SBOM Upload Ignores projectVersion Parameter – Empty in Project and Null in Logs

[Bomteyer]

Current Behavior

When uploading an SBOM to Dependency-Track using either curl or the Swagger UI, the projectVersion parameter is ignored. The SBOM is accepted and processed successfully, but the resulting project version is empty in the UI and projectVersion=null in the logs, despite the parameter being explicitly set in the request and the request being successful.

Steps to Reproduce

1. Use curl to upload an SBOM:

curl -X POST "https://<your-dependency-track-url>/api/v1/bom" \
     -H "X-Api-Key: <your-api-key>" \
     -F "bom=@sbom.json" \
     -F "project=projectID" \
     -F "projectVersion=foo"

2. Confirm that the upload is successful (HTTP 200 OK)
3. Open the Dependencytrack UI, go to your project -> View Details or query the project via the API
4. Observe that the SBOM was uploaded successfully, but the projects version is empty. Also the INFO [BomUploadProcessingTask] log shows projectVersion=null.
5. Repeat the test using the Swagger UI for https://[your-dependencytrack-url]/api/openapi.json, using the /v1/bom POST endpoint with the same parameters.
6. Observe that the same behavior occurs. Upload is successful, but the projects version is still empty.

Expected Behavior

When the projectVersion parameter is provided as part of the SBOM upload (via either curl or Swagger UI), Dependency-Track should:

1. Correctly associate the specified version with the created project.
2. Reflect the projectVersion in the UI and API responses.
3. Log the correct version value during processing.

Let me know if additional details, logs, or test data would be helpful.

Dependency-Track Version

4.13.2

Dependency-Track Distribution

Container Image

Database Server

Microsoft SQL Server

Database Server Version

15.00.4435

Browser

Microsoft Edge

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[jakub-bochenski]

I believe you can use either project id or name + version

Expects CycloneDX and a valid project UUID. If a UUID is not specified, then the projectName and projectVersion must be specified.