Finding Attributed On date is not retained when cloning projects

[nscuro]

Current Behavior

When cloning a project, including its findings, the Attributed On date for cloned findings is set to the date of the clone operation.

dependency-track/src/main/java/org/dependencytrack/persistence/ProjectQueryManager.java

Lines 649 to 652 in 8f9a18f

	for (Vulnerability vuln: sourceComponent.getVulnerabilities()) {
	final FindingAttribution sourceAttribution = this.getFindingAttribution(vuln, sourceComponent);
	this.addVulnerability(vuln, clonedComponent, sourceAttribution.getAnalyzerIdentity(), sourceAttribution.getAlternateIdentifier(), sourceAttribution.getReferenceUrl());
	}

Steps to Reproduce

1. Create project
2. Upload BOM with vulnerable components
3. Wait for vulnerabilities to be reported
4. Clone project, including findings
5. Observe a modified Attributed On date for findings in the cloned project

Expected Behavior

Retain the original Attributed On date when cloning findings.

Dependency-Track Version

4.10.1

Dependency-Track Distribution

Container Image, Executable WAR

Database Server

N/A

Database Server Version

No response

Browser

N/A

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.