XRAY: DB Sync V3 Migration Fails with “Custom Vulnerabilities or Components Exist” Error

Introduction 
During the DB Sync v1 to v3 migration process, the migration may fail with the following error:

 

This issue occurs when the migration detects custom vulnerabilities or components in the Xray DB that do not meet the expected criteria for migration.
In earlier versions of Xray, custom vulnerabilities and components were stored in public tables used by the DB Sync process. As part of the migration to DB Sync v3, validation checks are performed to ensure that only supported data is migrated safely. If certain thresholds are not met, the migration is blocked to prevent unintended data loss.

Goal
This article will guide you through identifying and resolving migration failures caused by custom vulnerabilities and components.
It will help you:

• Understand why the migration fails
• Identify custom vulnerabilities and components in your database
• Configure Xray to safely proceed with the migration

Resolution 
Step 1: Validate Existing Custom Vulnerabilities and Components
Run the following database queries on the Xray database to assess the current state.

Count custom vulnerabilities in public table:

SELECT count(*) FROM public_vulnerabilities WHERE vuln_id NOT ILIKE 'xray-%' OR provider NOT ILIKE 'jfrog';

Count custom vulnerabilities in public table:

SELECT count(*) FROM public_vulnerabilities WHERE vuln_id NOT ILIKE 'xray-%' OR provider NOT ILIKE 'jfrog';

Count npm audit vulnerabilities (X):

SELECT COUNT(*) FROM public_vulnerabilities WHERE vuln_id ILIKE 'xray-n%';

Count custom vulnerabilities in user tables (Y):

SELECT COUNT(*) FROM custom_vulnerabilities;

Count custom components in user tables (Z):

SELECT COUNT(*) FROM custom_components;

Vulnerabilities with:

• ID prefix “XRAY-”, or
• Provider “JFrog”
  are considered valid for standard migration.

Any vulnerabilities outside these criteria are treated as custom.
If more than 10 custom vulnerabilities are detected, the migration will fail automatically as a safeguard.

Step 2: Update system.yaml Configuration
To allow the migration to proceed, configure the allowed thresholds in the System.Yaml file using the values obtained from the queries.

server:
  dbSync:
    migration:
      maxCustomVulnerabilitiesAllowed: Y
      maxNpmAuditVulnerabilitiesAllowed: X
      maxCustomComponentsAllowed: Z

Replace:

• X : Count of npm audit vulnerabilities
• Y : Count of custom vulnerabilities
• Z : Count of custom components

Step 3: Apply Changes and Retry Migration

• Save the updated System.yaml file.
• Make sure the below prerequisites are met,
  
   
• Restart the Xray service
• Re-run the DB Sync migration

Conclusion 
The DB Sync v3 migration may fail if custom vulnerabilities or components exceed predefined thresholds. This behavior is intentional to prevent accidental data loss.
By identifying the number of custom entries and updating the System.yaml configuration accordingly, you can safely proceed with the migration.