Vulnerability Analysis Cache expiry erroneuously reduced to 14.4 minutes

[valentijnscholten]

Current Behavior:

The Vulnerability Analysis Cache expiry time was reduced from 24h to 14.4 minutes by mistake in #1841

https://github.com/DependencyTrack/dependency-track/commit/ac6186cd3f7c8d3731cac5ba944732df3ba6fda4#diff-4a2691c1673ee2620[…]62f4d1d6eada58a83596L73
https://github.com/DependencyTrack/dependency-track/commit/ac6186cd3f7c8d3731cac5ba944732df3ba6fda4#diff-c0b9dee940783572a[…]4df4e138fef3381477e0R49

Steps to Reproduce:

Not needed

Expected Behavior:

Set cache expiry back to 24h, or as discussed on Slack 12h might be better: https://owasp.slack.com/archives/C6R3R32H4/p1667471703846329

Additional Details:

This needs a database migration to convert the wrong default cache expiry currently stored in the database.
A text update might be good for the Task Schedule page in the UI to explain that the Cache Analysis Cleanup Cadence is a different setting that completely empties the cache.
In a future PR it might be worthwhile to make the cache expiry property configurable, maybe with some kind of sane/safe minimum value to avoid overloading the analyzer APIs.

[nscuro]

@stevespringett Do we want to have a 4.6.x release for this?

[stevespringett]

We likely should, yes

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.