sbom merged with cyclonedx-cli does not get imported

Current Behavior:

After merging several bom.xml into a sbom.xml with cyclonedx-cli, Dependency Track seems to not process it. I get no errors when uploading it and nothing really happens. If instead I upload separately the bom.xml that I merged they get processed.

Steps to Reproduce:

Merge the bom.xml files into one: docker run -v /home/all_bom_files:/tmp cyclonedx/cyclonedx-cli merge --input-format xml --input-files /tmp/bom_1.xml /tmp/bom_2.xml --output-file /tmp/bom_merged.xml

Upload the file into Dependecy Track project.

Expected Behavior:

Components and dependecies to be recognized.

Environment:

• Dependency-Track Version: v4.3.6
• Distribution: Docker
• BOM Format & Version: XML format, CycloneDX Maven plugin v2.5.3
• Database Server: PostgreSQL
• Browser: Firefox

Additional Details:

None

[lazyw0lf]

I did the validation/analyze with CycloneDX CLI and this is the result: # docker run -v /home/all_bom_files:/tmp cyclonedx/cyclonedx-cli analyze --input-file /tmp/bom_merged.xml Analysis results: BOM Version: 1

# docker run -v /home/all_bom_files:/tmp cyclonedx/cyclonedx-cli validate --input-file /tmp/bom_merged.xml Validating XML BOM… BOM validated successfully.

I will try checking the logs or if nothing shows up I will try to set up a dev env for testing.

Thanks

[nil4]

You may be running into https://github.com/DependencyTrack/dependency-track/issues/1214, due to recent cyclonedx-cli versions writing merged output with a UTF-8 BOM (byte-order-mark), which DT v4.3.6 rejects as invalid on upload.

Due to this mismatch, validating the file with cyclonedx-cli may not flag the issue, but the upload will not be accepted.