Merge pull request #5179 from jeremylong/synchronization

fix: synchronization issue
jeremylong · Dec 24, 2022 · 7dedb46 · 7dedb46
2 parents a4d8c99 + cdfd264
commit 7dedb46
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyMergingAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyMergingAnalyzer.java
@@ -48,6 +48,10 @@ public class DependencyMergingAnalyzer extends AbstractDependencyComparingAnalyz
      * The phase that this analyzer is intended to run in.
      */
     private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_INFORMATION_COLLECTION;
+    /**
+     * Used for synchronization when merging related dependencies.
+     */
+    private static final Object DEPENDENCY_LOCK = new Object();
 
     /**
      * Returns the name of the analyzer.
@@ -145,7 +149,7 @@ protected boolean evaluateDependencies(final Dependency dependency, final Depend
      */
     public static void mergeDependencies(final Dependency dependency, final Dependency relatedDependency,
             final Set<Dependency> dependenciesToRemove) {
-        synchronized (dependency) {
+        synchronized (DEPENDENCY_LOCK) {
             LOGGER.debug("Merging '{}' into '{}'", relatedDependency.getFilePath(), dependency.getFilePath());
             dependency.addRelatedDependency(relatedDependency);
             relatedDependency.getEvidence(EvidenceType.VENDOR).forEach((e) -> dependency.addEvidence(EvidenceType.VENDOR, e));