Support Import of CycloneDX 1.5 BOMs

[msymons]

Current Behavior

Dependency-Track v4.8.2 supports the import of BOMs that are CycloneDX 1.4 or below.

CycloneDX 1.5 will be released before the end of June 2023. We will start to see tooling producing 1.5 BOMs shortly thereafter. An attempt to import any such BOM to DT would throw an error,

Proposed Behavior

Dependency-Track must be updated so that CycloneDX v1.5 BOMs can be imported without error.

The implementation of support for new functionality offered by 1,5 (commercial licensing and much more besides) is expected to be covered by other issues. This enhancement is to ensure that existing CycloneDX functionality is preserved... no errors and dependency graphs (etc) still work.

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this enhancement was already requested

[msymons]

Now that the first CycloneDX v1.5 BOMs are being produced (not bad... 24 hours after release of the specification), here is the exception:

ERROR [BomUploadProcessingTask] Error while processing bom
org.cyclonedx.exception.ParseException: Unable to parse BOM from byte array
at org.cyclonedx.parsers.JsonParser.parse(JsonParser.java:70)
at org.dependencytrack.tasks.BomUploadProcessingTask.inform(BomUploadProcessingTask.java:93)
at alpine.event.framework.BaseEventService.lambda$publish$0(BaseEventService.java:101)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.base/java.lang.Thread.run(Unknown Source)
Caused by: com.fasterxml.jackson.databind.exc.MismatchedInputException: Cannot deserialize value of type java.util.ArrayList<org.cyclonedx.model.Tool> from Object value (token JsonToken.START_OBJECT)
at [Source: (byte[])"{"bomFormat":"CycloneDX","specVersion":"1.5","tools":{"components":[{"group":"https://github.com/CycloneDX","name":"cdxgen","version":"9.0.1","purl":"pkg:npm/%40cyclonedx/cdxgen@9.0.1","type":"application","bom-ref":"pkg:npm/%40cyclonedx/cdxgen@9.0.1"}]}, column: 180] (through reference chain: org.cyclonedx.model.Bom["metadata"]->org.cyclonedx.model.Metadata["tools"])
at com.fasterxml.jackson.databind.exc.MismatchedInputException.from(MismatchedInputException.java:59)
at com.fasterxml.jackson.databind.DeserializationContext.reportInputMismatch(DeserializationContext.java:1741)
at com.fasterxml.jackson.databind.DeserializationContext.handleUnexpectedToken(DeserializationContext.java:1515)
at com.fasterxml.jackson.databind.DeserializationContext.handleUnexpectedToken(DeserializationContext.java:1462)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.handleNonArray(CollectionDeserializer.java:392)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize(CollectionDeserializer.java:252)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize(CollectionDeserializer.java:28)
at com.fasterxml.jackson.databind.deser.impl.MethodProperty.deserializeAndSet(MethodProperty.java:129)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize(BeanDeserializer.java:314)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:177)
at com.fasterxml.jackson.databind.deser.impl.MethodProperty.deserializeAndSet(MethodProperty.java:129)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize(BeanDeserializer.java:314)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:177)
at com.fasterxml.jackson.databind.deser.DefaultDeserializationContext.readRootValue(DefaultDeserializationContext.java:323)
at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:4674)
at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:3690)
at org.cyclonedx.parsers.JsonParser.parse(JsonParser.java:68)
... 5 common frames omitted

[nscuro]

Note: We have a dependency on cyclonedx-core-java which was not updated for spec v1.5 yet.

[ChrisMcKee]

For anyone hitting this using cdxgen, 8.6.0 is the last version to use 1.4

[thaarbach]

For anyone hitting this using latest cdxgen
Specify the CycloneDx Version with:
cdxgen -r -o bom.json --spec-version 1.4

[BetOffice]

How do I solve this if I am using the server version, how can I specify the spec-version from the url, is it even possible?

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.