What's Changed

Bug Fixes 🐛

• Backport: Accept pipe-separated UUIDs on dependency graph path by @nscuro in #7745
• Backport: Resolve BOM upload tokens to root workflow runs only by @nscuro in #7746
• Backport: Skip analyzer when checking if enabled fails by @nscuro in #7747
• Backport: Fix collection tag missing in project lookup response by @nscuro in #7748
• Backport: Fix BOM validation failing when XML contains CDATA by @nscuro in #7750
• Backport: Map unknown or retired vulnerability sources to UNKNOWN in v4-migrator by @nscuro in #7752
• Backport: Remove eMudhra from container image cacerts by @nscuro in #7760
• Backport: Fix tag maintenance failing when tag is used only by collection projects by @nscuro in #7761
• Backport: Fix ineffective ACL check for /v1/finding/project/{uuid}/analyze by @nscuro in #7777

Dependency Updates 🤖

• Bump com.networknt:json-schema-validator from 2.0.4 to 2.0.7 by @dependabot[bot] in #7629
• Bump org.glassfish.jersey:jersey-bom from 4.0.2 to 4.0.3 by @dependabot[bot] in #7630
• Bump oasdiff/oasdiff-action/breaking from 0.1.17 to 0.1.18 by @dependabot[bot] in #7634
• Bump io.dropwizard.flywaydb:flyway-bom from 13.8.0 to 13.8.1 by @dependabot[bot] in #7639
• Bump com.networknt:json-schema-validator from 2.0.7 to 2.0.8 by @dependabot[bot] in #7640
• Bump org.metaeffekt.core:ae-security from 0.157.2 to 0.158.0 by @dependabot[bot] in #7660
• Bump io.dropwizard.flywaydb:flyway-bom from 13.8.1 to 13.9.0 by @dependabot[bot] in #7661
• Bump commons-codec:commons-codec from 1.22.1 to 1.23.0 by @dependabot[bot] in #7662
• Bump com.github.luben:zstd-jni from 1.5.7-20 to 1.5.7-21 by @dependabot[bot] in #7663
• Bump io.github.nscuro:versatile-core from 0.26.0 to 0.26.1 by @dependabot[bot] in #7678
• Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.4 to 5.6.5 by @dependabot[bot] in #7679
• Bump lib.jetty.version from 12.1.13 to 12.1.14 by @dependabot[bot] in #7680
• Bump net.javacrumbs.json-unit:json-unit-assertj from 6.2.0 to 6.3.0 by @dependabot[bot] in #7681
• Bump org.jetbrains.kotlin:kotlin-bom from 2.4.20 to 2.4.21 by @dependabot[bot] in #7688
• Bump org.openapitools:openapi-generator-maven-plugin from 7.25.0 to 7.26.0 by @dependabot[bot] in #7689
• Bump com.github.luben:zstd-jni from 1.5.7-21 to 1.5.7-22 by @dependabot[bot] in #7690
• Bump io.github.openfeign:feign-bom from 13.15 to 13.16 by @dependabot[bot] in #7692
• Bump org.apache.kafka:kafka-clients from 4.3.1 to 4.4.0 by @dependabot[bot] in #7691
• Bump org.postgresql:postgresql from 42.7.13 to 42.7.14 by @dependabot[bot] in #7701
• Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.3 to 3.10.4 by @dependabot[bot] in #7702
• Bump io.github.openfeign:feign-bom from 13.16 to 13.17 by @dependabot[bot] in #7703
• Bump actions/download-artifact from 8.0.1 to 8.0.2 by @dependabot[bot] in #7719
• Bump org.metaeffekt.core:ae-security from 0.158.0 to 0.159.0 by @dependabot[bot] in #7715
• Bump com.github.luben:zstd-jni from 1.5.7-22 to 1.5.7-23 by @dependabot[bot] in #7716
• Bump the codeql group with 2 updates by @dependabot[bot] in #7717
• Bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #7718
• Bump com.github.ben-manes.caffeine:caffeine from 3.3.0 to 3.3.1 by @dependabot[bot] in #7727
• Bump lib.byte-buddy.version from 1.18.14 to 1.18.15 by @dependabot[bot] in #7729
• Bump com.microsoft.sqlserver:mssql-jdbc from 13.6.0.jre11 to 13.6.1.jre11 by @dependabot[bot] in #7735
• Backport: Bump Alpine base image to 3.24.3 by @nscuro in #7766
• Bump io.prometheus:prometheus-metrics-bom from 1.9.0 to 1.10.0 by @dependabot[bot] in #7769
• Bump com.google.crypto.tink:tink from 1.23.0 to 1.24.0 by @dependabot[bot] in #7772
• Backport: Bump cyclonedx-core-java to 13.4.0 by @nscuro in #7778

Other Changes

• Backport: Make test coverage reporting more efficient by @nscuro in #7749

Full Changelog: 5.2.0...5.2.1

For official releases, refer to Dependency Track Docs >> Changelogs for information about improvements and upgrade notes.
If additional details are required, consult the closed issues for this release milestone.

# SHA1
f39f3cc9ac552200902e932029b54ddc5a7ac2bd  dependency-track-apiserver.jar
0050a4b1174d7a9127d00254624c6772b21175a8  dependency-track-bundled.jar
# SHA256
3a6866f8919864dca70c50f438874d0c0396c27077d3ef8e4d358d940459eeb5  dependency-track-apiserver.jar
421f4cb919f8e19babd13a0fe6380000fcf4938ae31009503eb34dcf65146753  dependency-track-bundled.jar
# SHA512
ac440fcbf57e6cb6672bf4b396188ffa07a34b293d399d502c4f8ed00b9c09784c4b206c1492e4559063167881e16ceaaea65a7c0e8abc3622f820fbd2450b43  dependency-track-apiserver.jar
d8950d1abb785787553692e2bb3cbe463992077fd770e1498f991eb93b6f111d47046ee6dfd7aaea1f73a49765227e07883202304fb0b103c3ae75040fb5565e  dependency-track-bundled.jar

What's Changed

Bug Fixes 🐛

• log suppression when creating new violation analysis by @stohrendorf in #6011
• Backport: Fix BOM validation failing when XML contains CDATA by @nscuro in #7751
• Backport: Remove eMudhra from container image cacerts by @nscuro in #7762

