dependency-check-gradle icon indicating copy to clipboard operation
dependency-check-gradle copied to clipboard

Database Compability Issue when using Spring Boot 3.2.0

Open LukasPrediger opened this issue 1 year ago • 1 comments

Summary

Using a cached h2 database build without spring boot 3.2 in a project that uses spring boot 3.2 will causes an error due to incompatible database versions

Steps to reproduce

  1. Build an h2 nvd database using update-only in a project that does not use spring boot (e.g by using the cli)
  2. Copy that database to a place where the other project can use it
  3. Configure a project using gradle, spring boot 3.2 and the dependency-check-gradle plugin to use the created database in step 1
  4. Execute a dependency check. It will cause the following error: General error: "org.h2.mvstore.MVStoreException: The write format 2 is smaller than the supported format 3

Probable cause / investigation

H2 has bumped the database format from 2 to 3 in the 2.2 release (see github PR)

Meaning databases build in version 2.1 cannot be opened in version 2.2 and vice versa.

dependency-check core internally uses h2 version 2.1.214 to build and update the local nvd database

Spring-boot 3.2 has set the h2 database version to 2.2.224.

This causes a project that uses spring-boot 3.2 and the spring-boot dependency-managment plugin to have the h2 version clamped to 2.2.224.

This is probably due to the spring-boot dependency-management also affecting plugin versions.

Building the database in the same project works fine, since it's then a format 3 database. Using the format 2 database in maven works fine

Migrating the format 2 database to format 3 using the h2 database migrator also makes it readable by the spring project.

LukasPrediger avatar Jan 26 '24 11:01 LukasPrediger