DependencyTrack / DependencyTrack/dependency-track
missing Index on VULNERABLESOFTWARE
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
-> Parallel Index Scan using "VULNERABLESOFTWARE_PURL_TYPE_NS_NAME_IDX" on "VULNERABLESOFTWARE" "A0" (cost=0.56..387323.80 rows=1 width=2410) (actual time=1134.942..1134.942 rows=0 loops=3)
### Steps to Reproduce
`explain SELECT
'org.dependencytrack.model.VulnerableSoftware' AS "DN_TYPE",
"A0"."CPE22",
"A0"."CPE23",
"A0"."EDITION",
"A0"."ID",
"A0"."LANGUAGE",
"A0"."OTHER",
"A0"."PART",
"A0"."PRODUCT",
"A0"."PURL",
"A0"."PURL_NAME",
"A0"."PURL_NAMESPACE",
"A0"."PURL_QUALIFIERS",
"A0"."PURL_SUBPATH",
"A0"."PURL_TYPE",
"A0"."PURL_VERSION",
"A0"."SWEDITION",
"A0"."TARGETHW",
"A0"."TARGETSW",
"A0"."UPDATE",
"A0"."UUID",
"A0"."VENDOR",
"A0"."VERSION",
"A0"."VERSIONENDEXCLUDING",
"A0"."VERSIONENDINCLUDING",
"A0"."VERSIONSTARTEXCLUDING",
"A0"."VERSIONSTARTINCLUDING",
"A0"."VULNERABLE"
FROM
"VULNERABLESOFTWARE" "A0"
WHERE
"A0"."PURL_TYPE" = 'foo'
AND "A0"."PURL_NAME" = 'bar'
AND "A0"."PURL_NAMESPACE" = 'ubuntu'
AND "A0"."VERSION" = 'baz'
AND "A0"."VERSIONENDEXCLUDING" = 'bla'
AND "A0"."VERSIONENDINCLUDING" IS NULL
AND "A0"."VERSIONSTARTEXCLUDING" IS NULL
AND "A0"."VERSIONSTARTINCLUDING" IS NULL FETCH NEXT ROW ONLY;`
### Expected Behavior
create index concurrently on "VULNERABLESOFTWARE" ("VERSION", "VERSIONENDEXCLUDING");
-> Index Scan using "VULNERABLESOFTWARE_VERSION_VERSIONENDEXCLUDING_idx" on "VULNERABLESOFTWARE" "A0" (cost=0.56..2.79 rows=1 width=2410) (actual time=1.005..1.005 rows=0 loops=1)
### Dependency-Track Version
4.7.x
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
15
### Browser
Google Chrome
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.