Components in the SBOM under 'metadata.component.components' are not imported

[malice00]

Current Behavior

I generate an SBOM from a multi-module Gradle project, using cdxgen. When I import this, my modules are not imported as components and therefore the dependency tree doesn't work.

This is most likely because cdxgen puts the sub-projects under 'metadata.component.components' instead of directly under 'components'. (See the specs for 1.4)

Steps to Reproduce

1. Generate an SBOM for a Gradle project with cdxgen
2. Import the SBOM

Expected Behavior

I expect my modules to be added just as any other components and the dependency tree to be available.

Dependency-Track Version

4.8.2

Dependency-Track Distribution

Container Image

Database Server

N/A

Database Server Version

No response

Browser

Mozilla Firefox

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

[nscuro]

This was closed by accident when implementing it in Hyades. Implementation for DT 4.x is still pending though.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.