Skip to content

Backport: v4-migrator: Dedup PROJECT_PROPERTY rows of collapsed projects - #7360

Merged
nscuro merged 1 commit into
DependencyTrack:5.1.xfrom
nscuro:backport-pr-7171
Sep 20, 2026
Merged

nscuro merged 1 commit into
DependencyTrack:5.1.xfrom
nscuro:backport-pr-7171

Conversation

@nscuro

@nscuro nscuro commented Sep 20, 2026

Copy link
Copy Markdown
Member

Description

v4-migrator: Dedup PROJECT_PROPERTY rows of collapsed projects.

Addressed Issue

Fixes #7114
Backports #7171

Additional Details

N/A

Checklist

  • I have read and understand the contributing guidelines
  • This PR fixes a defect, and I have provided tests to verify that the fix is effective
  • This PR implements an enhancement, and I have provided tests to verify that it works as intended
  • This PR introduces changes to the database model, and I have updated the migration changelog accordingly
  • This PR introduces new or alters existing behavior, and I have updated the documentation accordingly
  • This PR is a substantial change (per the ADR criteria), and I have added an ADR under docs/adr/

…dencyTrack#7171)

* Dedup PROJECT_PROPERTY rows of collapsed projects in v4-migrator

The §4.8 PROJECT collapse rewrites PROJECT_ID through
project_canonical_id_map, so two projects that were distinct in v4 can end
up sharing a canonical PROJECT_ID. Two PROJECT_PROPERTY rows that were
distinct in v4 by virtue of their PROJECT_ID then become the same
(PROJECT_ID, GROUPNAME, PROPERTYNAME) triple, and the load fails with:

  duplicate key value violates unique constraint "PROJECT_PROPERTY_KEYS_IDX"

Other tables affected by a collapse already handle this: MAPPEDLDAPGROUP
uses DISTINCT ON to keep MIN(ID) after the team collapse, and the
PROJECT-keyed join tables rely on ON CONFLICT DO NOTHING. PROJECT_PROPERTY
was missed.

Apply the same DISTINCT ON treatment, keeping MIN(ID) to match the
canonical-ID convention and to keep reruns deterministic.

Fixes DependencyTrack#7114

Signed-off-by: Arjav <arjavdongaonkar@gmail.com>

* Keep the surviving project's own property value on collapse

The PROJECT collapse keeps the newest project, so preferring MIN(ID) here
handed the survivor a property value belonging to a project the migrator had
just decided to discard. The test asserted that wrong outcome too.

Prefer the row that belonged to the surviving project. Where only discarded
projects carried the property, the lowest ID still wins, to keep reruns
deterministic.

Fold the case into PropertyTablesIT, which already covers PROJECT_PROPERTY,
and add a RowCountNotes entry so the differing row count has an explanation.

Signed-off-by: Arjav <arjavdongaonkar@gmail.com>

---------

Signed-off-by: Arjav <arjavdongaonkar@gmail.com>
(cherry picked from commit a1f50b2)
Signed-off-by: nscuro <nscuro@protonmail.com>
@nscuro nscuro added this to the 5.1.1 milestone Sep 20, 2026
@nscuro nscuro added the defect Something isn't working label Sep 20, 2026
@owasp-dt-bot

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@codacy-production

codacy-production Bot commented Sep 20, 2026 •

Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric Results
Complexity 0

View in Codacy

🟢 Coverage ∅ diff coverage

Metric Results
Coverage variation Report missing for c44d5141
Diff coverage ✅ ∅ diff coverage (70.00%)

View coverage diff in Codacy

Coverage variation details
Coverable lines Covered lines Coverage
Common ancestor commit (c44d514) Report Missing Report Missing Report Missing
Head commit (26174ab) 44339 38704 87.29%

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details
Coverable lines Covered lines Diff coverage
Pull request (#7360) 0 0 ∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

1 Codacy didn't receive coverage data for the commit, or there was an error processing the received data. Check your integration for errors and validate that your coverage setup is correct.

NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.

@nscuro
nscuro merged commit 7aa5787 into DependencyTrack:5.1.x Sep 20, 2026
21 checks passed
@nscuro
nscuro deleted the backport-pr-7171 branch September 20, 2026 14:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

defect Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants