fix: issue 5452 - ConcurrentModificationException in NodePackageAnalyzer.processDependencies - adding synchronized block (#6501)

Co-authored-by: Grzegorz Dabrowski <[email protected]>

Author: dabal

core/src/main/java/org/owasp/dependencycheck/analyzer/NodePackageAnalyzer.java

@@ -458,18 +458,19 @@ private void processDependencies(JsonObject json, File baseDir, File rootFile,
                         LOGGER.debug("Unable to build package url for `" + packagePath + "`", ex);
                     }
                 }
-
-                final Dependency existing = findDependency(engine, name, version);
-                if (existing != null) {
-                    if (existing.isVirtual()) {
-                        DependencyMergingAnalyzer.mergeDependencies(child, existing, null);
-                        engine.removeDependency(existing);
-                        engine.addDependency(child);
+                synchronized (this) {
+                    final Dependency existing = findDependency(engine, name, version);
+                    if (existing != null) {
+                        if (existing.isVirtual()) {
+                            DependencyMergingAnalyzer.mergeDependencies(child, existing, null);
+                            engine.removeDependency(existing);
+                            engine.addDependency(child);
+                        } else {
+                            DependencyBundlingAnalyzer.mergeDependencies(existing, child, null);
+                        }
                     } else {
-                        DependencyBundlingAnalyzer.mergeDependencies(existing, child, null);
+                        engine.addDependency(child);
                     }
-                } else {
-                    engine.addDependency(child);
                 }
             }
         }