DependencyTrack / DependencyTrack/dependency-track
Trivy Overloaded When Multiple Projects Are Uploaded Without Delay
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
When uploading 200 projects sequentially via the API without introducing any delay, the analyzers successfully assign vulnerabilities to the components, Trivy takes significantly longer—sometimes exceeding 10 minutes per project.
Adding a reasonable delay between uploads (e.g., 50 seconds in my case) allows Trivy to react and function properly.
### Steps to Reproduce
1. Sequentially upload 200 projects via the API, waiting for a server response after each upload.
2. Observe that vulnerabilities are assigned to components initially, but Trivy becomes stuck after some time.
3. Retry with a delay (e.g., 50 seconds) between uploads.
4. Observe that Trivy processes all projects successfully.
### Expected Behavior
Trivy should handle sequential project uploads with processing times comparable to other analyzers.
### Actual Behavior
Trivy takes significantly longer to process projects than other analyzers when handling sequential uploads without delay. This creates a bottleneck in vulnerability assignment and slows down the overall process.
### Dependency-Track Version
4.12.2
### Dependency-Track Distribution
Executable WAR
### Database Server
PostgreSQL
### Database Server Version
_No response_
### Browser
Mozilla Firefox
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.