fix: Make AntTaskHolder thread-safe using ThreadLocal

ant/src/main/java/org/owasp/dependencycheck/ant/logging/AntTaskHolder.java

@@ -22,10 +22,13 @@
 /**
  * Holds a reference to the current Ant Task for logging. Replaces the old
  * StaticLoggerBinder singleton pattern used with SLF4J 1.x.
+ * <p>
+ * Uses ThreadLocal to ensure thread-safety when Ant runs tasks in parallel.
+ * </p>
  */
 public final class AntTaskHolder {
 
-    private static volatile Task task;
+    private static final ThreadLocal<Task> task = new ThreadLocal<>();
 
     private AntTaskHolder() {
     }
@@ -36,7 +39,7 @@ private AntTaskHolder() {
      * @param t the Ant task
      */
     public static void setTask(Task t) {
-        task = t;
+        task.set(t);
     }
 
     /**
@@ -45,6 +48,15 @@ public static void setTask(Task t) {
      * @return the Ant task, or null if not set
      */
     public static Task getTask() {
-        return task;
+        return task.get();
+    }
+
+    /**
+     * Removes the current Ant task from the thread-local storage.
+     * This should be called when the task completes to prevent memory leaks
+     * in environments with thread pooling.
+     */
+    public static void remove() {
+        task.remove();
     }
 }

ant/src/main/java/org/owasp/dependencycheck/taskdefs/Purge.java

@@ -121,6 +121,7 @@ public final void execute() throws BuildException {
             executeWithContextClassloader();
         } finally {
             Thread.currentThread().setContextClassLoader(current);
+            AntTaskHolder.remove();
         }
     }