DependencyTrack / DependencyTrack/dependency-track

Trivy Overloaded When Multiple Projects Are Uploaded Without Delay

Open
#4,453 6 comments 0 reactions 0 assignees View on GitHub
defect integration/trivy p2 size/M
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

When uploading 200 projects sequentially via the API without introducing any delay, the analyzers successfully assign vulnerabilities to the components, Trivy takes significantly longer—sometimes exceeding 10 minutes per project.

Adding a reasonable delay between uploads (e.g., 50 seconds in my case) allows Trivy to react and function properly.

### Steps to Reproduce

1. Sequentially upload 200 projects via the API, waiting for a server response after each upload.
2. Observe that vulnerabilities are assigned to components initially, but Trivy becomes stuck after some time.
3. Retry with a delay (e.g., 50 seconds) between uploads.
4. Observe that Trivy processes all projects successfully.

### Expected Behavior
Trivy should handle sequential project uploads with processing times comparable to other analyzers.

### Actual Behavior
Trivy takes significantly longer to process projects than other analyzers when handling sequential uploads without delay. This creates a bottleneck in vulnerability assignment and slows down the overall process.

### Dependency-Track Version

4.12.2

### Dependency-Track Distribution

Executable WAR

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Mozilla Firefox

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.