Describe the bug
ConcurrentModificationException in NodePackageAnalyzer.processDependencies. Seems like a regression of jeremylong/DependencyCheck#4089
Version of dependency-check used
8.1.0 version of the Gradle plugin, but I see that it was also happening as early as 7.0.1
Log file
An unexpected error occurred during analysis of '.../package-lock.json' (Node.js Package Analyzer): null
java.util.ConcurrentModificationException
at java.base/java.util.TreeMap$PrivateEntryIterator.nextEntry(TreeMap.java:1208)
at java.base/java.util.TreeMap$KeyIterator.next(TreeMap.java:1262)
at java.base/java.lang.Iterable.forEach(Iterable.java:74)
at java.base/java.util.Collections$UnmodifiableCollection.forEach(Collections.java:1085)
at org.owasp.dependencycheck.analyzer.DependencyMergingAnalyzer.mergeDependencies(DependencyMergingAnalyzer.java:160)
at org.owasp.dependencycheck.analyzer.NodePackageAnalyzer.processDependencies(NodePackageAnalyzer.java:465)
at org.owasp.dependencycheck.analyzer.NodePackageAnalyzer.processDependencies(NodePackageAnalyzer.java:410)
at org.owasp.dependencycheck.analyzer.NodePackageAnalyzer.analyzeDependency(NodePackageAnalyzer.java:270)
at org.owasp.dependencycheck.analyzer.AbstractAnalyzer.analyze(AbstractAnalyzer.java:131)
at org.owasp.dependencycheck.AnalysisTask.call(AnalysisTask.java:88)
at org.owasp.dependencycheck.AnalysisTask.call(AnalysisTask.java:37)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at java.base/java.lang.Thread.run(Thread.java:829)
To Reproduce
Can't provide clear reproduction steps, the number of exceptions and in which projects they occur is pretty random.
Expected behavior
No ConcurrentModificationException and analysis is complete
Additional context
Describe the bug
ConcurrentModificationExceptioninNodePackageAnalyzer.processDependencies. Seems like a regression of jeremylong/DependencyCheck#4089Version of dependency-check used
8.1.0 version of the Gradle plugin, but I see that it was also happening as early as 7.0.1
Log file
To Reproduce
Can't provide clear reproduction steps, the number of exceptions and in which projects they occur is pretty random.
Expected behavior
No
ConcurrentModificationExceptionand analysis is completeAdditional context