DependencyTrack / DependencyTrack/dependency-track

SBOM Upload Ignores projectVersion Parameter – Empty in Project and Null in Logs

Open
#5,157 3 comments 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

When uploading an SBOM to Dependency-Track using either curl or the Swagger UI, the projectVersion parameter is ignored. The SBOM is accepted and processed successfully, but the resulting project version is empty in the UI and `projectVersion=null` in the logs, despite the parameter being explicitly set in the request and the request being successful.

### Steps to Reproduce

1. Use `curl` to upload an SBOM:

```bash
curl -X POST "https:///api/v1/bom" \
-H "X-Api-Key: " \
-F "bom=@sbom.json" \
-F "project=projectID" \
-F "projectVersion=foo"
```

2. Confirm that the upload is successful (HTTP 200 OK)
3. Open the Dependencytrack UI, go to your project -> View Details or query the project via the API
4. Observe that the SBOM was uploaded successfully, but the projects version is empty. Also the INFO [BomUploadProcessingTask] log shows projectVersion=null.
5. Repeat the test using the Swagger UI for https://[your-dependencytrack-url]/api/openapi.json, using the /v1/bom POST endpoint with the same parameters.
6. Observe that the same behavior occurs. Upload is successful, but the projects version is still empty.

### Expected Behavior

When the `projectVersion` parameter is provided as part of the SBOM upload (via either curl or Swagger UI), Dependency-Track should:
1. Correctly associate the specified version with the created project.
2. Reflect the projectVersion in the UI and API responses.
3. Log the correct version value during processing.

Let me know if additional details, logs, or test data would be helpful.

### Dependency-Track Version

4.13.2

### Dependency-Track Distribution

Container Image

### Database Server

Microsoft SQL Server

### Database Server Version

15.00.4435

### Browser

Microsoft Edge

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.