DependencyTrack / DependencyTrack/dependency-track
Put `/v1/bom` overwrite fields like `classifier` in an existing Project
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
In DependencyTrack version 4.12.x and above, after initially creating a project and then updating it with an SBOM, the Project `classifier` set to `APPLICATION` in this case gets overwritten to `CONTAINER`. I’m wondering if this behavior is expected and possibly an undocumented change, as earlier versions of DependencyTrack didn’t overwrite the classifier in this way.
I also tried excluding the SBOM upload request and instead used the bomRef in the project creation step, but this didn’t produce/upload sbom with the same behavior as `v1/bom`.
Additionally, the SBOM processing neither completes successfully nor returns an error when `bomRef` is set.
### Steps to Reproduce
1. Create a project using PUT v1/project with tags.
2. Upload the SBOM using v1/bom with autocreate set to false.
The returned project resource shows that the classifier has changed from APPLICATION to CONTAINER.
### Expected Behavior
Expected the project resource to remain in the same state as before the SBOM upload to the existing project.
### Dependency-Track Version
4.12.1
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
15
### Browser
Google Chrome
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.