Skip to content

Backport: Resolve project parent before other fields in updateProject - #7367

Merged
nscuro merged 1 commit into
DependencyTrack:5.1.xfrom
nscuro:backport-pr-7262
Sep 20, 2026
Merged

nscuro merged 1 commit into
DependencyTrack:5.1.xfrom
nscuro:backport-pr-7262

Conversation

@nscuro

@nscuro nscuro commented Sep 20, 2026

Copy link
Copy Markdown
Member

Description

Resolves project parent before other fields in updateProject.

Addressed Issue

Fixes #7241
Backports #7262

Additional Details

N/A

Checklist

  • I have read and understand the contributing guidelines
  • This PR fixes a defect, and I have provided tests to verify that the fix is effective
  • This PR implements an enhancement, and I have provided tests to verify that it works as intended
  • This PR introduces changes to the database model, and I have updated the migration changelog accordingly
  • This PR introduces new or alters existing behavior, and I have updated the documentation accordingly
  • This PR is a substantial change (per the ADR criteria), and I have added an ADR under docs/adr/

…cyTrack#7262)

* Resolve project parent before other fields in updateProject

getObjectByUuid, used to resolve the new parent, triggers a query. Any
JDO query flushes dirty state first, so if the parent block ran after
setClassifier but before setCollectionLogic cleared it, converting a
collection project back to a regular one while also changing its
parent flushed a row with both fields set, violating
PROJECT_COLLECTION_CLASSIFIER_check and surfacing as an uncaught 500.

The same hazard is already handled a few lines below for the
collection tag, which is resolved before collectionLogic is set for
exactly this reason. Moving parent resolution to the top of the
method, before any field is touched, applies the same fix: the query
now runs while the object is still clean, so nothing is flushed early.

Added a test reproducing the reported request shape: converting a
collection project back to a regular one, with a classifier and a
parent in the same request. Reverting the fix reproduces the original
500.

hasActiveChild and getLatestProjectVersion also run queries between
setClassifier and setCollectionLogic, for the isActive and isLatest
branches respectively. Same hazard, not exercised by the reported
case or by the added test, and not changed here to keep this fix
scoped to what was reported and verified.

Signed-off-by: adityaanikam <adityanikam9502@gmail.com>

* Apply Spotless formatting to ProjectResourceTest

The Lint Java check failed on the test added in the previous commit:
one assertion was longer than palantir-java-format allows. This only
rewraps that line.

Signed-off-by: adityaanikam <adityanikam9502@gmail.com>

---------

Signed-off-by: adityaanikam <adityanikam9502@gmail.com>
(cherry picked from commit 8f399b6)
Signed-off-by: nscuro <nscuro@protonmail.com>
@nscuro nscuro added this to the 5.1.1 milestone Sep 20, 2026
@nscuro nscuro added the defect Something isn't working label Sep 20, 2026
@owasp-dt-bot

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@codacy-production

codacy-production Bot commented Sep 20, 2026 •

Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric Results
Complexity 0

View in Codacy

🟢 Coverage 92.86% diff coverage · -0.02% coverage variation

Metric Results
Coverage variation ✅ -0.02% coverage variation (-1.00%)
Diff coverage ✅ 92.86% diff coverage (70.00%)

View coverage diff in Codacy

Coverage variation details
Coverable lines Covered lines Coverage
Common ancestor commit (5e621e9) 44339 38704 87.29%
Head commit (9aad328) 44339 (+0) 38697 (-7) 87.28% (-0.02%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details
Coverable lines Covered lines Diff coverage
Pull request (#7367) 14 13 92.86%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.

@nscuro
nscuro merged commit d779c38 into DependencyTrack:5.1.x Sep 20, 2026
22 checks passed
@nscuro
nscuro deleted the backport-pr-7262 branch September 20, 2026 14:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

defect Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants