What's Changed
Enhancements 🚀
- Backport: Optimize portfolio-wide findings queries by @nscuro in #6571
- Backport: Improve default data source config by @nscuro in #6732
- Backport: dex: add missing indexes on workflow_run_id in task tables by @nscuro in #6733
- Backport: dex: improve activity task scheduler polling efficiency for deep backlogs by @nscuro in #6735
- Backport: Improve classification of retryable vuln analysis errors by @nscuro in #6745
Bug Fixes 🐛
- Backport: Fix getAffectedProjects endpoint not accounting for suppressed findings by @nscuro in #6541
- Backport: Fix badges for collection projects showing no metrics by @nscuro in #6540
- Backport: Fix excessive churn of vulnerable software associations during mirroring by @nscuro in #6543
- Backport: Fix slow vulnerability database maintenance by @nscuro in #6544
- Backport: Raise lock timeout for mirror-vuln-data-source activities and set explicit request timeouts for NVD downloads by @nscuro in #6542
- Backport: exit the JVM when init tasks fail instead of hanging unready by @nscuro in #6712
- Backport: Fix project sorting by version by @nscuro in #6715
- Backport: Fix prepare-vuln-analysis activity failing when components have properties without value by @nscuro in #6714
- Backport: Fix local file storage not anticipating Windows-style paths by @nscuro in #6713
- Backport: Fix build workflow not running for PRs to release branches by @nscuro in #6738
- Backport: Fix NPE and redundant queries in VEX/VDR export by @nscuro in #6743
Dependency Updates 🤖
- Backport: chore(deps): Bump oasdiff/oasdiff-action from 0.0.48 to 0.0.51 by @nscuro in #6611
- chore(deps): Bump actions/cache from 5.0.5 to 6.1.0 by @dependabot[bot] in #6609
- chore(deps): Bump actions/setup-java from 5.2.0 to 5.4.0 by @dependabot[bot] in #6607
- chore(deps): Bump docker/setup-qemu-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6605
- chore(deps-dev): Bump org.cyclonedx:cyclonedx-maven-plugin from 2.9.1 to 2.9.2 by @dependabot[bot] in #6602
- chore(deps): Bump org.junit:junit-bom from 6.1.0 to 6.1.1 by @dependabot[bot] in #6601
- chore(deps): Bump imjasonh/setup-crane from 0.5 to 0.7 by @dependabot[bot] in #6600
- chore(deps): Bump actions/checkout from 6.0.2 to 7.0.0 by @dependabot[bot] in #6603
- chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-9 to 1.5.7-11 by @dependabot[bot] in #6606
- chore(deps): Bump lib.swagger.version from 2.2.50 to 2.2.52 by @dependabot[bot] in #6604
- chore(deps): Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.1 to 5.6.2 by @dependabot[bot] in #6622
- chore(deps): Bump io.takari.maven:takari-smart-builder from 1.1.0 to 1.1.1 by @dependabot[bot] in #6620
- chore(deps): Bump org.metaeffekt.core:ae-security from 0.155.0 to 0.156.3 by @dependabot[bot] in #6619
- chore(deps): Bump lib.protobuf-java.version from 4.35.0 to 4.35.1 by @dependabot[bot] in #6618
- chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.43 to 2.1.45 by @dependabot[bot] in #6621
- chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.4.2 to 13.7.0 by @dependabot[bot] in #6635
- chore(deps): Bump com.fasterxml.woodstox:woodstox-core from 7.2.0 to 7.2.1 by @dependabot[bot] in #6634
- chore(deps): Bump dev.cel:cel from 0.13.0 to 0.13.1 by @dependabot[bot] in #6636
- chore(deps): Bump io.dropwizard.flywaydb:flyway-bom from 12.6.1 to 12.10.0 by @dependabot[bot] in #6632
- chore(deps): Bump lib.logback.version from 1.5.33 to 1.5.37 by @dependabot[bot] in #6633
- chore(deps): Bump com.squareup.okhttp3:okhttp-jvm from 5.3.2 to 5.4.0 by @dependabot[bot] in #6644
- chore(deps): Bump org.jetbrains.kotlin:kotlin-bom from 2.3.21 to 2.4.0 by @dependabot[bot] in #6646
- chore(deps-dev): Bump org.apache.maven.plugins:maven-surefire-report-plugin from 3.5.5 to 3.5.6 by @dependabot[bot] in #6648
