DependencyTrack / DependencyTrack/frontend

BOM download should let users choose a CycloneDX spec version

Open
#1,473 1 comment 0 reactions 0 assignees View on GitHub
defect p2 size/S
Dominant language
Vue
Stars
171
Forks
250
Avg merge
10h 56m
Merged PRs (30d)
84

Description

### Current Behavior

Downloading the BOM from a project created with a v1.6 format BOM is creating a v1.5 format BOM.

### Steps to Reproduce

1. Create a project
2. Generate a v1.6 BOM with @cyclonedx/cyclonedx-npm or dotnet-cyclonedx
3. Upload the BOM
4. Download the BOM

### Expected Behavior

I expect either...

* the latest BOM format to be supported
* the same BOM format that was uploaded (successfully) to be downloaded
* or to have a choice of which BOM format to download

### Dependency-Track Version

4.14.0

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Microsoft Edge

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

No contributing guide indexed for this repository

Research direction

The issue names no files or tests; start by tracing the frontend BOM download flow and its API request. Check how the uploaded CycloneDX version is represented, then verify that users can download the uploaded version or choose a supported version, with the resulting BOM matching that selection.

Written by the indexing model from the issue text.

Assessment

Domain
frontend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.