VEX export confusion. Inventory-with-Vulnerabilities vs. just VEX exports have different 'affects' entries?

[schlenk]

Hello,

i am a little confused by the VEX export of DependencyTrack.

There are two options to get some VEX data from DependencyTrack:

1. Go to the Components tab of a project, click Download SBOM and select 'Inventory with Vulnerabilities' in the dropdown.
2. Go to the Vulnerabilities tab of a project, click Download VEX and select 'Export VEX'.

When i choose the variant 1, i get the VEX embedded in the SBOM and the bom-ref used in the 'affects' Block of the Vulnerability points to the Component bom-ref of the vulnerable sub component in the SBOM.

But when i choose the variant 2, pure VEX, the 'affects' block of the vulnerability no longer contains the affected sub component, but references the top level SBOM component element instead.

I would have expected the variant 2, to behave like variant 1 and return a VEX file similar to the example here: https://github.com/CycloneDX/bom-examples/tree/master/VEX , referencing the sub component.

Is this a bug in dependency track or something that can be configured in the API call (via /v1/vex/cyclonedx/project/{uuid} ) to retrieve a VEX?