Skip to content

Introduce package metadata resolution state tracking - #6794

Open
nscuro wants to merge 1 commit into
DependencyTrack:mainfrom
nscuro:pkg-metadata-res-improv
Open

Introduce package metadata resolution state tracking#6794
nscuro wants to merge 1 commit into
DependencyTrack:mainfrom
nscuro:pkg-metadata-res-improv

Conversation

@nscuro

@nscuro nscuro commented Jul 23, 2026

Copy link
Copy Markdown
Member

Description

Introduces package metadata resolution state tracking:

  • Adds a new PACKAGE_METADATA_RESOLUTION table that tracks when a given PURL was last resolved, and with what outcome.
  • Drives the resolution candidate query from the new table instead of the full COMPONENT table, significantly reducing query cost. This also allows permanently skipping resolution for PURLs that are unresolvable, e.g. because they're malformed.
  • Uses a cursor within a single resolve-package-metadata workflow run to avoid having to re-scan the full PACKAGE_METADATA_RESOLUTION table from the beginning for every batch.
  • Enables HOT updates on the PACKAGE_METADATA and PACKAGE_ARTIFACT_METADATA tables by dropping the now-unused indexes on RESOLVED_AT columns.

Addressed Issue

Fixes #6654
Relates to #6771

Additional Details

See the included ADR for more details, and alternative options that were considered.

Checklist

  • I have read and understand the contributing guidelines
  • This PR fixes a defect, and I have provided tests to verify that the fix is effective
  • This PR implements an enhancement, and I have provided tests to verify that it works as intended
  • This PR introduces changes to the database model, and I have updated the migration changelog accordingly
  • This PR introduces new or alters existing behavior, and I have updated the documentation accordingly
  • This PR is a substantial change (per the ADR criteria), and I have added an ADR under docs/adr/

@nscuro nscuro added this to the 5.1 milestone Jul 23, 2026
@nscuro nscuro added the enhancement New feature or request label Jul 23, 2026
@owasp-dt-bot

owasp-dt-bot commented Jul 23, 2026

Copy link
Copy Markdown

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@nscuro

nscuro commented Jul 23, 2026

Copy link
Copy Markdown
Member Author

@sahibamittal FYI. Please have a look when you get the time.

@codacy-production

codacy-production Bot commented Jul 23, 2026

Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 17 complexity

Metric Results
Complexity 17

View in Codacy

🟢 Coverage 98.13% diff coverage · +0.06% coverage variation

Metric Results
Coverage variation +0.06% coverage variation (-1.00%)
Diff coverage 98.13% diff coverage (70.00%)

View coverage diff in Codacy

Coverage variation details
Coverable lines Covered lines Coverage
Common ancestor commit (c910194) 43434 37778 86.98%
Head commit (391371b) 43563 (+129) 37917 (+139) 87.04% (+0.06%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details
Coverable lines Covered lines Diff coverage
Pull request (#6794) 160 157 98.13%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.

* Adds a new `PACKAGE_METADATA_RESOLUTION` table that tracks when a given PURL was last resolved, and with what outcome.
* Drives the resolution candidate query from the new table instead of the full `COMPONENT` table, significantly reducing query cost. This also allows permanently skipping resolution for PURLs that are unresolvable, e.g. because they're malformed.
* Uses a cursor within a single `resolve-package-metadata` workflow run to avoid having to re-scan the full `PACKAGE_METADATA_RESOLUTION` table from the beginning for every batch.
* Enables HOT updates on the `PACKAGE_METADATA` and `PACKAGE_ARTIFACT_METADATA` tables by dropping the now-unused indexes on `RESOLVED_AT` columns.

See the included ADR for more details, and alternative options that were considered.

Co-authored-by: Sahiba Mittal <sahiba.mittal@citi.com>
Signed-off-by: nscuro <nscuro@protonmail.com>
@nscuro
nscuro force-pushed the pkg-metadata-res-improv branch from 5cf84a6 to 391371b Compare July 28, 2026 22:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Missing negative-cache for Malformed PURLs

2 participants