[chadlwilson]

Description of Change

Currently all datafeed downloads are processed and awaited in the submitted order; and the submitted order is based on hash, not logical order.

There's no functional reason they need to be processed in submission order because each feed other than the modified one is for a separate year and subset of CVEs, and the submission order is also currently not consistent. We can acknowledge them and dispatch them for processing one-by-one as they complete using a CompletionService, rather than using static ordering of Futures.

The current behaviour causes really weird stuff like sitting there waiting for slow 2002 and 2003 downloads when the 2004 downloads have already failed, which is quite frustrating when you're trying to debug a problematic proxy or very slow NVD (as is the state right now).

This change

• makes order of feed downloads deterministically sorted by year 2001, 2002, 2003....etc
• simplifies the processing, by moving processing dispatch logic to the NvdApiDataSource itself
• changes to make the downloads fail fast, and process in order of download completion (except for modified, processed at the end)
• reverts to the previous default of 2 concurrent feed downloads (changed in 2021). The current unreliability does not seem to be affected by concurrency to either GHA (with a cache) or to NVD (direct upstream). With the current default value there is no value to the more complex threading code.
• uses CompletionService to report NVD API progress more accurately

Related issues

N/A

Have test cases been added to cover the new functionality?

yes

[Copilot]

🟡 Changes recommended

Reversed executor pool sizes misapply the configured download limit and processing concurrency cap.

1 open issue

• Correct executor pool size assignments · New

What changed in this PR

This PR refactors NVD datafeed updates to handle downloads in completion order, avoiding waits on earlier downloads while preserving modified-feed processing last.

Changes:

• Use completion services to coordinate downloads and processing.
• Separate downloading from processor submission.
• Sort feed scheduling and mark modified-feed processors for deferred execution.

File	Description
core/​src/​main/​java/​org/​owasp/​dependencycheck/​data/​update/​NvdApiDataSource.java	Coordinates completion-order handling and processes the modified feed last.
core/​src/​main/​java/​org/​owasp/​dependencycheck/​data/​update/​nvd/​api/​NvdApiProcessor.java	Adds a flag identifying processors that should be delayed.
core/​src/​main/​java/​org/​owasp/​dependencycheck/​data/​update/​nvd/​api/​DownloadTask.java	Returns an unsubmitted processor after downloading.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Transitive npm findings can overwrite direct-dependency advisory versions, causing vulnerability associations to be lost.

1 open issue

• Add regression tests for completion-order orchestration · New

1 resolved since last review

• Correct executor pool size assignments

_{Review effort: Balanced}