DependencyTrack / DependencyTrack/dependency-track
BOM import not refreshing with CycloneDX 1.6
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 9h 4m
- Merged PRs (30d)
- 229
Description
### Current Behavior
We had a really weird behaviour within our pipelines.
We noticed that dependencies weren't refreshing anymore, after investigating we noticed, that SBOMs with Schema version 1.5 and below did refresh properly but not with version 1.6. What worked though was deleting a the project and creating the project again using the the [CI/CD](https://docs.dependencytrack.org/usage/cicd/) API. The project was created, but refreshing still didn't work with the newly created project.
Our workaround was setting the version in the cyclonedx-gomod to 1.5 when creating a SBOM.
### Steps to Reproduce
1. Create a new project using [this command](https://docs.dependencytrack.org/usage/cicd/#alternative-parameters)
2. Change the SBOM
3. Run the command again
4. The last BOM import date does not change, neither the dependcies
### Expected Behavior
When rerunning the command from Step 1 the dependcies should refresh
### Dependency-Track Version
4.11.x
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
_No response_
### Browser
N/A
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Research direction
Start by reproducing the CI/CD API flow described in the issue with CycloneDX 1.5 and 1.6 SBOMs, then compare the import behavior and recorded dates. Done means rerunning the command refreshes the project’s last BOM import date and dependencies for CycloneDX 1.6 as well as earlier versions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, postgresql
- Domain
- backend, databases, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100