Describe the bug
#6196 describes the original problem, but when running a gradlew dependencyCheckUpdate w/ the new version of the tool using cached definitions from vulnz the memory usage is growing beyond Gradle's default 512MB limit and causing an OOM error.
Version of dependency-check used
The problem occurs using version 9.0.5 of the Gradle plugin, however I would assume the other tools are impacted too.
Log file
Here are the logs, but I also have a heap dump so I'll attach some screenshots from it.




All 4 of my threads have sizeable collections of io.github.jeremylong.openvulnerability.client.nvd.DefCveItem in memory. Each DefCveItem itself then contains a large collection of io.github.jeremylong.openvulnerability.client.nvd.Config where the bulk of the data appears to be. All that then adds up to ~400MB and Gradle's default heap limit gets filled with some of the other stuff laying around inside it.
To Reproduce
Run a database update against a fresh project w/ no cache.
Expected behavior
The database is updated without a hitch and the analysis works.
Additional context
The heap size can be increased to get around the issue, but I'm hoping to avoid that as it'll mean updating the gradle.properties for all my projects.
Describe the bug
#6196 describes the original problem, but when running a
gradlew dependencyCheckUpdatew/ the new version of the tool using cached definitions from vulnz the memory usage is growing beyond Gradle's default 512MB limit and causing an OOM error.Version of dependency-check used
The problem occurs using version 9.0.5 of the Gradle plugin, however I would assume the other tools are impacted too.
Log file
Here are the logs, but I also have a heap dump so I'll attach some screenshots from it.
All 4 of my threads have sizeable collections of
io.github.jeremylong.openvulnerability.client.nvd.DefCveItemin memory. EachDefCveItemitself then contains a large collection ofio.github.jeremylong.openvulnerability.client.nvd.Configwhere the bulk of the data appears to be. All that then adds up to ~400MB and Gradle's default heap limit gets filled with some of the other stuff laying around inside it.To Reproduce
Run a database update against a fresh project w/ no cache.
Expected behavior
The database is updated without a hitch and the analysis works.
Additional context
The heap size can be increased to get around the issue, but I'm hoping to avoid that as it'll mean updating the
gradle.propertiesfor all my projects.