Important
Please read the upgrade notes before upgrading your instance.
What's Changed
Enhancements 🚀
Bug Fixes 🐛
- Backport: Fix teams being logged as object references instead of names by @nscuro in #7059
- Backport: Fix 500 in /v1/vulnerability/component/{uuid} when a project has >1 analysis for the same vuln by @nscuro in #7060
- Backport: v4-migrator: Fix unique constraint violation on duplicate OIDC group mappings by @nscuro in #7061
- Backport: Fix unassigned severity missing from component metrics by @nscuro in #7062
- Backport: Fix component license name not being returned by v2 component APIs by @nscuro in #7063
- Backport: Fix POLICY_VIOLATION notification templates referencing nonexistent policyCondition field by @nscuro in #7064
- Backport: Fix notification templates referencing nonexistent variables by @nscuro in #7069
- Backport: Fix conversion of OSV version ranges by @nscuro in #7072
Dependency Updates 🤖
- chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.6 to 0.1.10 by @dependabot[bot] in #6888
- chore(deps): Bump docker/login-action from 4.4.0 to 4.5.2 by @dependabot[bot] in #6887
- chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-11 to 1.5.7-12 by @dependabot[bot] in #6886
- chore(deps): Bump com.google.cloud.sql:postgres-socket-factory from 1.28.6 to 1.29.0 by @dependabot[bot] in #6885
- chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.8.0 to 13.9.0 by @dependabot[bot] in #6883
- chore(deps): Bump lib.logback.version from 1.5.38 to 1.6.0 by @dependabot[bot] in #6868
- chore(deps): Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.2 to 5.6.3 by @dependabot[bot] in #6896
- chore(deps-dev): Bump org.apache.felix:maven-bundle-plugin from 6.0.2 to 6.1.0 by @dependabot[bot] in #6895
- chore(deps): Bump lib.logback.version from 1.6.0 to 1.6.1 by @dependabot[bot] in #6901
- chore(deps): Bump org.jspecify:jspecify from 1.0.0 to 1.0.1 by @dependabot[bot] in #6906
- chore(deps-dev): Bump org.cyclonedx:cyclonedx-maven-plugin from 2.9.2 to 2.9.3 by @dependabot[bot] in #6913
- chore(deps): Bump docker/login-action from 4.5.2 to 4.6.0 by @dependabot[bot] in #6927
- chore(deps): Bump io.github.jeremylong:open-vulnerability-clients from 9.0.5 to 9.0.6 by @dependabot[bot] in #6929
- chore(deps): Bump actions/setup-java from 5.6.0 to 5.7.0 by @dependabot[bot] in #6928
- chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.10 to 0.1.11 by @dependabot[bot] in #6926
- chore(deps): Bump lib.jetty.version from 12.1.11 to 12.1.12 by @dependabot[bot] in #6950
- chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.45 to 2.1.46 by @dependabot[bot] in #6948
- chore(deps): Bump lib.swagger.version from 2.2.52 to 2.2.53 by @dependabot[bot] in #6947
- chore(deps-dev): Bump com.tngtech.archunit:archunit-junit5 from 1.4.2 to 1.5.0 by @dependabot[bot] in #6945
- chore(deps): Bump com.fasterxml.woodstox:woodstox-core from 7.2.1 to 7.2.2 by @dependabot[bot] in #6949
- chore(deps): Bump eclipse-temurin from
30d9f87to5ecfde8in /apiserver/src/main/docker by @dependabot[bot] in #6965 - chore(deps): Bump com.icegreen:greenmail-junit5 from 2.1.11 to 2.1.12 by @dependabot[bot] in #6970
- chore(deps): Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4 by @dependabot[bot] in #6987
- chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.11 to 0.1.12 by @dependabot[bot] in #7002
- chore(deps): Bump org.junit:junit-bom from 6.1.2 to 6.1.3 by @dependabot[bot] in #7003
- chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.9.0 to 13.10.0 by @dependabot[bot] in #7004
- chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-12 to 1.5.7-13 by @dependabot[bot] in #7005
- chore(deps): Bump io.github.ascopes:protobuf-maven-plugin from 5.1.7 to 5.1.8 by @dependabot[bot] in #7020
- chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.5 to 0.156.6 by @dependabot[bot] in #7021
- chore(deps): Bump lib.logback.version from 1.6.1 to 1.6.2 by @dependabot[bot] in #7033
- chore(deps): Bump lib.logback.version from 1.6.2 to 1.6.3 by @dependabot[bot] in #7048
- chore(deps): Bump org.apache.maven.extensions:maven-build-cache-extension from 1.2.3 to 1.3.0 by @dependabot[bot] in #7046
- chore(deps): Bump io.github.nscuro:versatile-core from 0.21.1 to 0.22.0 by @dependabot[bot] in #7047
- Backport: Bump Temurin base image to 25.0.4_7 by @nscuro in #7071
- chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.12 to 0.1.13 by @dependabot[bot] in #7093
- chore(deps): Bump com.squareup.okhttp3:okhttp-jvm from 5.4.0 to 5.5.0 by @dependabot[bot] in #7092
- chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-13 to 1.5.7-15 by @dependabot[bot] in #7091
- chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.10.0 to 13.11.0 by @dependabot[bot] in #7090
- chore(deps): Bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #7089
- chore(deps): Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2 by @dependabot[bot] in #7088
Other Changes
- Backport: Add zizmor CI job by @nscuro in #7065
- Backport: Add CodeQL analysis by @nscuro in #7066
- Backport: Generate SLSA build provenance by @nscuro in #7067
- Backport: Have release notes refer to upgrade notes by @nscuro in #7095
Full Changelog: 5.0.4...5.0.5