Dependency Updates 🤖

• Bump com.fasterxml.woodstox:woodstox-core from 7.2.2 to 7.3.0 by @dependabot[bot] in #7599
• Bump io.github.ascopes:protobuf-maven-plugin from 5.1.10 to 5.1.11 by @dependabot[bot] in #7622
• Bump eclipse-temurin from 25.0.4_7-jre-jammy to 25.0.4.1_1-jre-jammy in /src/main/docker by @dependabot[bot] in #7637
• Bump io.github.nscuro:versatile-core from 0.26.0 to 0.26.1 by @dependabot[bot] in #7658
• Bump org.metaeffekt.core:ae-security from 0.157.2 to 0.158.0 by @dependabot[bot] in #7659
• Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.4 to 5.6.5 by @dependabot[bot] in #7674
• Bump debian from 5bc3287 to eb593cf in /src/main/docker by @dependabot[bot] in #7675
• Bump org.postgresql:postgresql from 42.7.13 to 42.7.14 by @dependabot[bot] in #7683
• Bump actions/download-artifact from 8.0.1 to 8.0.2 by @dependabot[bot] in #7712
• Bump org.metaeffekt.core:ae-security from 0.158.0 to 0.159.0 by @dependabot[bot] in #7713
• Bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #7714
• Bump com.google.cloud.sql:mysql-socket-factory-connector-j-8 from 1.30.0 to 1.30.1 by @dependabot[bot] in #7724
• Bump com.google.cloud.sql:postgres-socket-factory from 1.30.0 to 1.30.1 by @dependabot[bot] in #7726
• Bump com.google.cloud.sql:cloud-sql-connector-jdbc-sqlserver from 1.30.0 to 1.30.1 by @dependabot[bot] in #7725
• Bump com.microsoft.sqlserver:mssql-jdbc from 13.6.0.jre11 to 13.6.1.jre11 by @dependabot[bot] in #7733
• Backport: Bump Alpine base image to 3.24.3 by @nscuro in #7767
• Bump eclipse-temurin from 25777ac to e0d8c47 in /src/main/docker by @dependabot[bot] in #7768
• Backport: Bump cyclonedx-core-java to 13.4.0 by @nscuro in #7779
• Bump bundled frontend to 4.14.6 by @nscuro in #7780

Other Changes

• Add changelog for 4.14.5 by @nscuro in #7594
• Fix link to services.bom.json in docs FAQ by @nscuro in #7753

Full Changelog: 4.14.5...4.14.6

What's Changed

Enhancements 🚀

• Make the Trivy API token optional by @arjavdongaonkar in #7178
• Tweak apiserver Dockerfile by @nscuro in #7180
• Make Dockerfile more layer cache friendly by @nscuro in #7181
• Allow operators to load external JDBC drivers by @nscuro in #7182
• Support inverted tag matching in policy scope by @arjavdongaonkar in #7176
• Refactor component metrics computation to avoid pathological query plans by @nscuro in #7214
• Add analyzer_identity in NEW_VULNERABILITY notifications by @sahibamittal in #7206
• Fix N+1 queries in dependency graph endpoint by @nscuro in #7275
• Improve efficiency of is_dependency_of and is_exclusive_dependency_of CEL functions by @nscuro in #7276
• Avoid redundant component iteration during dependency graph export by @nscuro in #7277
• Add checksum matching support for Snyk vuln analyzer by @mehab in #6835
• Migrate cargo package metadata resolver to sparse index by @nscuro in #7315
• Implement service accounts by @nscuro in #7293
• Implement service account API key expiry by @nscuro in #7317
• Sign webhook payloads with HMAC-SHA256 by @adilalperenciftci in #7323
• Implement workload identity federation by @nscuro in #7330
• Make the monitoring dashboards usable outside the dev stack by @nissessenap in #7335
• Introduce outbound connection policy by @nscuro in #7449
• Integrate outbound connection policy with shared HTTP client by @nscuro in #7450
• Expose outbound connection policy to plugins by @nscuro in #7451
• Streamline JDBI mappers by @nscuro in #7466
• Support bracketed list strings in OIDC teams claim by @Akhil-1527 in #7467
• Bump spdx license list 3.29.0 by @nscuro in #7502
• Enforce a max size for BOM and VEX uploads by @nscuro in #7545
• Batch finding bulk operations and notification emission by @nscuro in #7608

Bug Fixes 🐛

• Run spotless:apply after Maven release plugin modifies them POM by @nscuro in #7138
• v4-migrator: Reconcile PROJECT collection logic and tag by @arjavdongaonkar in #7172
• v4-migrator: Dedup PROJECT_PROPERTY rows of collapsed projects by @arjavdongaonkar in #7171
• Fix PURLs without version being submitted for analysis by @nscuro in #7196
• Add option to use Snyk's per-package endpoint when batching is not available by @arjavdongaonkar in #7195
• Remove unused LDAP properties by @nscuro in #7240
• Fix management server preventing shutdown on initialization failures by @nscuro in #7278
• Fix incorrect OpenAPI docs for POST /v1/project WRT parent semantics by @nscuro in #7312
• Fix DATASOURCE_MIRRORING notifications not being emitted by @nscuro in #7313
• Fix project lookup endpoints not serving aggregate metrics for collection projects by @nscuro in #7311
• Resolve project parent before other fields in updateProject by @adityaanikam in #7262
• Treat >=0 ranges as wildcard during vers matching by @nscuro in #7329
• Fix broken link to VulnCheck token creation by @nscuro in #7347
• Accumulate mirrored VulnerableSoftware by vulnerability key by @nscuro in #7351
• Fix Checkmarx model conversion NPEs by @sahibamittal in #7352
• Fix tag binding triggering unnecessary relationship loads by @nscuro in #7353
• Fix OS package scanning for Trivy analyzer by @nscuro in #7355
• Prevent NPEs during DataNucleus L1 cache eviction by @nscuro in #7357
• Fix proxy authentication for GitHub Advisories vuln data source by @nscuro in #7356
• Fix calculated CVSSv4 score only considering base metrics by @nscuro in #7358
• Fix NVD vuln data source iteration and watermarking issues by @nscuro in #7359
• Move vuln data source mirroring off JDO by @nscuro in #7382
• Fix lack of context in NVD & OSV unexpected status code exception messages by @nscuro in #7385
• Fix invalid PURLs causing list API endpoints to fail by @nscuro in #7501
• Fix failure to match CPE with wildcard version and version range >=0 by @nscuro in #7514
• Fix internal vulns with finding attributions failing deletion by @nscuro in #7542
• PEP 503-normalize PyPI package names for vuln matching by @nscuro in #7546
• Treat NuGet package names as case-insensitive for vuln matching by @nscuro in #7547
• Fix manually assigned findings being deactivated on analysis by @nscuro in #7551
• Fix Trivy findings dropped for PURLs with URL-valued qualifiers by @nissessenap in #7581
• Consistently tolerate trailing slashes in configurable URLs by @nscuro in #7607
• Fix collection project metrics shape when children have no metrics by @nscuro in #7609
• Fix missing pagination in /v1/vulnerability/component/{uuid} by @nscuro in #7610

