DependencyTrack / dependency-track

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.
https://dependencytrack.org/
Apache License 2.0
2.71k stars 580 forks source link

BOM import not refreshing with CycloneDX 1.6 #4363

Open DerArkeN opened 2 weeks ago

DerArkeN commented 2 weeks ago

Current Behavior

We had a really weird behaviour within our pipelines. We noticed that dependencies weren't refreshing anymore, after investigating we noticed, that SBOMs with Schema version 1.5 and below did refresh properly but not with version 1.6. What worked though was deleting a the project and creating the project again using the the CI/CD API. The project was created, but refreshing still didn't work with the newly created project.

Our workaround was setting the version in the cyclonedx-gomod to 1.5 when creating a SBOM.

Steps to Reproduce

  1. Create a new project using this command
  2. Change the SBOM
  3. Run the command again
  4. The last BOM import date does not change, neither the dependcies

Expected Behavior

When rerunning the command from Step 1 the dependcies should refresh

Dependency-Track Version

4.11.x

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

No response

Browser

N/A

Checklist