DependencyTrack / DependencyTrack/frontend
BOM download should let users choose a CycloneDX spec version
- Dominant language
- Vue
- Stars
- 171
- Forks
- 250
- Avg merge
- 10h 56m
- Merged PRs (30d)
- 84
Description
### Current Behavior
Downloading the BOM from a project created with a v1.6 format BOM is creating a v1.5 format BOM.
### Steps to Reproduce
1. Create a project
2. Generate a v1.6 BOM with @cyclonedx/cyclonedx-npm or dotnet-cyclonedx
3. Upload the BOM
4. Download the BOM
### Expected Behavior
I expect either...
* the latest BOM format to be supported
* the same BOM format that was uploaded (successfully) to be downloaded
* or to have a choice of which BOM format to download
### Dependency-Track Version
4.14.0
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
_No response_
### Browser
Microsoft Edge
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
No contributing guide indexed for this repository
Research direction
The issue names no files or tests; start by tracing the frontend BOM download flow and its API request. Check how the uploaded CycloneDX version is represented, then verify that users can download the uploaded version or choose a supported version, with the resulting BOM matching that selection.
Written by the indexing model from the issue text.
Assessment
- Domain
- frontend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100