Dependency Updates 🤖

• Update maintenance branch in Dependabot config to 5.1.x by @nscuro in #7139
• chore(deps): Bump io.smallrye.config:smallrye-config-bom from 3.18.1 to 3.18.2 by @dependabot[bot] in #7143
• Bump squawk to 2.63.0 by @nscuro in #7150
• Pin spectral image by @nscuro in #7151
• Group CodeQL actions in Dependabot by @nscuro in #7156
• chore(deps): Bump the codeql group with 2 updates by @dependabot[bot] in #7157
• Bump com.uber.nullaway:nullaway from 0.13.8 to 0.14.0 by @dependabot[bot] in #7167
• Bump com.adobe.testing:s3mock-testcontainers from 5.1.0 to 5.2.0 by @dependabot[bot] in #7185
• Bump com.icegreen:greenmail-junit5 from 2.1.12 to 2.1.13 by @dependabot[bot] in #7184
• Bump actions/setup-java from 5.7.0 to 6.0.0 by @dependabot[bot] in #7183
• Bump org.openapitools:openapi-generator-maven-plugin from 7.24.0 to 7.25.0 by @dependabot[bot] in #7198
• Bump io.dropwizard.flywaydb:flyway-bom from 13.3.0 to 13.4.0 by @dependabot[bot] in #7215
• Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.0 to 3.10.1 by @dependabot[bot] in #7217
• Bump org.apache.felix:maven-bundle-plugin from 6.1.0 to 6.1.2 by @dependabot[bot] in #7216
• Bump the codeql gr...

What's Changed

Bug Fixes 🐛

• Backport: Fix invalid PURLs causing list API endpoints to fail by @nscuro in #7554
• Backport: Fix failure to match CPE with wildcard version and version range >=0 by @nscuro in #7555
• Backport: Fix internal vulns with finding attributions failing deletion by @nscuro in #7558
• Backport: PEP 503-normalize PyPI package names for vuln matching by @nscuro in #7559
• Backport: Fix manually assigned findings being deactivated on analysis by @nscuro in #7560
• Backport: Treat NuGet package names as case-insensitive for vuln matching by @nscuro in #7562
• Backport: Fix Trivy findings dropped for PURLs with URL-valued qualifiers by @nscuro in #7596

Dependency Updates 🤖

• Bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2 by @dependabot[bot] in #7402
• Bump org.apache.maven.plugins:maven-deploy-plugin from 3.1.4 to 3.2.0 by @dependabot[bot] in #7403
• Bump io.dropwizard.flywaydb:flyway-bom from 13.5.0 to 13.6.0 by @dependabot[bot] in #7404
• Bump io.github.jeremylong:open-vulnerability-clients from 9.0.6 to 9.0.7 by @dependabot[bot] in #7405
• Bump the codeql group with 2 updates by @dependabot[bot] in #7406
• Bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 by @dependabot[bot] in #7407
• Bump oasdiff/oasdiff-action/breaking from 0.1.15 to 0.1.16 by @dependabot[bot] in #7408
• Bump actions/setup-java from 6.0.0 to 6.0.1 by @dependabot[bot] in #7409
• Bump io.github.ascopes:protobuf-maven-plugin from 5.1.8 to 5.1.9 by @dependabot[bot] in #7416
• Bump lib.byte-buddy.version from 1.18.13 to 1.18.14 by @dependabot[bot] in #7418
• Bump org.apache.maven.plugins:maven-install-plugin from 3.1.4 to 3.2.0 by @dependabot[bot] in #7419
• Bump org.apache.felix:maven-bundle-plugin from 6.1.2 to 6.2.0 by @dependabot[bot] in #7417
• Bump io.prometheus:prometheus-metrics-bom from 1.8.0 to 1.9.0 by @dependabot[bot] in #7429
• Bump org.codehaus.mojo:exec-maven-plugin from 3.6.3 to 3.6.4 by @dependabot[bot] in #7430
• Bump io.github.nscuro:versatile-core from 0.24.0 to 0.25.0 by @dependabot[bot] in #7431
• Bump org.metaeffekt.core:ae-security from 0.157.0 to 0.157.1 by @dependabot[bot] in #7432
• Bump com.github.luben:zstd-jni from 1.5.7-16 to 1.5.7-17 by @dependabot[bot] in #7441
• Bump com.adobe.testing:s3mock-testcontainers from 5.2.0 to 5.2.2 by @dependabot[bot] in #7439
• Bump io.dropwizard.flywaydb:flyway-bom from 13.6.0 to 13.7.0 by @dependabot[bot] in #7442
• Bump io.smallrye.config:smallrye-config-bom from 3.18.2 to 3.18.3 by @dependabot[bot] in #7440
• Bump lib.protobuf-java.version from 4.36.1 to 4.36.2 by @dependabot[bot] in #7456
• Bump com.github.ben-manes.caffeine:caffeine from 3.2.4 to 3.3.0 by @dependabot[bot] in #7486
• Bump io.github.ascopes:protobuf-maven-plugin from 5.1.9 to 5.1.10 by @dependabot[bot] in #7487
• Bump com.github.luben:zstd-jni from 1.5.7-17 to 1.5.7-18 by @dependabot[bot] in #7488
• Bump com.icegreen:greenmail-junit5 from 2.1.13 to 2.1.14 by @dependabot[bot] in #7489
• Bump the codeql group with 2 updates by @dependabot[bot] in #7490
• Bump docker/setup-qemu-action from 4.3.0 to 4.4.0 by @dependabot[bot] in #7491
• Bump oasdiff/oasdiff-action/breaking from 0.1.16 to 0.1.17 by @dependabot[bot] in #7492
• Bump docker/setup-buildx-action from 4.3.0 to 4.4.1 by @dependabot[bot] in #7493
• Bump docker/build-push-action from 7.3.0 to 7.4.0 by @dependabot[bot] in #7494
• Bump org.eclipse.microprofile.config:microprofile-config-api from 3.1.1 to 3.1.2 by @dependabot[bot] in #7507
• Bump tools.jackson:jackson-bom from 3.2.2 to 3.2.3 by @dependabot[bot] in #7508
• Bump com.adobe.testing:s3mock-testcontainers from 5.2.2 to 5.2.3 by @dependabot[bot] in #7510
• Bump com.fasterxml.jackson:jackson-bom from 2.22.2 to 2.22.3 by @dependabot[bot] in #7509
• Bump org.slf4j:slf4j-bom from 2.0.19 to 2.0.20 by @dependabot[bot] in #7520
• Bump com.github.luben:zstd-jni from 1.5.7-18 to 1.5.7-19 by @dependabot[bot] in #7524
• Bump org.metaeffekt.core:ae-security from 0.157.1 to 0.157.2 by @dependabot[bot] in #7532
• Bump org.mockito:mockito-bom from 5.23.0 to 5.24.0 by @dependabot[bot] in #7531
• Bump io.dropwizard.flywaydb:flyway-bom from 13.7.0 to 13.8.0 by @dependabot[bot] in #7538
• Bump lib.logback.version from 1.6.3 to 1.6.4 by @dependabot[bot] in #7539
• Bump com.uber.nullaway:nullaway from 0.14.1 to 0.14.2 by @dependabot[bot] in #7540
• Backport: Bump versatile to 0.26.0 by @nscuro in #7556
• Bump eclipse-temurin from 25.0.4_7-jdk-alpine to 25.0.4.1_1-jdk-alpine in /apiserver/src/main/docker by @dependabot[bot] in #7575
• Bump com.tngtech.archunit:archunit-junit5 from 1.5.0 to 1.5.1 by @dependabot[bot] in #7576
• Bump org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0 by @dependabot[bot] in #7577
• Bump com.github.luben:zstd-jni from 1.5.7-19 to 1.5.7-20 by @dependabot[bot] in #7578
• Bump the codeql group with 2 updates by @dependabot[bot] in #7579
• Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.2 to 3.10.3 by @dependabot[bot] in #7589
• Bump com.h2database:h2 from 2.5.250 to 2.5.252 by @dependabot[bot] in #7590
• Bump org.jdbi:jdbi3-bom from 3.54.0 to 3.55.0 by @dependabot[bot] in #7591

