VDR erronously include full SBOM inventory

[stevespringett]

Current Behavior

When exporting a VDR, the entire inventory is exported whether the components are affected by vulnerabilities or not.

Steps to Reproduce

1. Export VDR from the UI

Expected Behavior

The VDR should only contain components that are affected by a vulnerability, not the full inventory.

Dependency-Track Version

4.8.0

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

No response

Browser

Google Chrome

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[nscuro]

@stevespringett I raised #2878 to address this. Problem is that filtering components like this will inevitably break the dependency graph.

Few ideas how to handle that:

1. Don't. Just accept that the graph will have holes.
2. Remove the dependency graph entirely from VDR exports.
3. Attempt to close the gaps by re-wiring broken edges to the next-best candidate (i.e., connect transitive dependency to root node when direct dependency was filtered out); Could become quite expensive for large projects with complex graphs.

In any case, I reckon we could make use of compositions to signal that something is missing. Question is, do we need to "fix" broken graphs?

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.