License and vulnerability analysis not done Dependency Track

Hi,

When I try to upload bom json or xml output to Dependency Track as given below. Eventhough the components are listed but the license and vulnerability analysis is not performed by Dependency Track.

cdxgen -r -o bom.json --server-url $DT_URL --api-key $DT_KEY

But the same json output license and vulnerability analysis are performed correctly If I upload it to the DT UI or via DT REST API.

The DT logs doesn’t show any errors and the logs are same when I run the above command and If I upload it via UI and REST API. I don’t have a clue why this is happening.

Dependency-Track v4.5.0

Thanks

[ghost]

@prabhu you are right using -t python worked. So it’s a bug. Also while running this command I got node error:

idna TypeError: Cannot read properties of null (reading 'indexOf')
    at getPyMetadata (/usr/local/lib/node_modules/@appthreat/cdxgen/utils.js:1125:31)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Object.parsePiplockData (/usr/local/lib/node_modules/@appthreat/cdxgen/utils.js:1217:10)
    at async createPythonBom (/usr/local/lib/node_modules/@appthreat/cdxgen/index.js:1384:19)
    at async exports.createBom (/usr/local/lib/node_modules/@appthreat/cdxgen/index.js:2703:14)
    at async /usr/local/lib/node_modules/@appthreat/cdxgen/bin/cdxgen:100:22

[giulio1979]

as far as I see the cdxgen console output has license information;

{ “group”: “”, “name”: “react-i18next”, “version”: “11.18.5”, “description”: “Internationalization for react done right. Using the i18next i18n ecosystem.”, “scope”: “required”, “hashes”: [ { “alg”: “SHA-512”, “content”: “70a732baecc8bf461467897d58e45f95536e84848f02a41284e02cc7017262e268080ec794b9879bb5e7bceea17c01a61a90cd461247a015fc846e3d09bdb165” } ], “licenses”: [ { “license”: { “id”: “MIT”, “url”: “https://opensource.org/licenses/MIT” } } ], “purl”: “pkg:npm/react-i18next@11.18.5”, “externalReferences”: [ { “type”: “website”, “url”: “https://github.com/i18next/react-i18next” }, { “type”: “vcs”, “url”: “git+https://github.com/i18next/react-i18next.git” } ], “type”: “library”, “bom-ref”: “pkg:npm/react-i18next@11.18.5” },

but nothing reaches dependency-track. the file doesnt contain any license information when i add -o bom.xml.

I tried capturing the whole console output and uploading to dependency-track, it got processed without issues