Dependency Track ignores dependsOn tag in CycloneDX format

Current Behavior: Security Vulnerabilities do not include the dependsOn tag of the CycloneDX file. For example, suppose that we have the following reference and dependsOn field, where component-a has no security vulnerability but b and c have vulnerabilities:

{
      "ref" : "pkg:maven/component/component-a@0.0.1?type=jar",
      "dependsOn" : [
        "pkg:maven/component/component-b@0.0.1?type=jar",
        "pkg:maven/component/component-c@0.0.1?type=jar"
      ]
},

Dependency Track will not show these relationships to component-a in the vulnerabilities tab. You will only see the component-b/c with a vulnerability risk and component-a will not yield any information that it depends on this software module with the given vulnerability.

Proposed Behavior: Given the above CycloneDX file and scenario, Dependency Track should log the vulneribility inside component-a too or reference the vulnerability of component-b/c in component-a.

[stevespringett]

Another possibility is to include a new dependency graph view (a few visual representations are planned) which shows the exploded dependency tree and highlights the nodes that are vulnerable. Snyk has a similar view which is very useful.

[jimklimov]

Didn’t know this was already indirectly mentioned in your issue.

Just another point of view at indirect dependencies 😃