Other Changes

• Backport: Improve effectiveness of caching in CI by @nscuro in #7550
• Backport: Disable caching in docker/setup-qemu-action by @nscuro in #7557

Full Changelog: 5.1.1...5.1.2

For official releases, refer to Dependency Track Docs >> Changelogs for information about improvements and upgrade notes.
If additional details are required, consult the closed issues for this release milestone.

# SHA1
16d73175e293a807409c621bf39bac1e1aaa9c2b  dependency-track-apiserver.jar
de0b87dbe7bb23d2d9bfd587ce56514820c35ded  dependency-track-bundled.jar
# SHA256
50f698fa06078f800b6ca626c05ce6190efcbadecc88d03b0d80a6e144f60055  dependency-track-apiserver.jar
9c1153fbb98b224a171121e0447abe20f085160a19445f82d36a77cd60b34733  dependency-track-bundled.jar
# SHA512
c81a3f192a92f8bebe3fe458ed140991acfc1937cda358151f5d89f82a3feedc2e334bdb537da3db603fec8dbc1d37879a20885520ff0ee96eb341d55ccb8b7e  dependency-track-apiserver.jar
c93a4a507fec4d6201c071ef0fdf655dc4819ed9a173ca737ab925ec238dd07ffab28237515cd0561e74d0630678a3dcc5267842051a07cc61388912d89007c1  dependency-track-bundled.jar

What's Changed

Bug Fixes 🐛

• Fix portfolio vulnerability analysis cache eviction by @mikael-carneholm-2-wcar in #7448
• Backport: Prevent NPEs during DataNucleus L1 cache eviction by @nscuro in #7499
• Fix NEW_VULNERABLE_DEPENDENCY notifications not including project tags by @nscuro in #7500
• Backport: PEP 503-normalize PyPI package names for vuln matching by @nscuro in #7564
• Backport: Treat NuGet package names as case-insensitive for vuln matching by @nscuro in #7565
• Backport: Fix Trivy findings dropped for PURLs with URL-valued qualifiers by @nscuro in #7592
• Backport: Fix OS package scanning for Trivy analyzer by @nscuro in #7593

Dependency Updates 🤖

• Bump alpine from 3.24.1 to 3.24.2 in /src/main/docker by @dependabot[bot] in #7338
• Bump eclipse-temurin from 20a695e to abed22b in /src/main/docker by @dependabot[bot] in #7339
• Bump com.microsoft.sqlserver:mssql-jdbc from 13.4.0.jre11 to 13.6.0.jre11 by @dependabot[bot] in #7340
• Bump io.github.nscuro:versatile-core from 0.24.0 to 0.25.0 by @dependabot[bot] in #7397
• Bump io.github.ascopes:protobuf-maven-plugin from 5.1.8 to 5.1.9 by @dependabot[bot] in #7398
• Bump actions/setup-java from 6.0.0 to 6.0.1 by @dependabot[bot] in #7399
• Bump io.github.jeremylong:open-vulnerability-clients from 9.0.6 to 9.0.7 by @dependabot[bot] in #7400
• Bump org.codehaus.mojo:exec-maven-plugin from 3.6.3 to 3.6.4 by @dependabot[bot] in #7401
• Bump org.metaeffekt.core:ae-security from 0.157.0 to 0.157.1 by @dependabot[bot] in #7427
• Bump lib.protobuf-java.version from 4.36.1 to 4.36.2 by @dependabot[bot] in #7453
• Bump debian from 0463431 to 5bc3287 in /src/main/docker by @dependabot[bot] in #7475
• Bump alpine from 31b6477 to 294b683 in /src/main/docker by @dependabot[bot] in #7476
• Bump docker/setup-buildx-action from 4.3.0 to 4.4.1 by @dependabot[bot] in #7480
• Bump com.icegreen:greenmail-junit5 from 2.1.13 to 2.1.14 by @dependabot[bot] in #7481
• Bump docker/build-push-action from 7.3.0 to 7.4.0 by @dependabot[bot] in #7483
• Bump io.github.ascopes:protobuf-maven-plugin from 5.1.9 to 5.1.10 by @dependabot[bot] in #7484
• Bump docker/setup-qemu-action from 4.3.0 to 4.4.0 by @dependabot[bot] in #7485
• Bump org.slf4j:log4j-over-slf4j from 2.0.19 to 2.0.20 by @dependabot[bot] in #7517
• Bump org.metaeffekt.core:ae-security from 0.157.1 to 0.157.2 by @dependabot[bot] in #7529
• Backport: Bump versatile to 0.26.0 by @nscuro in #7563
• Bump eclipse-temurin from 25.0.4_7-jdk-alpine to 25.0.4.1_1-jdk-alpine in /src/main/docker by @dependabot[bot] in #7570
• Bump org.apache.maven:maven-artifact from 3.9.16 to 3.10.0 by @dependabot[bot] in #7574
• Bump bundled frontend to 4.14.5 by @nscuro in #7595

Other Changes

• Add changelog for v4.14.4 by @nscuro in #7308

Full Changelog: 4.14.4...4.14.5

What's Changed

Enhancements 🚀

• Backport: Refactor component metrics computation to avoid pathological query plans by @nscuro in #7364

Bug Fixes 🐛

• Backport: Run spotless:apply after Maven release plugin modifies them POM by @nscuro in #7140
• Backport: v4-migrator: Dedup PROJECT_PROPERTY rows of collapsed projects by @nscuro in #7360
• Backport: v4-migrator: Reconcile PROJECT collection logic and tag by @nscuro in #7361
• Backport: Add option to use Snyk's per-package endpoint when batching is not available by @nscuro in #7362
• Backport: Fix PURLs without version being submitted for analysis by @nscuro in #7363
• Backport: Remove unused LDAP properties by @nscuro in #7365
• Backport: Fix management server preventing shutdown on initialization failures by @nscuro in #7366
• Backport: Resolve project parent before other fields in updateProject by @nscuro in #7367
• Backport: Fix incorrect OpenAPI docs for POST /v1/project WRT parent semantics by @nscuro in #7368
• Backport: Fix project lookup endpoints not serving aggregate metrics for collection projects by @nscuro in #7369
• Backport: Fix DATASOURCE_MIRRORING notifications not being emitted by @nscuro in #7370
• Backport: Treat >=0 ranges as wildcard during vers matching by @nscuro in #7371
• Backport: Accumulate mirrored VulnerableSoftware by vulnerability key by @nscuro in #7373
• Backport: Fix Checkmarx model conversion NPEs by @nscuro in #7374
• Backport: Fix tag binding triggering unnecessary relationship loads by @nscuro in #7375
• Backport: Prevent NPEs during DataNucleus L1 cache eviction by @nscuro in #7376
• Backport: Fix proxy authentication for GitHub Advisories vuln data source by @nscuro in #7377
• Backport: Fix broken link to VulnCheck token creation by @nscuro in #7372
• Backport: Fix calculated CVSSv4 score only considering base metrics by @nscuro in #7378
• Backport: Fix NVD vuln data source iteration and watermarking issues by @nscuro in #7379
• Backport: Move vuln data source mirroring off JDO by @nscuro in #7384
• Backport: Fix lack of context in NVD & OSV unexpected status code exception messages by @nscuro in #7386

Dependency Updates 🤖

• chore(deps): Bump io.smallrye.config:smallrye-config-bom from 3.18.1 to 3.18.2 by @dependabot[bot] in #7144
• chore(deps): Bump com.networknt:json-schema-validator from 2.0.4 to 2.0.5 by @dependabot[bot] in #7147
• chore(deps): Bump com.networknt:json-schema-validator from 2.0.5 to 2.0.7 by @dependabot[bot] in #7154
• chore(deps): Bump the codeql group with 2 updates by @dependabot[bot] in #7158
• Bump com.uber.nullaway:nullaway from 0.13.8 to 0.14.0 by @dependabot[bot] in #7166
• Bump com.icegreen:greenmail-junit5 from 2.1.12 to 2.1.13 by @dependabot[bot] in #7190
• Bump com.adobe.testing:s3mock-testcontainers from 5.1.0 to 5.2.0 by @dependabot[bot] in #7189
• Bump actions/setup-java from 5.7.0 to 6.0.0 by @dependabot[bot] in #7191
• Bump org.openapitools:openapi-generator-maven-plugin from 7.24.0 to 7.25.0 by @dependabot[bot] in #7204
• Bump io.dropwizard.flywaydb:flyway-bom from 13.3.0 to 13.4.0 by @dependabot[bot] in #7221
• Bump org.apache.felix:maven-bundle-plugin from 6.1.0 to 6.1.2 by @dependabot[bot] in #7218
• Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.0 to 3.10.1 by @dependabot[bot] in #7219
• Bump com.github.luben:zstd-jni from 1.5.7-15 to 1.5.7-16 by @dependabot[bot] in #7233
• Bump org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0 by @dependabot[bot] in #7234
• Bump com.uber.nullaway:nullaway from 0.14.0 to 0.14.1 by @dependabot[bot] in #7235
• Bump the codeql group with 2 updates by @dependabot[bot] in #7236
• Bump oasdiff/oasdiff-action/breaking from 0.1.13 to 0.1.14 by @dependabot[bot] in #7237
• Bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 by @dependabot[bot] in #7238
• Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.6 to 3.6.0 by @dependabot[bot] in #7253
• Bump org.apache.maven.plugins:maven-surefire-report-plugin from 3.5.6 to 3.6.0 by @dependabot[bot] in #7252
• Bump lib.swagger.version from 2.2.54 to 2.2.55 by @dependabot[bot] in #7251
• Bump lib.protobuf-java.version from 4.36.0 to 4.36.1 by @dependabot[bot] in #7268
• Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0 by @dependabot[bot] in #7269
• Bump io.swagger.parser.v3:swagger-parser from 2.1.47 to 2.1.48 by @dependabot[bot] in #7270
• Bump lib.jetty.version from 12.1.12 to 12.1.13 by @dependabot[bot] in #7285
• Bump org.metaeffekt.core:ae-security from 0.156.6 to 0.157.0 by @dependabot[bot] in #7286
• Bump lib.byte-buddy.version from 1.18.12 to 1.18.13 by @dependabot[bot] in #7284
• Bump com.h2database:h2 from 2.4.240 to 2.5.250 by @dependabot[bot] in #7304
• Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.1 to 3.10.2 by @dependabot[bot] in #7305
• Bump docker/setup-qemu-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #7306
• Bump oasdiff/oasdiff-action/breaking from 0.1.14 to 0.1.15 by @dependabot[bot] in #7307
• Bump io.dropwizard.flywaydb:flyway-bom from 13.4.0 to 13.5.0 by @dependabot[bot] in #7303
• chore(deps): Bump io.github.openfeign:feign-bom from 13.13 to 13.14 by @dependabot[bot] in #7145
• Bump org.jetbrains.kotlin:kotlin-bom from 2.4.10 to 2.4.20 by @dependabot[bot] in #7320
• Bump org.slf4j:slf4j-bom from 2.0.18 to 2.0.19 by @dependabot[bot] in #7318
• Bump io.github.openfeign:feign-bom from 13.14 to 13.15 by @dependabot[bot] in #7325
• Bump alpine from 3.24.1 to 3.24.2 in /apiserver/src/main/docker by @dependabot[bot] in #7342
• Bump eclipse-temurin from 09349d7 to 541729c in /apiserver/src/main/docker by @dependabot[bot] in #7343
• Bump com.microsoft.sqlserver:mssql-jdbc from 13.4.0.jre11 to 13.6.0.jre11 by @dependabot[bot] in #7344
• Backport: Bump alpine base image to 3.24.2 by @nscuro in #7381

Other Changes

• Backport: Address zizmor findings by @nscuro in #7194

Full Changelog: 5.1.0...5.1.1

For official releases, refer to Dependency Track Docs >> Changelogs for information about improvements and upgrade notes.
If additional details are required, consult the closed issues for this release milestone.

# SHA1
94b907639f56fadce3e20026178d0c6d7f4ff2a0  dependency-track-apiserver.jar
54ef0146414037b875d2670a1e282845d13a5516  dependency-track-bundled.jar
# SHA256
08a8f517f571e5c2a3c4392de044ae8668beb0b2dec1bf172082676d1a9f9ad1  dependency-track-apiserver.jar
5b993cfe4cf7855feba8b7454a529100186537f46ebbe9651b6c720ab184a9d1  dependency-track-bundled.jar
# SHA512
671e439ec338e496ccc51c29f10df28da9b88f3749c4f29d2e3ca73fad080c119487a42a3ed2e62d288dc1db2bd83ad70e7eade39a2ae96a2e287969f0301905  dependency-track-apiserver.jar
75e108bdd1fe7a58615999da3de9b1f5a0e46080bc1d6e2856b31d7a1858109d6fc99dfd03ef2ea08cef1006b5d428ee55ff4d2344e0c8d7a34739f3c8d47837  dependency-track-bundled.jar

What's Changed

Enhancements 🚀

• fix(notifications): improve Jira Perform Test logging and status handling by @valentijnscholten in #6792
• Backport: Bump cyclonedx-core-java and json-schema-validtor libs by @nscuro in #6963
• Backport: Add CycloneDX 1.7 support by @nscuro in #6966
• Backport: Remove unnecessary enrichment when querying for individual projects by @nscuro in #7258
• Backport: Use modern CycloneDX tools metadata by @nscuro in #7259

Bug Fixes 🐛

• Fix User-Agent header missing for various HTTP requests by @nscuro in #7254
• Backport: Fix excessive churn of vulnerable software associations during mirroring by @nscuro in #7256
• Backport: Stop bumping AffectedVersionAttribution.lastSeen by @nscuro in #7257
• Fix FK violations when deleting vulns with analyses by @nscuro in #7260

Dependency Updates 🤖

• chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.3 to 0.156.4 by @dependabot[bot] in #6775
• chore(deps-dev): Bump com.icegreen:greenmail-junit5 from 2.1.9 to 2.1.10 by @dependabot[bot] in #6778
• chore(deps): Bump io.github.nscuro:versatile-core from 0.21.0 to 0.21.1 by @dependabot[bot] in #6779
• chore(deps-dev): Bump com.icegreen:greenmail-junit5 from 2.1.10 to 2.1.11 by @dependabot[bot] in #6789
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.4 to 0.156.5 by @dependabot[bot] in #6800
• chore(deps): Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #6818
• chore(deps): Bump actions/setup-java from 5.5.0 to 5.6.0 by @dependabot[bot] in #6817
• chore(deps): Bump docker/login-action from 4.4.0 to 4.5.2 by @dependabot[bot] in #6884
• chore(deps): Bump com.google.cloud.sql:postgres-socket-factory from 1.28.6 to 1.29.0 by @dependabot[bot] in #6882
• chore(deps): Bump com.google.cloud.sql:cloud-sql-connector-jdbc-sqlserver from 1.28.6 to 1.29.0 by @dependabot[bot] in #6881
• chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.8.0 to 13.9.0 by @dependabot[bot] in #6880
• chore(deps): Bump com.google.cloud.sql:mysql-socket-factory-connector-j-8 from 1.28.6 to 1.29.0 by @dependabot[bot] in #6879
• chore(deps): Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.2 to 5.6.3 by @dependabot[bot] in #6892
• chore(deps): Bump docker/login-action from 4.5.2 to 4.6.0 by @dependabot[bot] in #6925
• chore(deps): Bump actions/setup-java from 5.6.0 to 5.7.0 by @dependabot[bot] in #6924
• chore(deps): Bump io.github.jeremylong:open-vulnerability-clients from 9.0.5 to 9.0.6 by @dependabot[bot] in #6923
• chore(deps): Bump debian from 328d164 to 0d97731 in /src/main/docker by @dependabot[bot] in #6920
• chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.45 to 2.1.46 by @dependabot[bot] in #6944
• chore(deps): Bump com.fasterxml.woodstox:woodstox-core from 7.2.1 to 7.2.2 by @dependabot[bot] in #6943
• chore(deps): Bump eclipse-temurin from b8ba5fc to 5bd5dbe in /src/main/docker by @dependabot[bot] in #6938
• chore(deps): Bump debian from 0d97731 to 1710bde in /src/main/docker by @dependabot[bot] in #6956
• chore(deps-dev): Bump com.icegreen:greenmail-junit5 from 2.1.11 to 2.1.12 by @dependabot[bot] in #6969
• chore(deps): Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4 by @dependabot[bot] in #6985
• chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.9.0 to 13.10.0 by @dependabot[bot] in #7001
• chore(deps-dev): Bump io.github.ascopes:protobuf-maven-plugin from 5.1.7 to 5.1.8 by @dependabot[bot] in #7018
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.5 to 0.156.6 by @dependabot[bot] in #7019
• chore(deps): Bump io.github.nscuro:versatile-core from 0.21.1 to 0.22.0 by @dependabot[bot] in #7043
• chore(deps): Bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #7086
• chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.10.0 to 13.11.0 by @dependabot[bot] in #7085
• chore(deps): Bump io.github.nscuro:versatile-core from 0.22.0 to 0.23.0 by @dependabot[bot] in #7087
• chore(deps): Bump eclipse-temurin from 5bd5dbe to 966f3ab in /src/main/docker by @dependabot[bot] in #7105
• chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.46 to 2.1.47 by @dependabot[bot] in #7122
• chore(deps): Bump lib.protobuf-java.version from 4.35.1 to 4.36.0 by @dependabot[bot] in #7142
• Bump eclipse-temurin from 25.0.3_9-jdk-alpine to 25.0.4_7-jdk-alpine in /src/main/docker by @dependabot[bot] in #7164
• Bump debian from 1710bde to 0463431 in /src/main/docker by @dependabot[bot] in #7163
• Bump io.github.nscuro:versatile-core from 0.23.0 to 0.24.0 by @dependabot[bot] in #7187
• Bump com.icegreen:greenmail-junit5 from 2.1.12 to 2.1.13 by @dependabot[bot] in #7186
• Bump actions/setup-java from 5.7.0 to 6.0.0 by @dependabot[bot] in #7188
• Bump org.cyclonedx:cyclonedx-core-java from 13.1.0 to 13.2.0 by @dependabot[bot] in #7201
• Bump com.google.cloud.sql:postgres-socket-factory from 1.29.0 to 1.30.0 by @dependabot[bot] in #7200
• Bump com.google.cloud.sql:cloud-sql-connector-jdbc-sqlserver from 1.29.0 to 1.30.0 by @dependabot[bot] in #7199
• Bump com.google.cloud.sql:mysql-socket-factory-connector-j-8 from 1.29.0 to 1.30.0 by @dependabot[bot] in #7202
• Bump io.swagger.parser.v3:swagger-parser from 2.1.47 to 2.1.48 by @dependabot[bot] in #7246
• Bump lib.protobuf-java.version from 4.36.0 to 4.36.1 by @dependabot[bot] in #7250
• Bump eclipse-temurin from 10c2519 to 3ffcdc9 in /src/main/docker by @dependabot[bot] in #7265
• Bump eclipse-temurin from 3ffcdc9 to 20a695e in /src/main/docker by @dependabot[bot] in #7280
• Bump org.metaeffekt.core:ae-security from 0.156.6 to 0.157.0 by @dependabot[bot] in #7283
• Bump org.slf4j:log4j-over-slf4j from 2.0.18 to 2.0.19 by @dependabot[bot] in #7301
• Bump docker...

What's Changed

Enhancements 🚀

• Use ScopedValue instead of ThreadLocal for unrestricted project access by @nscuro in #6291
• v4-migrator: Add TCP keepalive and optional socket timeout by @nscuro in #6302
• v4-migrator: Fail fast when detecting bootstrap being pointed at v4 database by @nscuro in #6332
• Allow out-of-order execution of Flyway migrations by @nscuro in #6365
• Drop FK constraints from partitioned metrics tables by @nscuro in #6346
• Add protobuf publishing option for webhook notifications by @Xenira in #6373
• Add Squawk for migration linting by @nscuro in #6413
• Resolve analysis rating overrides per method in findings and notifications by @nscuro in #6417
• Apply OWASP rating from VEX import by @fahedouch in #6210
• Add server release version to the OpenAPI spec info block by @GabrielBBaldez in #6426
• Optimize portfolio-wide findings queries by @nscuro in #6459
• Forward group_by parameter to DefectDojo, v5 version by @webdevred in #6416
• Extend distro-aware version matching with Red Hat support by @nscuro in #6464
• Forward analysis.detail to DefectDojo, v5 version by @webdevred in #6415
• Add project isActive parameter for BOM upload API by @sahibamittal in #6475
• Implemented Banner Backend. by @ElenaStroebele in #6440
• Raise lock timeout for mirror-vuln-data-source activities and set explicit request timeouts for NVD downloads by @nscuro in #6508
• Remove unnecessary enrichment when querying for individual projects by @nscuro in #6514
• Bump cyclonedx-core-java and json-schema-validtor libs by @nscuro in #6515
• Implement initial KEV support by @nscuro in #6516
• Make KEV usable in component and vulnerability policies by @nscuro in #6545
• Include KEV flag in notifications by @nscuro in #6546
• Add GitHub App authentication for the GitHub Advisories mirror by @nissessenap in #6564
• Reduce resource footprint of project metrics updates by @nscuro in #6655
• Improve default data source config by @nscuro in #6678
• dex: add missing indexes on workflow_run_id in task tables by @nscuro in #6721
• dex: improve activity task scheduler polling efficiency for deep backlogs by @nscuro in #6723
• dex: execute multiple deletion batches per maintenance cycle by @nscuro in #6734
• Improve classification of retryable vuln analysis errors by @nscuro in #6744
• Implement support for compressed SBOMs in multipart uploads by @Nihlus in #6769
• dex: Make query timeout configurable by @nscuro in #6806
• dex: improve workflow task scheduling performance for deep backlogs with concurrency keys by @nscuro in #6811
• Log HTTP response body snippets on publish failures by @valentijnscholten in #6793
• Avoid sequential scan of FINDINGATTRIBUTION in project-scoped queries by @nscuro in #6834
• dex: enforce execution timeout for activities by @mehab in #6741
• dex: define default activity execution timeout by @nscuro in #6836
• Improve responsiveness to thread interruptions by @nscuro in #6837
• Avoid potential nested loop in component metrics computation by @nscuro in #6839
• dex: automatically heartbeat activities by @nscuro in #6807
• dex: reduce metrics collection footprint by @nscuro in #6840
• Don't assemble expensive notifications when no subscribing rule exists by @nscuro in #6843
• Add component scope evaluation policy by @adamtorokaccreativetg in #6853
• Introduce package metadata resolution state tracking by @nscuro in #6794
• Add KEV dimension to time series metrics by @nscuro in #6552
• Add Checkmarx SCA vulnerability analyser by @sahibamittal in #6804
• Add CycloneDX 1.7 support by @nscuro in #6703
• v4-migrator: Skip repeatable Flyway migrations by @nscuro in #6967
• Leverage OSV's modified_id.csv list for full archive downloads by @nscuro in #6974
• Stop bumping AffectedVersionAttribution.lastSeen by @nscuro in #6979
• Improve BOV model conversion for vulns with many affected components by @nscuro in #6981
• Log child projects deleted with their parent by @ElenaStroebele in #6976
• Support AWS-managed credentials for S3 storage by @fouad-j in #6874
• Add REST API endpoints to view and trigger KEV mirroring runs by @nscuro in #7007
• Enforce global database query timeout by @nscuro in #7009
• Bypass JDO for bulk deletions by @nscuro in #7011
• Support display names for extensions and KEV asserters by @nscuro in #7025
• Add VulnCheck KEV data source by @nscuro in #7027
• Pace creation of scheduled analyze-project workflows by @nscuro in #7049
• Enforce Maven build constraints by @nscuro in #7052
• Use modern CycloneDX tools metadata by @AKSHATSPAR in #6785
• Add JVN (Japan Vulnerability Notes) vulnerability data source by @mitsukado-shinagawa in #6640
• Declaratively define capabilities of CycloneDX export variants by @nscuro in #7075
• Align VEX semantics with CISA guidance and tooling ecosystem by @nscuro in #7076
• Fix excessive UPDATEs being issued during BOM import by @nscuro in #7099
• Define display names for all extensions by @nscuro in #7128
• Enforce consistent code formatting by @nscuro in #7053
• Check for optional columns via ResultSetMetaData instead of findColumn's exception by @nscuro in #7131
• dex: Avoid unnecessary allocations during history replay by @nscuro in #7136
• Expose workflow run status on BOM token polling endpoint by @Suhas2109 in #7127

Bug Fixes 🐛

• Make REPOSITORY.AUTHENTICATIONREQUIRED non-nullable by @nscuro in #6303
• Apply stricter PURL normalization for NPM package metadata resolution by @nscuro in #6304
• Bypass outbox for notification rule tests by @nscuro in #6305
• Fix NO_PROXY being rejected as legacy Alpine property by @nscuro in #6307
• v4-migrator: only run post-load actions when load phase completes suc...

What's Changed

Enhancements 🚀

• Backport: Leverage OSV's modified_id.csv list for full archive downloads by @nscuro in #7073

Bug Fixes 🐛

• Backport: Fix teams being logged as object references instead of names by @nscuro in #7059
• Backport: Fix 500 in /v1/vulnerability/component/{uuid} when a project has >1 analysis for the same vuln by @nscuro in #7060
• Backport: v4-migrator: Fix unique constraint violation on duplicate OIDC group mappings by @nscuro in #7061
• Backport: Fix unassigned severity missing from component metrics by @nscuro in #7062
• Backport: Fix component license name not being returned by v2 component APIs by @nscuro in #7063
• Backport: Fix POLICY_VIOLATION notification templates referencing nonexistent policyCondition field by @nscuro in #7064
• Backport: Fix notification templates referencing nonexistent variables by @nscuro in #7069
• Backport: Fix conversion of OSV version ranges by @nscuro in #7072

Dependency Updates 🤖

• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.6 to 0.1.10 by @dependabot[bot] in #6888
• chore(deps): Bump docker/login-action from 4.4.0 to 4.5.2 by @dependabot[bot] in #6887
• chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-11 to 1.5.7-12 by @dependabot[bot] in #6886
• chore(deps): Bump com.google.cloud.sql:postgres-socket-factory from 1.28.6 to 1.29.0 by @dependabot[bot] in #6885
• chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.8.0 to 13.9.0 by @dependabot[bot] in #6883
• chore(deps): Bump lib.logback.version from 1.5.38 to 1.6.0 by @dependabot[bot] in #6868
• chore(deps): Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.2 to 5.6.3 by @dependabot[bot] in #6896
• chore(deps-dev): Bump org.apache.felix:maven-bundle-plugin from 6.0.2 to 6.1.0 by @dependabot[bot] in #6895
• chore(deps): Bump lib.logback.version from 1.6.0 to 1.6.1 by @dependabot[bot] in #6901
• chore(deps): Bump org.jspecify:jspecify from 1.0.0 to 1.0.1 by @dependabot[bot] in #6906
• chore(deps-dev): Bump org.cyclonedx:cyclonedx-maven-plugin from 2.9.2 to 2.9.3 by @dependabot[bot] in #6913
• chore(deps): Bump docker/login-action from 4.5.2 to 4.6.0 by @dependabot[bot] in #6927
• chore(deps): Bump io.github.jeremylong:open-vulnerability-clients from 9.0.5 to 9.0.6 by @dependabot[bot] in #6929
• chore(deps): Bump actions/setup-java from 5.6.0 to 5.7.0 by @dependabot[bot] in #6928
• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.10 to 0.1.11 by @dependabot[bot] in #6926
• chore(deps): Bump lib.jetty.version from 12.1.11 to 12.1.12 by @dependabot[bot] in #6950
• chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.45 to 2.1.46 by @dependabot[bot] in #6948
• chore(deps): Bump lib.swagger.version from 2.2.52 to 2.2.53 by @dependabot[bot] in #6947
• chore(deps-dev): Bump com.tngtech.archunit:archunit-junit5 from 1.4.2 to 1.5.0 by @dependabot[bot] in #6945
• chore(deps): Bump com.fasterxml.woodstox:woodstox-core from 7.2.1 to 7.2.2 by @dependabot[bot] in #6949
• chore(deps): Bump eclipse-temurin from 30d9f87 to 5ecfde8 in /apiserver/src/main/docker by @dependabot[bot] in #6965
• chore(deps): Bump com.icegreen:greenmail-junit5 from 2.1.11 to 2.1.12 by @dependabot[bot] in #6970
• chore(deps): Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4 by @dependabot[bot] in #6987
• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.11 to 0.1.12 by @dependabot[bot] in #7002
• chore(deps): Bump org.junit:junit-bom from 6.1.2 to 6.1.3 by @dependabot[bot] in #7003
• chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.9.0 to 13.10.0 by @dependabot[bot] in #7004
• chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-12 to 1.5.7-13 by @dependabot[bot] in #7005
• chore(deps): Bump io.github.ascopes:protobuf-maven-plugin from 5.1.7 to 5.1.8 by @dependabot[bot] in #7020
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.5 to 0.156.6 by @dependabot[bot] in #7021
• chore(deps): Bump lib.logback.version from 1.6.1 to 1.6.2 by @dependabot[bot] in #7033
• chore(deps): Bump lib.logback.version from 1.6.2 to 1.6.3 by @dependabot[bot] in #7048
• chore(deps): Bump org.apache.maven.extensions:maven-build-cache-extension from 1.2.3 to 1.3.0 by @dependabot[bot] in #7046
• chore(deps): Bump io.github.nscuro:versatile-core from 0.21.1 to 0.22.0 by @dependabot[bot] in #7047
• Backport: Bump Temurin base image to 25.0.4_7 by @nscuro in #7071
• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.12 to 0.1.13 by @dependabot[bot] in #7093
• chore(deps): Bump com.squareup.okhttp3:okhttp-jvm from 5.4.0 to 5.5.0 by @dependabot[bot] in #7092
• chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-13 to 1.5.7-15 by @dependabot[bot] in #7091
• chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.10.0 to 13.11.0 by @dependabot[bot] in #7090
• chore(deps): Bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #7089
• chore(deps): Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2 by @dependabot[bot] in #7088

Other Changes

• Backport: Add zizmor CI job by @nscuro in #7065
• Backport: Add CodeQL analysis by @nscuro in #7066
• Backport: Generate SLSA build provenance by @nscuro in #7067
• Backport: Have release notes refer to upgrade notes by @nscuro in #7095

Full Changelog: 5.0.4...5.0.5

What's Changed

Enhancements 🚀

• Backport: dex: Make query timeout configurable by @nscuro in #6855
• Backport: dex: improve workflow task scheduling performance for deep backlogs with concurrency keys by @nscuro in #6858
• Backport: dex: execute multiple deletion batches per maintenance cycle by @nscuro in #6860
• Backport: dex: enforce execution timeout for activities by @nscuro in #6861
• Backport: dex: define default activity execution timeout by @nscuro in #6862
• Backport: dex: automatically heartbeat activities by @nscuro in #6864
• Backport: Improve responsiveness to thread interruptions by @nscuro in #6863

Bug Fixes 🐛

• Backport: Exclude project from components loaded during ImportBomActivity by @nscuro in #6856
• Backport: Fix failure to emit notification when vulnerability description is empty by @nscuro in #6857
• Backport: dex: fix too eager consumption of concurrency key wakeup hints by @nscuro in #6859
• Backport: Strip trailing / from baseUrl notification template variable by @nscuro in #6865

Dependency Updates 🤖

• chore(deps): Bump com.icegreen:greenmail-junit5 from 2.1.9 to 2.1.10 by @dependabot[bot] in #6784
• chore(deps): Bump org.jetbrains.kotlin:kotlin-bom from 2.4.0 to 2.4.10 by @dependabot[bot] in #6783
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.3 to 0.156.4 by @dependabot[bot] in #6780
• chore(deps): Bump com.icegreen:greenmail-junit5 from 2.1.10 to 2.1.11 by @dependabot[bot] in #6791
• chore(deps): Bump io.smallrye.config:smallrye-config-bom from 3.18.0 to 3.18.1 by @dependabot[bot] in #6790
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.4 to 0.156.5 by @dependabot[bot] in #6803
• chore(deps): Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 by @dependabot[bot] in #6821
• chore(deps): Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #6820
• chore(deps): Bump actions/setup-java from 5.5.0 to 5.6.0 by @dependabot[bot] in #6819
• chore(deps-dev): Bump org.openapitools:openapi-generator-maven-plugin from 7.23.0 to 7.24.0 by @dependabot[bot] in #6831
• chore(deps): Bump com.nimbusds:oauth2-oidc-sdk from 11.38.1 to 11.38.2 by @dependabot[bot] in #6847
• chore(deps): Bump io.github.nscuro:versatile-core from 0.18.3 to 0.21.1 by @dependabot[bot] in #6781

Full Changelog: 5.0.3...5.0.4