Repository: DependencyTrack/dependency-track

Issue #2061: NotificationService crashes with PSQLException: column list index is out of range: 1, number of columns: 0.
Created: 2022-10-18T08:34:56Z
Current Behavior:
After restarting the api-server it starts updating itself with Github Advisories, OSV etc. After completing the update it crashes:
(...)
2022-10-18 08:09:53,145 INFO [GitHubAdvisoryMirrorTask] Updating datasource with GitHub advisories
2022-10-18 08:09:56,198 INFO [GitHubAdvisoryMirrorTask] GitHub Advisory mirroring complete
2022-10-18 08:09:56,198 INFO [GitHubAdvisoryMirrorTask] Time spent (total): 482040ms
2022-10-18 08:09:56,208 ERROR [LoggableUncaughtExceptionHandler] An unknown error occurred in an asynchronous event or notification thread
javax.jdo.JDODataStoreException: Cannot set String parameter: value = SYSTEM for column "" : The column index is out of range: 1, number of columns: 0.
        at org.datanucleus.api.jdo.JDOAdapter.getJDOExceptionForNucleusException(JDOAdapter.java:605)
        at org.datanucleus.api.jdo.JDOQuery.executeInternal(JDOQuery.java:456)
        at org.datanucleus.api.jdo.JDOQuery.execute(JDOQuery.java:276)
        at org.dependencytrack.notification.NotificationRouter.resolveRules(NotificationRouter.java:147)
        at org.dependencytrack.notification.NotificationRouter.inform(NotificationRouter.java:56)
        at alpine.notification.NotificationService.lambda$alertSubscriber$0(NotificationService.java:110)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
        at java.base/java.lang.Thread.run(Unknown Source)
Caused by: org.postgresql.util.PSQLException: The column index is out of range: 1, number of columns: 0.
        at org.postgresql.core.v3.SimpleParameterList.bind(SimpleParameterList.java:70)
        at org.postgresql.core.v3.SimpleParameterList.setStringParameter(SimpleParameterList.java:133)
        at org.postgresql.jdbc.PgPreparedStatement.bindString(PgPreparedStatement.java:1099)
        at org.postgresql.jdbc.PgPreparedStatement.setString(PgPreparedStatement.java:387)
        at org.postgresql.jdbc.PgPreparedStatement.setString(PgPreparedStatement.java:373)
        at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.setString(HikariProxyPreparedStatement.java)
        at org.datanucleus.store.rdbms.mapping.column.CharColumnMapping.setString(CharColumnMapping.java:261)
        at org.datanucleus.store.rdbms.mapping.java.EnumMapping.setObject(EnumMapping.java:170)
        at org.datanucleus.store.rdbms.sql.SQLStatementHelper.applyParametersToStatement(SQLStatementHelper.java:311)
        at org.datanucleus.store.rdbms.query.BulkFetchHandler.applyParametersToStatement(BulkFetchHandler.java:99)
        at org.datanucleus.store.rdbms.query.JDOQLQuery.performExecute(JDOQLQuery.java:715)
        at org.datanucleus.store.query.Query.executeQuery(Query.java:2004)
        at org.datanucleus.store.query.Query.executeWithArray(Query.java:1893)
        at org.datanucleus.api.jdo.JDOQuery.executeInternal(JDOQuery.java:433)
        ... 7 common frames omitted

I have no notifications defined through the UI:

This instance was updated from 4.5.0 to 4.6.0 and then 4.6.1.
PG-version is 14.3-1.pgdg110+1 from postgres:14.3-bullseye@sha256:c976fe9355f53fd93c087e0875be401ad19fa5c3c894b5ae44c03ae9c573cbba
Environment:

Dependency-Track Version: 4.6.1
Distribution: Docker
BOM Format & Version:
Database Server: PostgreSQL

Additional Details:
(e.g. detailed explanation, stacktraces, related issues, suggestions how to fix, links for us to have context, eg. stackoverflow, gitter, etc)

Duplicate issue #3372: After update to 4.10.*: Empty Audit Vulnerabilities lists and Uncaught internal server error: value = ... for column ""COMPONENT"."ID"" : The column index is out of range: 1, number of columns: 0.
Created: 2024-01-11T10:57:16Z
Current Behavior
After I updated 4.9.1 to 4.10.0 and then 4.10.1, the Audit Vulnerabilities list has been showing 0 entries for all projects and project versions. Can't say which of the two update step caused this.
Looking at the browser dev tools, the reason for the empty lists was that the /api/v1/findings API requests failed with HTTP status 500.
The 500s correlated with log entries like these, differing by the value = ... value:
2024-01-11 08:02:14,575 ERROR [GlobalExceptionHandler] Uncaught internal server error
javax.jdo.JDODataStoreException: Cannot set long parameter: value = 498978 for column ""COMPONENT"."ID"" : The column index is out of range: 1, number of columns: 0.
        at org.datanucleus.api.jdo.JDOAdapter.getJDOExceptionForNucleusException(JDOAdapter.java:605)
        at org.datanucleus.api.jdo.JDOQuery.executeInternal(JDOQuery.java:456)
        at org.datanucleus.api.jdo.JDOQuery.execute(JDOQuery.java:290)
        at org.dependencytrack.persistence.FindingsQueryManager.getAnalysis(FindingsQueryManager.java:169)
        at org.dependencytrack.persistence.FindingsQueryManager.getFindings(FindingsQueryManager.java:276)
        at org.dependencytrack.persistence.QueryManager.getFindings(QueryManager.java:1044)
        at org.dependencytrack.resources.v1.FindingResource.getFindingsByProject(FindingResource.java:92)
        at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory.lambda$static$0(ResourceMethodInvocationHandlerFactory.java:52)
        at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:146)
        at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:189)
        at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$ResponseOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:176)
        at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:93)
        at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:478)
       ...

I fixed this by manually restarting the apiserver container.
I don't know DT's inner workings, but this feels like the apiserver cached some intermediate DB state from when the DB was still processing update-related background data tasks, and kept working off of that, claiming silly things like the table having no columns.
Steps to Reproduce

have 4.9.1 apiserver and frontend running with projects in a docker-compose setup (also including an nginx and swagger-ui)
update the image tags for the apiserver and frontend to 4.10.0, save and do docker-compose up -d
have 4.10.0 running for a while (was over the x-mas das in my case)
update the image tags of the apiserver to 4.10.1, save and do `docker-compose up -d

Expected Behavior
Audit Vulnerabilities should not be empty and I shouldn't have to manually restart the apiserver if the Change Log didn't recommend it.
Dependency-Track Version
4.10.1
Dependency-Track Distribution
Container Image
Database Server
PostgreSQL
Database Server Version
13.2.0
Browser
Google Chrome
Checklist

 I have read and understand the contributing guidelines
 I have checked the existing issues for whether this defect was already reported

Closing comment (2024-06-15T16:37:25Z): Confirmed to be the same as #2061. Closing as duplicate.