Unable to filter components by outdated versions for components without namespace/group

[sedan07]

Current Behavior

When listing all the components of a given project using the /v1/component/project/{uuid} endpoint you can filter by onlyOutdated to exclude recent components. However this won't show any outdated components which don't have the optional group field set. Java SBOMs will have this set as Java uses namespaces, but Python for instance doesn't. As a result you cannot filter Python projects to see only the outdated components as 0 get returned.

Steps to Reproduce

1. Take for instance a relatively popular Python open source project such as Netbox and generate an SBOM using Trivy:

• trivy image -f cyclonedx -o netbox.cdx.json netboxcommunity/netbox:v4.1
• netbox.cdx.json

2. Upload the SBOM to a new project in Dependency-Track
3. From the components tab enable the "Outdated only" toggle
4. 0 results returned.

Expected Behavior

28 outdated results returned, for items such as click

Dependency-Track Version

4.12.2

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

13

Browser

N/A

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported