SQRP-346 add known_package to sca_releases table

12 files changed, 476 insertions, 1 deletions

diff --git a/server/sonar-db-dao/src/it/java/org/sonar/db/purge/PurgeDaoIT.java b/server/sonar-db-dao/src/it/java/org/sonar/db/purge/PurgeDaoIT.java
index 589145c220f..58b21ee2c96 100644
--- a/server/sonar-db-dao/src/it/java/org/sonar/db/purge/PurgeDaoIT.java
+++ b/server/sonar-db-dao/src/it/java/org/sonar/db/purge/PurgeDaoIT.java
@@ -1979,6 +1979,7 @@ oldCreationDate));
       "version", "1.0",
       "license_expression", "MIT",
       "known", true,
+      "known_package", true,
       "created_at", 0L, "updated_at", 0L);
     db.executeInsert("sca_releases", merge(releaseBase, Map.of("uuid", "release-uuid1", "component_uuid", branch1Uuid)));
     db.executeInsert("sca_releases", merge(releaseBase, Map.of("uuid", "release-uuid2", "component_uuid", branch2Uuid)));
diff --git a/server/sonar-db-dao/src/schema/schema-sq.ddl b/server/sonar-db-dao/src/schema/schema-sq.ddl
index 33f9b380ce5..4bbc5c40fd7 100644
--- a/server/sonar-db-dao/src/schema/schema-sq.ddl
+++ b/server/sonar-db-dao/src/schema/schema-sq.ddl
@@ -1096,7 +1096,8 @@ CREATE TABLE "SCA_RELEASES"(
     "CREATED_AT" BIGINT NOT NULL,
     "UPDATED_AT" BIGINT NOT NULL,
     "NEW_IN_PULL_REQUEST" BOOLEAN DEFAULT FALSE NOT NULL,
-    "DECLARED_LICENSE_EXPRESSION" CHARACTER VARYING(400) DEFAULT 'NOASSERTION' NOT NULL
+    "DECLARED_LICENSE_EXPRESSION" CHARACTER VARYING(400) DEFAULT 'NOASSERTION' NOT NULL,
+    "KNOWN_PACKAGE" BOOLEAN NOT NULL
 );
 ALTER TABLE "SCA_RELEASES" ADD CONSTRAINT "PK_SCA_RELEASES" PRIMARY KEY("UUID");
 CREATE INDEX "SCA_RELEASES_COMP_UUID_UUID" ON "SCA_RELEASES"("COMPONENT_UUID" NULLS FIRST, "UUID" NULLS FIRST);
diff --git a/server/sonar-db-migration/src/it/java/org/sonar/server/platform/db/migration/version/v202503/AddKnownPackageToScaReleasesTableIT.java b/server/sonar-db-migration/src/it/java/org/sonar/server/platform/db/migration/version/v202503/AddKnownPackageToScaReleasesTableIT.java
new file mode 100644
index 00000000000..8ae1be4cb24
--- /dev/null
+++ b/server/sonar-db-migration/src/it/java/org/sonar/server/platform/db/migration/version/v202503/AddKnownPackageToScaReleasesTableIT.java
@@ -0,0 +1,53 @@
+/*
+ * SonarQube
+ * Copyright (C) 2009-2025 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+package org.sonar.server.platform.db.migration.version.v202503;
+
+import java.sql.SQLException;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.RegisterExtension;
+import org.sonar.db.MigrationDbTester;
+import org.sonar.server.platform.db.migration.step.DdlChange;
+
+import static java.sql.Types.BOOLEAN;
+import static org.sonar.db.MigrationDbTester.createForMigrationStep;
+
+class AddKnownPackageToScaReleasesTableIT {
+  private static final String TABLE_NAME = "sca_releases";
+  private static final String COLUMN_NAME = "known_package";
+
+  @RegisterExtension
+  public final MigrationDbTester db = createForMigrationStep(AddKnownPackageToScaReleasesTable.class);
+  private final DdlChange underTest = new AddKnownPackageToScaReleasesTable(db.database());
+
+  @Test
+  void execute_shouldAddColumn() throws SQLException {
+    db.assertColumnDoesNotExist(TABLE_NAME, COLUMN_NAME);
+    underTest.execute();
+    db.assertColumnDefinition(TABLE_NAME, COLUMN_NAME, BOOLEAN, null, true);
+  }
+
+  @Test
+  void execute_shouldBeReentrant() throws SQLException {
+    db.assertColumnDoesNotExist(TABLE_NAME, COLUMN_NAME);
+    underTest.execute();
+    underTest.execute();
+    db.assertColumnDefinition(TABLE_NAME, COLUMN_NAME, BOOLEAN, null, true);
+  }
+}
diff --git a/server/sonar-db-migration/src/it/java/org/sonar/server/platform/db/migration/version/v202503/PopulateKnownPackageColumnForScaReleasesTableIT.java b/server/sonar-db-migration/src/it/java/org/sonar/server/platform/db/migration/version/v202503/PopulateKnownPackageColumnForScaReleasesTableIT.java
new file mode 100644
index 00000000000..bd28fffad9e
--- /dev/null
+++ b/server/sonar-db-migration/src/it/java/org/sonar/server/platform/db/migration/version/v202503/PopulateKnownPackageColumnForScaReleasesTableIT.java
@@ -0,0 +1,103 @@
+/*
+ * SonarQube
+ * Copyright (C) 2009-2025 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+package org.sonar.server.platform.db.migration.version.v202503;
+
+import java.sql.SQLException;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.RegisterExtension;
+import org.sonar.db.MigrationDbTester;
+import org.sonar.server.platform.db.migration.step.DataChange;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.sonar.db.MigrationDbTester.createForMigrationStep;
+
+class PopulateKnownPackageColumnForScaReleasesTableIT {
+  private static final String COLUMN_NAME = "known_package";
+
+  @RegisterExtension
+  public final MigrationDbTester db = createForMigrationStep(PopulateKnownPackageColumnForScaReleasesTable.class);
+  private final DataChange underTest = new PopulateKnownPackageColumnForScaReleasesTable(db.database());
+
+  @Test
+  void execute_doesNotCreateRecords() throws SQLException {
+    underTest.execute();
+    assertThat(db.countSql("select count(*) from sca_releases")).isZero();
+  }
+
+  @Test
+  void execute_whenPackageKnownNull_updatesKnownTrueToPackageKnownTrue() throws SQLException {
+    boolean known = true;
+    Boolean packageKnown = null;
+    insertRelease("1", known, packageKnown);
+
+    assertThat(db.selectFirst("select * from sca_releases where uuid = '%s'".formatted("scaReleaseUuid1"))).containsEntry(COLUMN_NAME, packageKnown);
+    underTest.execute();
+    assertThat(db.selectFirst("select * from sca_releases where uuid = '%s'".formatted("scaReleaseUuid1"))).containsEntry(COLUMN_NAME, known);
+  }
+
+  @Test
+  void execute_whenPackageKnownNull_updatesKnownFalseToPackageKnownFalse() throws SQLException {
+    boolean known = false;
+    Boolean packageKnown = null;
+    insertRelease("1", known, packageKnown);
+
+    assertThat(db.selectFirst("select * from sca_releases where uuid = '%s'".formatted("scaReleaseUuid1"))).containsEntry(COLUMN_NAME, packageKnown);
+    underTest.execute();
+    assertThat(db.selectFirst("select * from sca_releases where uuid = '%s'".formatted("scaReleaseUuid1"))).containsEntry(COLUMN_NAME, known);
+  }
+
+  @Test
+  void execute_whenPackageKnownNotNull_doesNotUpdatePackageKnown() throws SQLException {
+    boolean known = false;
+    Boolean packageKnown = true;
+    insertRelease("1", known, packageKnown);
+
+    assertThat(db.selectFirst("select * from sca_releases where uuid = '%s'".formatted("scaReleaseUuid1"))).containsEntry(COLUMN_NAME, packageKnown);
+    underTest.execute();
+    assertThat(db.selectFirst("select * from sca_releases where uuid = '%s'".formatted("scaReleaseUuid1"))).containsEntry(COLUMN_NAME, packageKnown);
+  }
+
+  @Test
+  void execute_resultsInNoNullPackageKnown() throws SQLException {
+    insertRelease("1", true, null);
+    insertRelease("2", false, null);
+    insertRelease("3", false, false);
+
+    underTest.execute();
+    assertThat(db.countSql("select count(*) from sca_releases where known_package is null")).isZero();
+  }
+
+  private void insertRelease(String suffix, boolean known, Boolean knownPackage) {
+    db.executeInsert("sca_releases",
+      "uuid", "scaReleaseUuid" + suffix,
+      "component_uuid", "componentUuid" + suffix,
+      "package_url", "packageUrl",
+      "package_manager", "MAVEN",
+      "package_name", "packageName" + suffix,
+      "version", "1.0.0",
+      "license_expression", "MIT",
+      "declared_license_expression", "MIT",
+      "known", known,
+      "new_in_pull_request", false,
+      "known_package", knownPackage,
+      "updated_at", 1L,
+      "created_at", 2L);
+  }
+}
diff --git a/server/sonar-db-migration/src/it/java/org/sonar/server/platform/db/migration/version/v202503/UpdateKnownPackageColumnNotNullableIT.java b/server/sonar-db-migration/src/it/java/org/sonar/server/platform/db/migration/version/v202503/UpdateKnownPackageColumnNotNullableIT.java
