Changelog for version 12.2.2 not accurate

[michix]

Our upgrade to version 12.2.2 failed with the following error message:

[ERROR] 	DatabaseException: Unable to connect to the dependency-check database
[ERROR] 		caused by DatabaseException: Database schema does not match this version of dependency-check
[ERROR] 		caused by DatabaseException: Old database schema identified - please execute dependency-check without the no-update configuration to continue

Some digging revealed, that indeed the database schema has been changed in this version (47aa0c7). This is, however, not reflected in the CHANGELOG. Could you please add this change?

On another note, a schema change is a breaking change for us, because we have to rebuild the database. But I guess in this project this does not count as a breaking change, right?

[chadlwilson]

Not sure that it should require too much digging because the very first changelog entry is

fix: widen reference URL column to handle long Mozilla CVE URLs (#8467)

Anyone using NVD would have been getting DB errors for the past week due to the problem that was fixed. (If they monitor their logs/DB)

It could be more explicit, sure, but it's definitely there and not "inaccurate". I'll suggest a change to clarify as I wanted to tidy the spacing anyway.

It's a bit of a grey area, and likely does not count as a breaking change because upgrade deltas are supplied, and are automatically applied for H2 users (which are likely the majority), there's no general requirement to "rebuild the database" across any DB type, and the rollback in this case is also non-destructive; not bound between DB schema and code.

People with external centralised databases are probably expected to automate checking for upgrades to apply within the distribution as appropriate for their DB/deployment processes so as to apply deltas during any automated upgrades. Probably the expectations could be more explicit in the docs at https://dependency-check.github.io/DependencyCheck/data/database.html though.

[michix]

Sorry, I didn't mean to offend you! Probably "inaccurate" is not an appropriate wording, so please excuse me here (I am not a native speaker). The changes you proposed in #8476 are great, thank you very much.

[michix]

I am closing this issue since everything is clarified for me now.

[chadlwilson]

Not offended, sorry - just was writing loosely and directly while on-the-go. My bad. 😅

if you'd like to submit a PR or suggestion to improve the documentation it'd help.

[chadlwilson]

To be fair to you, most previous schema changes do seem to have been marked as breaking it seems, probably because they have involved bigger changes, not just a column length change to fix a minor bug from upstream data.

I'm not recommending it, but even if you mark your schema version as updated using DML without changing the column size I believe ODC should keep working, just with the particular CVE ignored (and the error logged in #8466), which for now only seems to be a Firefox CVE, not the types of components ODC scans for.