fix: dispatch metrics update for collection parent on bulk project delete

When child projects are deleted via deleteProjectsByUUIDs, their parent
collection project's metrics are now recalculated. Previously the stale
aggregated metrics (vuln counts, risk scores, etc.) would persist on the
collection project indefinitely after all children were removed.

The single-delete path (recursivelyDelete) already handled this correctly;
this aligns the bulk-delete path with the same behaviour.

Signed-off-by: Valentijn Scholten <valentijnscholten@gmail.com>

Author: valentijnscholten

src/main/java/org/dependencytrack/persistence/ProjectQueryManager.java

@@ -1019,6 +1019,16 @@ public void deleteProjectsByUUIDs(Collection<UUID> uuids) {
             throw ProjectOperationException.forDeletion(errorByUUID);
         }
 
+        // Collect parent collection projects that need metrics updates after deletion.
+        // Exclude parents that are themselves being deleted.
+        final Set<UUID> collectionParentUuids = projects.stream()
+                .map(Project::getParent)
+                .filter(parent -> parent != null
+                        && parent.getCollectionLogic() != ProjectCollectionLogic.NONE
+                        && uuids.stream().noneMatch(u -> u.equals(parent.getUuid())))
+                .map(Project::getUuid)
+                .collect(Collectors.toSet());
+
         Long[] projectIDsArray = accessibleProjectIds.toArray(Long[]::new);
         String commaSeparatedProjectIDs = accessibleProjectIds.stream().map(String::valueOf).collect(Collectors.joining(","));
         var queryParameter = DbUtil.isMssql() ? commaSeparatedProjectIDs : projectIDsArray;
@@ -1325,6 +1335,10 @@ WHERE PROJECT.ID IN (SELECT value FROM STRING_SPLIT(?, ','))
                 executeAndCloseWithArray(sqlQuery, queryParameter);
             }
         });
+
+        for (final UUID parentUuid : collectionParentUuids) {
+            Event.dispatch(new ProjectMetricsUpdateEvent(parentUuid));
+        }
     }
 
     /**

src/test/java/org/dependencytrack/persistence/ProjectQueryManagerTest.java

@@ -32,7 +32,9 @@
 
 import java.util.Date;
 import java.util.List;
+import java.util.UUID;
 
+import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
 import static org.mockito.Mockito.times;
 
@@ -132,4 +134,42 @@ public void testCloneProjectMetricUpdate() throws Exception {
         }
     }
 
+    @Test
+    void testDeleteProjectsByUUIDsDispatchesMetricsUpdateForCollectionParent() {
+        final Project collectionParent = qm.createProject("Collection", null, "1.0", null, null, null, true, false);
+        final Project detachedParent = qm.detach(Project.class, collectionParent.getId());
+        detachedParent.setCollectionLogic(ProjectCollectionLogic.AGGREGATE_DIRECT_CHILDREN);
+        qm.updateProject(detachedParent, false);
+
+        final Project child = qm.createProject("Child", null, "1.0", null, collectionParent, null, true, false);
+
+        try (MockedStatic<Event> mockedEvent = Mockito.mockStatic(Event.class)) {
+            qm.deleteProjectsByUUIDs(List.of(child.getUuid()));
+
+            final ArgumentCaptor<Event> eventCaptor = ArgumentCaptor.forClass(Event.class);
+            mockedEvent.verify(() -> Event.dispatch(eventCaptor.capture()), times(1));
+
+            final List<UUID> dispatchedUuids = eventCaptor.getAllValues().stream()
+                    .filter(e -> e instanceof ProjectMetricsUpdateEvent)
+                    .map(e -> ((ProjectMetricsUpdateEvent) e).getUuid())
+                    .toList();
+            assertThat(dispatchedUuids).containsExactly(collectionParent.getUuid());
+        }
+    }
+
+    @Test
+    void testDeleteProjectsByUUIDsDoesNotDispatchMetricsUpdateWhenParentAlsoDeleted() {
+        final Project collectionParent = qm.createProject("Collection", null, "1.0", null, null, null, true, false);
+        final Project detachedParent = qm.detach(Project.class, collectionParent.getId());
+        detachedParent.setCollectionLogic(ProjectCollectionLogic.AGGREGATE_DIRECT_CHILDREN);
+        qm.updateProject(detachedParent, false);
+
+        final Project child = qm.createProject("Child", null, "1.0", null, collectionParent, null, true, false);
+
+        try (MockedStatic<Event> mockedEvent = Mockito.mockStatic(Event.class)) {
+            qm.deleteProjectsByUUIDs(List.of(collectionParent.getUuid(), child.getUuid()));
+
+            mockedEvent.verify(() -> Event.dispatch(Mockito.any(ProjectMetricsUpdateEvent.class)), times(0));
+        }
+    }
 }