Error in CacheStampedeBlocker for pre-release only NuGet packages #5075
Description
Current Behavior
When checking the logs in DT, I can see the following:
2025-06-25 13:33:04,952 WARN [CacheStampedeBlocker] An error occurred while populating cache repositoryMetaCache for key pkg:nuget/[email protected] : Cannot invoke "String.length()" because "<parameter1>" is null
java.lang.NullPointerException: Cannot invoke "String.length()" because "<parameter1>" is null
at java.base/java.net.URLEncoder.encode(Unknown Source)
at org.dependencytrack.tasks.repositories.AbstractMetaAnalyzer.urlEncode(AbstractMetaAnalyzer.java:84)
at org.dependencytrack.tasks.repositories.NugetMetaAnalyzer.performLastPublishedCheck(NugetMetaAnalyzer.java:161)
at org.dependencytrack.tasks.repositories.NugetMetaAnalyzer.analyze(NugetMetaAnalyzer.java:101)
at org.dependencytrack.tasks.repositories.RepositoryMetaAnalyzerTask.analyze(RepositoryMetaAnalyzerTask.java:196)
at org.dependencytrack.tasks.repositories.RepositoryMetaAnalyzerTask.lambda$analyze$0(RepositoryMetaAnalyzerTask.java:139)
at io.github.resilience4j.retry.Retry.lambda$decorateCallable$5(Retry.java:237)
at io.github.resilience4j.retry.Retry.executeCallable(Retry.java:373)
at org.dependencytrack.util.CacheStampedeBlocker.readThroughOrPopulateCache(CacheStampedeBlocker.java:201)
at org.dependencytrack.tasks.repositories.RepositoryMetaAnalyzerTask.analyze(RepositoryMetaAnalyzerTask.java:144)
at org.dependencytrack.tasks.repositories.RepositoryMetaAnalyzerTask.inform(RepositoryMetaAnalyzerTask.java:102)
at alpine.event.framework.BaseEventService.lambda$publish$0(BaseEventService.java:110)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.base/java.lang.Thread.run(Unknown Source)
From what I can tell, meta.getLatestVersion() is null and is passed to urlEncode.
Steps to Reproduce
- Analyze a .NET project with a NuGet package that only has beta releases. E.g. OpenTelemetry.Instrumentation.SqlClient
- See dependencytrack error logs
Expected Behavior
DependencyTrack should not throw errors for packages with only pre-release packages.
For some reason, the SQL intrumentation pacakges for OpenTelemetry never had a full release, and I think something broke when DT fixed pre-release packages showing up as the latest version.
Dependency-Track Version
4.13.2
Dependency-Track Distribution
Container Image
Database Server
N/A
Database Server Version
N/A
Browser
N/A
Checklist
- I have read and understand the contributing guidelines
- I have checked the existing issues for whether this defect was already reported