Depenency Track Parser doesn't set unique_id_from_tool

[AndreVirtimo]

Findings from Dependency Track import will be recreated (old is closed, new one is created) when new vulnerability_ids are added by DT. This can not be fixed by setting deduplication algorithm to DEDUPE_ALGO_UNIQUE_ID_FROM_TOOL_OR_HASH_CODE because the parser sets the DT uuid to vuln_id_from_tool. But it has to be unique_id_from_tool.

See also discussion on Slack https://defectdojocommunity.slack.com/archives/C0A4DBKANDS/p1771402183329359

Steps to reproduce
Steps to reproduce the behavior:

1. Import Dependency Track finding with only a CVE vuln id
2. Reimport the same finding with an additional alias with a GHSA id

Expected behavior
The existing finding should get an update and stay open.

Deployment method (select with an X)

• Docker Compose
• Kubernetes
• GoDojo

Environment information

• DefectDojo version v. 2.55.1

Screenshots

E-Mail:

New and old finding: