Current Behavior

Summary
CycloneDX provides component scope data ( https://cyclonedx.org/docs/1.6/json/#components_items_scope ), which indicates whether a component is required, optional or excluded. This data can be used to classify development and other optional dependencies, enhancing transparency while allowing them to be segregated from other scopes.

Problem Statement
Currently, Dependency-Track does not utilise scope data from CycloneDX SBOMs. This omission may lead users to generate SBOMs that exclude optional dependencies, potentially creating a false sense of security and reducing overall transparency.

Proposed Behavior

Proposed Solution

MVP Implementation

• Store component scope data from CycloneDX SBOMs.
• Display scope information in the UI to help users make informed decisions.

Future Enhancements

• Integrate scope data into policy enforcement and notifications, allowing users to leverage it for advanced use cases.

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this enhancement was already requested