at java.base/java.util.stream.AbstractPipeline.evaluate(Unknown Source)
at java.base/java.util.stream.ReferencePipeline.collect(Unknown Source)
at org.dependencytrack.persistence.ComponentQueryManager.synchronizeComponentProperties(ComponentQueryManager.java:883)
at org.dependencytrack.persistence.QueryManager.synchronizeComponentProperties(QueryManager.java:633)
at org.dependencytrack.tasks.BomUploadProcessingTask.processComponents(BomUploadProcessingTask.java:440)
at org.dependencytrack.tasks.BomUploadProcessingTask.lambda$processBom$0(BomUploadProcessingTask.java:282)
at alpine.persistence.AbstractAlpineQueryManager.lambda$runInTransaction$6(AbstractAlpineQueryManager.java:564)
at alpine.persistence.Transaction.call(Transaction.java:139)
at alpine.persistence.AbstractAlpineQueryManager.callInTransaction(AbstractAlpineQueryManager.java:542)
at alpine.persistence.AbstractAlpineQueryManager.runInTransaction(AbstractAlpineQueryManager.java:563)
at alpine.persistence.AbstractAlpineQueryManager.runInTransaction(AbstractAlpineQueryManager.java:575)
at org.dependencytrack.tasks.BomUploadProcessingTask.processBom(BomUploadProcessingTask.java:277)
at org.dependencytrack.tasks.BomUploadProcessingTask.processEvent(BomUploadProcessingTask.java:176)
at org.dependencytrack.tasks.BomUploadProcessingTask.inform(BomUploadProcessingTask.java:151)
at alpine.event.framework.BaseEventService.lambda$publish$0(BaseEventService.java:110)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.base/java.lang.Thread.run(Unknown Source)`
### Steps to Reproduce
1. Create new project
2. Upload SBOM
3. Upload newer version of SBOM (with minimal changes, just internal component version updates)
4. Notice that the SBOM fails to upload in logs
### Expected Behavior
The SBOM gets uploaded without errors.
### Dependency-Track Version
4.12.0
### Dependency-Track Distribution
Container Image
### Database Server
Microsoft SQL Server
### Database Server Version
_No response_
### Browser
Google Chrome
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.