Skip to content

v9.0.5 still appears to have memory usage problems #6295

@ThomGeG

Description

@ThomGeG

Describe the bug
#6196 describes the original problem, but when running a gradlew dependencyCheckUpdate w/ the new version of the tool using cached definitions from vulnz the memory usage is growing beyond Gradle's default 512MB limit and causing an OOM error.

Version of dependency-check used
The problem occurs using version 9.0.5 of the Gradle plugin, however I would assume the other tools are impacted too.

Log file
Here are the logs, but I also have a heap dump so I'll attach some screenshots from it.

image
image
image
image

All 4 of my threads have sizeable collections of io.github.jeremylong.openvulnerability.client.nvd.DefCveItem in memory. Each DefCveItem itself then contains a large collection of io.github.jeremylong.openvulnerability.client.nvd.Config where the bulk of the data appears to be. All that then adds up to ~400MB and Gradle's default heap limit gets filled with some of the other stuff laying around inside it.

To Reproduce
Run a database update against a fresh project w/ no cache.

Expected behavior
The database is updated without a hitch and the analysis works.

Additional context
The heap size can be increased to get around the issue, but I'm hoping to avoid that as it'll mean updating the gradle.properties for all my projects.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions