After updating to fixed version component still show vulnerabilities

[zivilev18]

In my project was vulnerable components, we updated it to fix version but vulnerabilities does not disappear. I tried refresh buttons for update and it shows that it's updated now but vulnerabilities is still showing. What can cause such problem ?

[stevespringett]

When you say you 'updated it to fix version', did you publish a new CycloneDX SBOM to DT and wait for the analysis?

Refresh buttons only refresh metrics. Not SBOM analysis.

If you uploaded a new SBOM with a fixed version, can you provide the PURL or CPE to the component in question?