dependency-check-gradle
dependency-check-gradle copied to clipboard
Database Compability Issue when using Spring Boot 3.2.0
Summary
Using a cached h2 database build without spring boot 3.2 in a project that uses spring boot 3.2 will causes an error due to incompatible database versions
Steps to reproduce
- Build an h2 nvd database using update-only in a project that does not use spring boot (e.g by using the cli)
- Copy that database to a place where the other project can use it
- Configure a project using gradle, spring boot 3.2 and the dependency-check-gradle plugin to use the created database in step 1
- Execute a dependency check. It will cause the following error:
General error: "org.h2.mvstore.MVStoreException: The write format 2 is smaller than the supported format 3
Probable cause / investigation
H2 has bumped the database format from 2 to 3 in the 2.2 release (see github PR)
Meaning databases build in version 2.1 cannot be opened in version 2.2 and vice versa.
dependency-check core internally uses h2 version 2.1.214 to build and update the local nvd database
Spring-boot 3.2 has set the h2 database version to 2.2.224.
This causes a project that uses spring-boot 3.2 and the spring-boot dependency-managment plugin to have the h2 version clamped to 2.2.224.
This is probably due to the spring-boot dependency-management also affecting plugin versions.
Building the database in the same project works fine, since it's then a format 3 database. Using the format 2 database in maven works fine
Migrating the format 2 database to format 3 using the h2 database migrator also makes it readable by the spring project.