fix: widen reference URL column to handle long Mozilla CVE URLs

[steffenjacobs]

Some Mozilla CVE references (e.g. CVE-2026-6785 at 1585 chars, CVE-2026-6786 at 1115 chars) contain bugzilla URLs with many concatenated bug IDs that exceed the existing
VARCHAR(1000) limit on reference.url, causing NvdApiProcessor to throw DatabaseException: Value too long for column "URL CHARACTER VARYING(1000)" and skip those CVEs.

This widens the reference.url column from VARCHAR(1000) to VARCHAR(4000) (4000 was chosen to stay within Oracle's standard VARCHAR2(4000) limit and avoid falling back to
TEXT/CLOB on any supported dialect):

• Updated all 5 dialect initialization scripts (initialize.sql, initialize_mssql.sql, initialize_mysql.sql, initialize_oracle.sql, initialize_postgres.sql).
• Added upgrade_5.5.sql so existing H2 databases auto-migrate via DatabaseManager.updateSchema().
• Bumped the schema version from 5.5 to 5.6 in dependencycheck.properties and the property version inside each init script.

Verified locally against the test data.zip (a real 5.5 H2 db at src/test/resources/data.zip): the upgrade runs without errors, all 158,933 existing reference rows are preserved,
and a 1848-char Mozilla bugzilla URL inserts successfully where it previously failed.

Related issues

• fixes org.owasp.dependencycheck.data.nvdcve.DatabaseException: Error updating 'CVE-2026-6785'; Value too long for column "URL CHARACTER VARYING(1000) #8466

Have test cases been added to cover the new functionality?

no - existing DatabaseManagerTest.testInitialize and any test extending BaseDBTestCase already exercise upgrade_5.5.sql because the bundled data.zip is at schema 5.5 and the
application now expects 5.6.

[marcelstoer]

It's unfortunate that we have to do this but it LGTM.

[OrangeDog]

It is RECOMMENDED that all senders and recipients support, at a minimum, URIs with lengths of 8000 octets in protocol elements.

https://www.rfc-editor.org/rfc/rfc9110#section-4.1-5

[jeremylong]

4000 -> 8000

[marcelstoer]

@OrangeDog That is a very valid concern, but so is the author's judgement

4000 was chosen to stay within Oracle's standard VARCHAR2(4000) limit and avoid falling back to
TEXT/CLOB on any supported dialect

Which one is the lesser evil?

[Copilot]

Pull request overview

This PR updates the embedded Dependency-Check DB schema to support very long CVE reference URLs (notably Mozilla Bugzilla links) by widening the reference.url column and bumping the expected schema version so the H2 database can auto-upgrade.

Changes:

• Bumps the expected DB schema version from 5.5 to 5.6 in runtime and test dependencycheck.properties.
• Widens the reference.url column in all dialect initialization SQL scripts.
• Adds an H2 auto-migration script upgrade_5.5.sql to alter the column and update the schema version in properties.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
core/src/main/resources/dependencycheck.properties	Bumps expected schema version to 5.6
core/src/test/resources/dependencycheck.properties	Bumps expected schema version to 5.6 for tests
core/src/main/resources/data/upgrade_5.5.sql	Adds H2 upgrade from 5.5 → 5.6 and alters reference.url
core/src/main/resources/data/initialize.sql	Widens reference.url and updates schema version in properties
core/src/main/resources/data/initialize_postgres.sql	Widens reference.url and updates schema version in properties
core/src/main/resources/data/initialize_oracle.sql	Widens reference.url and updates schema version in properties
core/src/main/resources/data/initialize_mysql.sql	Widens reference.url and updates schema version in properties
core/src/main/resources/data/initialize_mssql.sql	Widens reference.url and updates schema version in properties

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[marcelstoer]

LGTM

[jeremylong]

LGTM

[jeremylong]

I will try and release this over the weekend.