Dependency Track API Server - error with H2 "AFFECTEDVERSIONATTRIBUTION" after mirroring

[jonhall54]

Current Behavior

After setting up dependency track with a new volume, and the API server logs show it has completed the NistApiMirrorTask and EpssMirrorTask a h2 error is thrown which does not clear on restart:

2025-01-21 16:46:19,959 INFO [RequirementsVerifier] Initializing requirements verifier
2025-01-21 16:46:19,960 INFO [UpgradeInitializer] Initializing upgrade framework
2025-01-21 16:47:22,284 WARN [Schema] Exception thrown while querying indices for table=AFFECTEDVERSIONATTRIBUTION
org.h2.jdbc.JdbcSQLNonTransientException: General error: "org.h2.mvstore.MVStoreException: Chunk 19247 not found [2.3.232/9]" [50000-232]

Steps to Reproduce

1. Start dependency track with new docker volume via docker compose.
2. Configure the following:
   1. Admin user password change.
   2. NVD API mirroring with an NVD API Key.
   3. OSV with vuln ID matching.
3. Upload a BOM.
4. Await completion of [NistApiMirrorTask], [EpssMirrorTask], and [EpssParser].
5. Await [EmbeddedJettyServer] doing a config dump, followed by the error.

Expected Behavior

API server not to throw an error, indices from AFFECTEDVERSIONATTRIBUTION to match intended state.

Dependency-Track Version

4.12.2

Dependency-Track Distribution

Container Image

Database Server

H2

Database Server Version

No response

Browser

Google Chrome

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[valentijnscholten]

My experience is that H2 will eventually get corrupted and throw errors like this. Can you switch to a "real" database?

[jonhall54]

No reason I couldn't but it does present a barrier to entry for doing a short proof of concept/ proof of value - note that another OWASP project defectdojo defaults to containerized postgres: https://github.com/DefectDojo/django-DefectDojo/blob/537298495f3ee6fa43a1a6928d91659a9633b58e/docker-compose.yml#L107 if H2 can be a bit flaky this could be considered?

[valentijnscholten]

I like that approach better indeed. I believe for v4 DT will only support postgres: https://github.com/DependencyTrack/hyades

[nscuro]

[...] if H2 can be a bit flaky this could be considered?

Good suggestion, here you go: #4576