- chore(deps-dev): Bump org.openapitools:openapi-generator-maven-plugin from 7.22.0 to 7.23.0 by @dependabot[bot] in #6649
- chore(deps): Bump org.apache.kafka:kafka-clients from 4.3.0 to 4.3.1 by @dependabot[bot] in #6647
- chore(deps): Bump com.icegreen:greenmail-junit5 from 2.1.8 to 2.1.9 by @dependabot[bot] in #6675
- chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.0.51 to 0.1.5 by @dependabot[bot] in #6674
- chore(deps): Bump io.minio:minio from 9.0.1 to 9.0.3 by @dependabot[bot] in #6673
- chore(deps): Bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6671
- chore(deps): Bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6669
- chore(deps): Bump io.github.openfeign:feign-bom from 13.12 to 13.13 by @dependabot[bot] in #6668
- chore(deps): Bump com.google.crypto.tink:tink from 1.21.0 to 1.22.0 by @dependabot[bot] in #6667
- chore(deps): Bump docker/build-push-action from 7.2.0 to 7.3.0 by @dependabot[bot] in #6676
- chore(deps): Bump docker/login-action from 4.2.0 to 4.4.0 by @dependabot[bot] in #6672
- chore(deps-dev): Bump com.zaxxer:HikariCP from 7.0.2 to 7.1.0 by @dependabot[bot] in #6670
- chore(deps): Bump io.micrometer:micrometer-bom from 1.16.5 to 1.17.0 by @dependabot[bot] in #6685
- chore(deps): Bump com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.22.0 by @dependabot[bot] in #6684
- chore(deps): Bump io.github.ascopes:protobuf-maven-plugin from 5.1.4 to 5.1.7 by @dependabot[bot] in #6683
- chore(deps): Bump io.prometheus:prometheus-metrics-bom from 1.6.1 to 1.8.0 by @dependabot[bot] in #6686
- chore(deps): Bump org.eclipse.parsson:jakarta.json from 1.1.7 to 1.1.9 by @dependabot[bot] in #6700
- chore(deps): Bump com.google.cloud.sql:postgres-socket-factory from 1.28.3 to 1.28.6 by @dependabot[bot] in #6699
- chore(deps): Bump org.jdbi:jdbi3-bom from 3.53.0 to 3.54.0 by @dependabot[bot] in #6698
- chore(deps): Bump org.postgresql:postgresql from 42.7.11 to 42.7.13 by @dependabot[bot] in #6697
- chore(deps): Bump lib.jetty.version from 12.1.9 to 12.1.11 by @dependabot[bot] in #6696
- chore(deps): Bump io.pebbletemplates:pebble from 4.1.1 to 4.1.2 by @dependabot[bot] in #6708
- chore(deps): Bump com.fasterxml.jackson:jackson-bom from 2.22.0 to 2.22.1 by @dependabot[bot] in #6709
- chore(deps): Bump com.adobe.testing:s3mock-testcontainers from 5.0.0 to 5.1.0 by @dependabot[bot] in #6707
- chore(deps): Bump io.smallrye.config:smallrye-config-bom from 3.17.2 to 3.18.0 by @dependabot[bot] in #6705
- chore(deps): Bump org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15 by @dependabot[bot] in #6706
- chore(deps): Bump com.google.crypto.tink:tink from 1.22.0 to 1.23.0 by @dependabot[bot] in #6731
- chore(deps): Bump com.nimbusds:oauth2-oidc-sdk from 11.37.2 to 11.38 by @dependabot[bot] in #6730
- chore(deps): Bump lib.logback.version from 1.5.37 to 1.5.38 by @dependabot[bot] in #6729
- chore(deps): Bump com.github.kagkarlsson:db-scheduler from 16.11.0 to 16.12.0 by @dependabot[bot] in #6727
- chore(deps): Bump org.junit:junit-bom from 6.1.1 to 6.1.2 by @dependabot[bot] in #6761
- chore(deps): Bump actions/setup-java from 5.4.0 to 5.5.0 by @dependabot[bot] in #6759
- chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.7.0 to 13.8.0 by @dependabot[bot] in #6758
- chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.5 to 0.1.6 by @dependabot[bot] in #6756
- chore(deps): Bump actions/checkout from 6.0.2 to 7.0.0 by @dependabot[bot] in #6755
- chore(deps): Bump io.dropwizard.flywaydb:flyway-bom from 12.10.0 to 12.11.0 by @dependabot[bot] in #6757
- chore(deps): Bump com.nimbusds:oauth2-oidc-sdk from 11.38 to 11.38.1 by @dependabot[bot] in #6760
Other Changes
- Backport: Use WireMock for NVD vuln data source tests by @nscuro in #6612
- Backport: Add Squawk for migration linting by @nscuro in #6737
Full Changelog: 5.0.2...5.0.3