new file mode 100644
index 00000000000..d0b271cfbb3
--- /dev/null
+++ b/server/sonar-db-migration/src/it/java/org/sonar/server/platform/db/migration/version/v202503/UpdateKnownPackageColumnNotNullableIT.java
@@ -0,0 +1,53 @@
+/*
+ * SonarQube
+ * Copyright (C) 2009-2025 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+package org.sonar.server.platform.db.migration.version.v202503;
+
+import java.sql.SQLException;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.RegisterExtension;
+import org.sonar.db.MigrationDbTester;
+import org.sonar.server.platform.db.migration.step.DdlChange;
+
+import static java.sql.Types.BOOLEAN;
+import static org.sonar.db.MigrationDbTester.createForMigrationStep;
+
+class UpdateKnownPackageColumnNotNullableIT {
+  private static final String TABLE_NAME = "sca_releases";
+  private static final String COLUMN_NAME = "known_package";
+
+  @RegisterExtension
+  public final MigrationDbTester db = createForMigrationStep(UpdateKnownPackageColumnNotNullable.class);
+  private final DdlChange underTest = new UpdateKnownPackageColumnNotNullable(db.database());
+
+  @Test
+  void execute_shouldUpdateColumn() throws SQLException {
+    db.assertColumnDefinition(TABLE_NAME, COLUMN_NAME, BOOLEAN, null, true);
+    underTest.execute();
+    db.assertColumnDefinition(TABLE_NAME, COLUMN_NAME, BOOLEAN, null, false);
+  }
+
+  @Test
+  void execute_shouldBeReentrant() throws SQLException {
+    db.assertColumnDefinition(TABLE_NAME, COLUMN_NAME, BOOLEAN, null, true);
+    underTest.execute();
+    underTest.execute();
+    db.assertColumnDefinition(TABLE_NAME, COLUMN_NAME, BOOLEAN, null, false);
+  }
+}
diff --git a/server/sonar-db-migration/src/main/java/org/sonar/server/platform/db/migration/MigrationConfigurationModule.java b/server/sonar-db-migration/src/main/java/org/sonar/server/platform/db/migration/MigrationConfigurationModule.java
index a4ea57f9d35..fdfcd97907a 100644
--- a/server/sonar-db-migration/src/main/java/org/sonar/server/platform/db/migration/MigrationConfigurationModule.java
+++ b/server/sonar-db-migration/src/main/java/org/sonar/server/platform/db/migration/MigrationConfigurationModule.java
@@ -30,6 +30,7 @@ import org.sonar.server.platform.db.migration.step.MigrationStepsProvider;
 import org.sonar.server.platform.db.migration.version.v00.DbVersion00;
 import org.sonar.server.platform.db.migration.version.v202501.DbVersion202501;
 import org.sonar.server.platform.db.migration.version.v202502.DbVersion202502;
+import org.sonar.server.platform.db.migration.version.v202503.DbVersion202503;
 
 public class MigrationConfigurationModule extends Module {
   @Override
@@ -40,6 +41,7 @@ public class MigrationConfigurationModule extends Module {
       DbVersion00.class,
       DbVersion202501.class,
       DbVersion202502.class,
+      DbVersion202503.class,
 
       // migration steps
       MigrationStepRegistryImpl.class,
diff --git a/server/sonar-db-migration/src/main/java/org/sonar/server/platform/db/migration/version/v202503/AddKnownPackageToScaReleasesTable.java b/server/sonar-db-migration/src/main/java/org/sonar/server/platform/db/migration/version/v202503/AddKnownPackageToScaReleasesTable.java
new file mode 100644
index 00000000000..9921d9dddea
--- /dev/null
+++ b/server/sonar-db-migration/src/main/java/org/sonar/server/platform/db/migration/version/v202503/AddKnownPackageToScaReleasesTable.java
@@ -0,0 +1,52 @@
+/*
+ * SonarQube
+ * Copyright (C) 2009-2025 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+package org.sonar.server.platform.db.migration.version.v202503;
+
+import java.sql.SQLException;
+import org.sonar.db.Database;
+import org.sonar.server.platform.db.migration.def.BooleanColumnDef;
+import org.sonar.server.platform.db.migration.sql.AddColumnsBuilder;
+import org.sonar.server.platform.db.migration.step.DdlChange;
+
+import static org.sonar.db.DatabaseUtils.tableColumnExists;
