According to nscuro suggestions

-Remove unnecesary persistance in updateVulnerability function.
-Return updated exisitingVulnerability in updateVulnerability
-Remove return of empty vulnerability
-Wrap synchronizedVUlnerability in callInTransaction to share
same transaction.

Signed-off-by: Andres Tito <[email protected]>

src/main/java/org/dependencytrack/persistence/VulnerabilityQueryManager.java

@@ -109,7 +109,6 @@ public Vulnerability updateVulnerability(Vulnerability transientVulnerability, b
         return callInTransaction(() -> {
             Vulnerability existingVulnerability = getExistingVulnerability(transientVulnerability);
             if (existingVulnerability != null) {
-
                 final PersistenceUtil.Differ<Vulnerability> differ = new PersistenceUtil.Differ<>(existingVulnerability, transientVulnerability);
                 differ.applyIfChanged("created", Vulnerability::getCreated, existingVulnerability::setCreated);
                 differ.applyIfChanged("published", Vulnerability::getPublished, existingVulnerability::setPublished);
@@ -139,24 +138,14 @@ public Vulnerability updateVulnerability(Vulnerability transientVulnerability, b
                 differ.applyIfChanged("owaspRRTechnicalImpactScore", Vulnerability::getOwaspRRTechnicalImpactScore, existingVulnerability::setOwaspRRTechnicalImpactScore);
                 differ.applyIfChanged("owaspRRVector", Vulnerability::getOwaspRRVector, existingVulnerability::setOwaspRRVector);
                 differ.applyIfChanged("cwes", Vulnerability::getCwes, existingVulnerability::setCwes);
-                if (transientVulnerability.getVulnerableSoftware()!= null) {
-                    differ.applyIfChanged("vulnerableSoftware", Vulnerability::getVulnerableSoftware, existingVulnerability::setVulnerableSoftware);
+                differ.applyIfNonNullAndChanged("vulnerableSoftware", Vulnerability::getVulnerableSoftware, existingVulnerability::setVulnerableSoftware);
             }
-                // Persist changes only if there are differences
-                if (!differ.getDiffs().isEmpty()) {
-                    final Vulnerability result = persist(existingVulnerability);
-            Event.dispatch(new IndexEvent(IndexEvent.Action.UPDATE, result));
-            commitSearchIndex(commitIndex, Vulnerability.class);
-            return result;
-        }
-                // If no changes were made, return the existing vulnerability without modification
-                return existingVulnerability;
-                }
             else {
                 // Handle cases where no existing vulnerability is found if needed (e.g., log an error)
                 LOGGER.warn("No existing vulnerability found for update operation.");
-                return new Vulnerability(); // return a new object or handle according to requirements
             }
+            //return updated Vulnerability
+            return existingVulnerability;
         });
     }
 
@@ -170,18 +159,18 @@ public Vulnerability updateVulnerability(Vulnerability transientVulnerability, b
      */
     @Override
     public Vulnerability synchronizeVulnerability(Vulnerability vulnerability, boolean commitIndex) {
-        Vulnerability existingVulnerability  = getExistingVulnerability(vulnerability);
-        if (existingVulnerability != null) {
-            if(hasChanges(existingVulnerability, vulnerability)) {
-                // Update only if changes are detected
-                return updateVulnerability(vulnerability, commitIndex);
+        return callInTransaction(() -> {
+            Vulnerability existingVulnerability  = getExistingVulnerability(vulnerability);
+            if (existingVulnerability == null) {
+                // Create new vulnerability if it doesnt exist
+                return  createVulnerability(vulnerability, commitIndex);
             } else {
-                return null;
+                // Update only if changes are detected
+                return hasChanges(existingVulnerability, vulnerability)
+                ? updateVulnerability(vulnerability, commitIndex)
+                : null;
             }
-        } else {
-            // Create new vulnerability if it doesnt exist
-            return  createVulnerability(vulnerability, commitIndex);
-        }
+        });
     }
 
     /**