Where does information from "metadata.component" end up?

[ja-he]

I'm not sure I get exactly how Dependency-Track expects BOMs to look, but I found it strange that if I have a project and then upload a BOM with "metadata":{"component":{"name":"MyCoolName","version":"1.2.3","purl":"pkg:example/mycoolthing@1.2.3",...} none of that information seems to go anywhere.
I would expect, for instance, the PURL field to be updated. I could see that Dependency-Track has its own conception¹ of how projects and versions should be used and would prefer not to blindly incorporate a version (although that was the behaviour I initially expected), but I would think it should have value.

To be clear, I tried this out via the web-ui and via the API (with PUT /api/v1/bom where you pass a base64-encoded BOM²) and found that none of the information from "metadata.component" gets used.
However, it is not that it is completely irrelevant or disregarded by Dependency-Track, because it does make a difference for the dependency-tree whether I have a root component as "metadata.component" which depends on the other components.

I wanted to refrain from posting an issue for now, because I am not sure whether there is something about Dependency-Track that I am not quite grokking here, but I think I am leaning towards requesting a feature that allows incorporating this information like I have described, e.g. via a modal in the web-ui or via an extra JSON key like "update-project-metadata":true in the JSON payload?

Any and all thoughts on this appreciated.

Footnotes

1. https://github.com/DependencyTrack/dependency-track/issues/695 ↩

2. Mostly to have it documented (it's not very relevant for this discussion entry) what I did with the API was basically this:

   curl -X 'PUT' "${URL}/api/v1/project" \
     -H 'accept: application/json' \
     -H 'content-type: application/json' \
     -H 'X-Api-Key: 🙈' \
     --data '{"name":"A","author":"me","description":"a thing","version":"v0.1.0","classifier":"DEVICE","externalReferences":[]}'
   

   curl -X 'PUT' "${URL}/api/v1/bom' \
     -H 'accept: application/json' \
     -H 'X-Api-Key: 🙈' \
     -H 'content-type: application/json' \
     --data '{"project":"dce668b4-2b56-48a9-aa3d-e260f47de189","bom":"ewogICJib21Gb3JtYXQiOiAiQ3ljbG9uZURYIiwKICAic3BlY1ZlcnNpb24iOiAiMS40IiwKICAidmVyc2lvbiI6IDEsCiAgIm1ldGFkYXRhIjogewogICAgImNvbXBvbmVudCI6IHsKICAgICAgInR5cGUiOiAibGlicmFyeSIsCiAgICAgICJib20tcmVmIjogIm1haW4tY29tcG9uZW50IiwKICAgICAgIm5hbWUiOiAiTWFpbiBDb21wb25lbnQiLAogICAgICAidmVyc2lvbiI6ICIxLjAuMCIsCiAgICAgICJwdXJsIjogInBrZzpleGFtcGxlL21haW4tY29tcG9uZW50QDEuMC4wIiwKICAgICAgImRlc2NyaXB0aW9uIjogIlRoaXMgaXMgdGhlIG1haW4gY29tcG9uZW50LiIKICAgIH0KICB9LAogICJjb21wb25lbnRzIjogWwogICAgewogICAgICAidHlwZSI6ICJsaWJyYXJ5IiwKICAgICAgImJvbS1yZWYiOiAic3ViLWNvbXBvbmVudCIsCiAgICAgICJuYW1lIjogIlN1YiBDb21wb25lbnQiLAogICAgICAidmVyc2lvbiI6ICIxLjAuMCIsCiAgICAgICJwdXJsIjogInBrZzpleGFtcGxlL3N1Yi1jb21wb25lbnRAMS4wLjAiLAogICAgICAiZGVzY3JpcHRpb24iOiAiVGhpcyBpcyBhIHN1YmNvbXBvbmVudCBvZiB0aGUgbWFpbiBjb21wb25lbnQuIgogICAgfQogIF0sCiAgImRlcGVuZGVuY2llcyI6IFsKICAgIHsKICAgICAgInJlZiI6ICJtYWluLWNvbXBvbmVudCIsCiAgICAgICJkZXBlbmRzT24iOiBbCiAgICAgICAgInN1Yi1jb21wb25lbnQiCiAgICAgIF0KICAgIH0KICBdCn0K"}'
   

   ↩