+
+public class AddKnownPackageToScaReleasesTable extends DdlChange {
+  static final String TABLE_NAME = "sca_releases";
+  static final String COLUMN_NAME = "known_package";
+
+  public AddKnownPackageToScaReleasesTable(Database db) {
+    super(db);
+  }
+
+  @Override
+  public void execute(Context context) throws SQLException {
+    try (var connection = getDatabase().getDataSource().getConnection()) {
+      if (!tableColumnExists(connection, TABLE_NAME, COLUMN_NAME)) {
+        var columnDef = BooleanColumnDef.newBooleanColumnDefBuilder()
+          .setColumnName(COLUMN_NAME)
+          .build();
+
+        context.execute(new AddColumnsBuilder(getDialect(), TABLE_NAME)
+          .addColumn(columnDef)
+          .build());
+      }
+    }
+  }
+}
diff --git a/server/sonar-db-migration/src/main/java/org/sonar/server/platform/db/migration/version/v202503/DbVersion202503.java b/server/sonar-db-migration/src/main/java/org/sonar/server/platform/db/migration/version/v202503/DbVersion202503.java
new file mode 100644
index 00000000000..d88a0e0d429
--- /dev/null
+++ b/server/sonar-db-migration/src/main/java/org/sonar/server/platform/db/migration/version/v202503/DbVersion202503.java
@@ -0,0 +1,43 @@
+/*
+ * SonarQube
+ * Copyright (C) 2009-2025 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+package org.sonar.server.platform.db.migration.version.v202503;
+
+import org.sonar.server.platform.db.migration.step.MigrationStepRegistry;
+import org.sonar.server.platform.db.migration.version.DbVersion;
+
+// ignoring bad number formatting, as it's indented that we align the migration numbers to SQ versions
+@SuppressWarnings("java:S3937")
+public class DbVersion202503 implements DbVersion {
+
+  /**
+   * We use the start of the 10.X cycle as an opportunity to align migration numbers with the SQ version number.
+   * Please follow this pattern:
+   * 2025_03_000
+   * 2025_03_001
+   * 2025_03_002
+   */
+  @Override
+  public void addSteps(MigrationStepRegistry registry) {
+    registry
+      .add(2025_03_000, "Add known_package column to SCA releases", AddKnownPackageToScaReleasesTable.class)
+      .add(2025_03_001, "Populate known_package column to SCA releases", PopulateKnownPackageColumnForScaReleasesTable.class)
+      .add(2025_03_002, "Update known_package on SCA release to be not nullable", UpdateKnownPackageColumnNotNullable.class);
+  }
+}
\ No newline at end of file
diff --git a/server/sonar-db-migration/src/main/java/org/sonar/server/platform/db/migration/version/v202503/PopulateKnownPackageColumnForScaReleasesTable.java b/server/sonar-db-migration/src/main/java/org/sonar/server/platform/db/migration/version/v202503/PopulateKnownPackageColumnForScaReleasesTable.java
new file mode 100644
index 00000000000..564e4473156
--- /dev/null
+++ b/server/sonar-db-migration/src/main/java/org/sonar/server/platform/db/migration/version/v202503/PopulateKnownPackageColumnForScaReleasesTable.java
@@ -0,0 +1,51 @@
+/*
+ * SonarQube
+ * Copyright (C) 2009-2025 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+package org.sonar.server.platform.db.migration.version.v202503;
+
+import java.sql.SQLException;
+import org.sonar.db.Database;
+import org.sonar.server.platform.db.migration.step.DataChange;
+import org.sonar.server.platform.db.migration.step.MassUpdate;
+
+public class PopulateKnownPackageColumnForScaReleasesTable extends DataChange {
+
+  private static final String SELECT_QUERY = "select known, uuid from sca_releases where known_package is null";
+  private static final String UPDATE_QUERY = "update sca_releases set known_package = ? where uuid = ?";
+
+  public PopulateKnownPackageColumnForScaReleasesTable(Database db) {
+    super(db);
+  }
+
+  @Override
+  protected void execute(Context context) throws SQLException {
+    MassUpdate massUpdate = context.prepareMassUpdate();
+    massUpdate.select(SELECT_QUERY);
+    massUpdate.update(UPDATE_QUERY);
+
