Update DB schema

[nscuro]

Description

Update DB schema with recent changes.

Addressed Issue

N/A

Additional Details

N/A

Checklist

• I have read and understand the contributing guidelines
• This PR fixes a defect, and I have provided tests to verify that the fix is effective
• This PR implements an enhancement, and I have provided tests to verify that it works as intended
• This PR introduces changes to the database model, and I have updated the migration changelog accordingly
• This PR introduces new or alters existing behavior, and I have updated the documentation accordingly

[owasp-dt-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Pull request overview

Updates the repository’s Postgres schema snapshot (schema.sql) to reflect recent database changes, and removes legacy Java model artifacts related to the old vulnerability alias representation.

Changes:

• Refresh schema.sql with updated procedures, tables/indexes, and the new VULNERABILITY_ALIAS-based aliasing model.
• Adjust clone_project implementation details (constraint deferral and IS_LATEST updates timing).
• Remove the deprecated VulnerabilityAlias model and the transient aliases field from Vulnerability.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
commons-persistence/src/main/resources/schema.sql	Updates schema snapshot: procedures, clone logic adjustments, new tables, alias model/table migration, and refreshed partitions/indexes/constraints.
commons-persistence/src/main/java/org/dependencytrack/persistence/model/VulnerabilityAlias.java	Removes legacy JPA model for VULNERABILITYALIAS.
commons-persistence/src/main/java/org/dependencytrack/persistence/model/Vulnerability.java	Removes now-unused transient aliases property accessors.

Comments suppressed due to low confidence (2)

commons-persistence/src/main/resources/schema.sql:482

• SET CONSTRAINTS ALL DEFERRED changes constraint checking mode for the remainder of the surrounding transaction (not just inside this function). If clone_project is called from a larger transaction, this can unintentionally defer FK checks for unrelated work after the call. Consider resetting to SET CONSTRAINTS ALL IMMEDIATE before returning, or otherwise ensuring/ documenting that clone_project is always executed in its own transaction.

  -- Defer checking of FK constraints to commit time.
  -- We want clones to be atomic, but due to the multiple tables
  -- with FKs being involved, that has a potential for lock contention.
  SET CONSTRAINTS ALL DEFERRED;

commons-persistence/src/main/resources/schema.sql:2973

• The init script hard-codes a single daily partition for DEPENDENCYMETRICS/PROJECTMETRICS with a fixed timestamp range. Since this schema.sql is used to initialize test/dev Postgres instances, these partitions will become stale quickly and inserts may fail once timestamps fall outside the covered range. Consider adding a DEFAULT partition (or a wider initial range) in the init script, or generating/attaching partitions dynamically during startup instead of baking specific dates into the schema snapshot.

ALTER TABLE ONLY public."DEPENDENCYMETRICS" ATTACH PARTITION public."DEPENDENCYMETRICS_20260226" FOR VALUES FROM ('2026-02-25 23:00:00+00') TO ('2026-02-26 23:00:00+00');

ALTER TABLE ONLY public."PROJECTMETRICS" ATTACH PARTITION public."PROJECTMETRICS_20260226" FOR VALUES FROM ('2026-02-25 23:00:00+00') TO ('2026-02-26 23:00:00+00');

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codacy-production]

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation	Diff coverage
✅ +23.72% (target: -1.00%)	✅ ∅ (target: 70.00%)

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (5657f47)	212	137	64.62%
Head commit (cce2dca)	4659 (+4447)	4116 (+3979)	88.35% (+23.72%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#2050)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings    Change summary preferences