Cargo Component Info Not Displaying in Dependency Track

[leec94]

Current Behavior

The Dependency Track features list Cargo (Rust) as a compatible ecosystem: https://github.com/DependencyTrack/dependency-track/?tab=readme-ov-file#features

However, when uploading Cargo components, such as pkg:cargo/rand@0.7.2 through the UI, details such as latest version status is not available to view.

Note

The bug, as found by @nscur0 is located here:

dependency-track/src/main/java/org/dependencytrack/tasks/repositories/IMetaAnalyzer.java

Line 81 in 8cf1ee3

static IMetaAnalyzer build(Component component) {

I'm happy to work on this bug if someone can assign me to this!

Steps to Reproduce

1. Create example Project and add component "rand", version "0.7.2", with PURL pkg:cargo/rand@0.7.2
2. View Component list and see that the latest version status on the right side of "Version" column does not show if the component is up to date.

I'm using the default set up from the quickstart docker compose. Not sure if the database is H2 or PostgreSQL but selecting H2 as a guess.

Expected Behavior

1. Create example Project and add component "rand", version "0.7.2", with PURL pkg:cargo/rand@0.7.2
2. View Component list and see that the latest version status on the right side of "Version" column does show if the component is up to date, and the version and latest version information is available through the API.

Dependency-Track Version

4.9.x

Dependency-Track Distribution

Container Image

Database Server

H2

Database Server Version

No response

Browser

Google Chrome

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.