When using -t dotnet componet set to latest instead of same version causing there to be no reference to the root when trying to render trees

[WesHaze]

Is it possible at all to change the version of the component to also use the version in the csproj instead of defaulting to latest? Or is this simply not yet implemented?

[prabhu]

Could you kindly share the csproj file or a sample repo to replicate the issue?

[WesHaze]

https://github.com/WesHaze/dotnet-cdxgen-v-mismatch

There you go, the version in the afforementioned apiservice project is set to 5.0.0. when running cdxgen . -t dotnet -o ./bom.json on the folder of the project it results in the shown sbom which then causes dependency track to not be able to render the graph. Thanks for your quick reponse by the way prabhu.

[WesHaze]

Hey prabhu, I've never done anything open source related so sorry if this question is nonsensical to you, but what happens now? Will someone review this and possibly make an issue later or does that responsibility fall onto us? This is a significant hurdle for anyone using .net who also wants to use cdxgen with dependency track so I would love some insight here.

[prabhu]

Thank you again for your help with the reproducer project! Your question about open source is a great one.

Open source thrives on the concept of freedom - the freedom to learn, use, modify, share, and innovate to solve problems. It fosters a collaborative community of users, contributors, and enthusiasts, guided by shared practices.

A helpful analogy might be a hostel's shared kitchen. Guests can use it freely, but everyone contributes to its smooth operation. They clean after themselves, maintain common supplies, and some even volunteer for reduced stays. This collaboration helps everyone, including the (often part-time) staff with other commitments. Some hostels offer cooked meals for a fee, catering to those who prefer convenience.

Similarly, well-documented bug reports with reproducers and contributions like pull requests and test cases significantly ease the development and testing burden on maintainers, who are only volunteers. While those with time constraints can explore financial contributions to support continued development and quicker, guaranteed assistance. This ensures funds directly benefit the project and its users.

Hope this helps!