DependencyTrack / DependencyTrack/dependency-track

BOM import not refreshing with CycloneDX 1.6

Open
#4,363 2 comments 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
9h 4m
Merged PRs (30d)
229

Description

### Current Behavior

We had a really weird behaviour within our pipelines.
We noticed that dependencies weren't refreshing anymore, after investigating we noticed, that SBOMs with Schema version 1.5 and below did refresh properly but not with version 1.6. What worked though was deleting a the project and creating the project again using the the [CI/CD](https://docs.dependencytrack.org/usage/cicd/) API. The project was created, but refreshing still didn't work with the newly created project.

Our workaround was setting the version in the cyclonedx-gomod to 1.5 when creating a SBOM.

### Steps to Reproduce

1. Create a new project using [this command](https://docs.dependencytrack.org/usage/cicd/#alternative-parameters)
2. Change the SBOM
3. Run the command again
4. The last BOM import date does not change, neither the dependcies

### Expected Behavior

When rerunning the command from Step 1 the dependcies should refresh

### Dependency-Track Version

4.11.x

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

N/A

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the CI/CD API flow described in the issue with CycloneDX 1.5 and 1.6 SBOMs, then compare the import behavior and recorded dates. Done means rerunning the command refreshes the project’s last BOM import date and dependencies for CycloneDX 1.6 as well as earlier versions.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, postgresql
Domain
backend, databases, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.