+    massUpdate.execute((row, update, index) -> {
+      update
+        // Set known_package from known
+        .setBoolean(1, row.getBoolean(1))
+        // Set uuid from uuid
+        .setString(2, row.getString(2));
+      return true;
+    });
+  }
+}
diff --git a/server/sonar-db-migration/src/main/java/org/sonar/server/platform/db/migration/version/v202503/UpdateKnownPackageColumnNotNullable.java b/server/sonar-db-migration/src/main/java/org/sonar/server/platform/db/migration/version/v202503/UpdateKnownPackageColumnNotNullable.java
new file mode 100644
index 00000000000..457288f1f66
--- /dev/null
+++ b/server/sonar-db-migration/src/main/java/org/sonar/server/platform/db/migration/version/v202503/UpdateKnownPackageColumnNotNullable.java
@@ -0,0 +1,53 @@
+/*
+ * SonarQube
+ * Copyright (C) 2009-2025 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+package org.sonar.server.platform.db.migration.version.v202503;
+
+import java.sql.SQLException;
+import org.sonar.db.Database;
+import org.sonar.server.platform.db.migration.def.BooleanColumnDef;
+import org.sonar.server.platform.db.migration.sql.AlterColumnsBuilder;
+import org.sonar.server.platform.db.migration.step.DdlChange;
+
+import static org.sonar.db.DatabaseUtils.tableColumnExists;
+
+public class UpdateKnownPackageColumnNotNullable extends DdlChange {
+  static final String TABLE_NAME = "sca_releases";
+  static final String COLUMN_NAME = "known_package";
+
+  public UpdateKnownPackageColumnNotNullable(Database db) {
+    super(db);
+  }
+
+  @Override
+  public void execute(Context context) throws SQLException {
+    try (var connection = getDatabase().getDataSource().getConnection()) {
+      if (tableColumnExists(connection, TABLE_NAME, COLUMN_NAME)) {
+        var columnDef = BooleanColumnDef.newBooleanColumnDefBuilder()
+          .setColumnName(COLUMN_NAME)
+          .setIsNullable(false)
+          .build();
+
+        context.execute(new AlterColumnsBuilder(getDialect(), TABLE_NAME)
+          .updateColumn(columnDef)
+          .build());
+      }
+    }
+  }
+}
diff --git a/server/sonar-db-migration/src/main/java/org/sonar/server/platform/db/migration/version/v202503/package-info.java b/server/sonar-db-migration/src/main/java/org/sonar/server/platform/db/migration/version/v202503/package-info.java
new file mode 100644
index 00000000000..cc36bc37f03
--- /dev/null
+++ b/server/sonar-db-migration/src/main/java/org/sonar/server/platform/db/migration/version/v202503/package-info.java
@@ -0,0 +1,23 @@
+/*
+ * SonarQube
+ * Copyright (C) 2009-2025 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+@ParametersAreNonnullByDefault
+package org.sonar.server.platform.db.migration.version.v202503;
+
+import javax.annotation.ParametersAreNonnullByDefault;
diff --git a/server/sonar-db-migration/src/test/java/org/sonar/server/platform/db/migration/version/v202503/DbVersion202503Test.java b/server/sonar-db-migration/src/test/java/org/sonar/server/platform/db/migration/version/v202503/DbVersion202503Test.java
new file mode 100644
index 00000000000..e1480dd9844
--- /dev/null
+++ b/server/sonar-db-migration/src/test/java/org/sonar/server/platform/db/migration/version/v202503/DbVersion202503Test.java
@@ -0,0 +1,40 @@
+/*
+ * SonarQube
+ * Copyright (C) 2009-2025 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+package org.sonar.server.platform.db.migration.version.v202503;
+
+import org.junit.jupiter.api.Test;
+
+import static org.sonar.server.platform.db.migration.version.DbVersionTestUtils.verifyMigrationNotEmpty;
+import static org.sonar.server.platform.db.migration.version.DbVersionTestUtils.verifyMinimumMigrationNumber;
+
+class DbVersion202503Test {
+
+  private final DbVersion202503 underTest = new DbVersion202503();
+
+  @Test
+  void migrationNumber_starts_at_2025_03_000() {
+    verifyMinimumMigrationNumber(underTest, 2025_03_000);
+  }
+
+  @Test
+  void verify_migration_is_not_empty() {
+    verifyMigrationNotEmpty(underTest);
+  }
+}