DependencyTrack/dependency-track 5.1.0 on GitHub

Important

Please read the upgrade notes before upgrading your instance.

What's Changed

Enhancements 🚀

Use ScopedValue instead of ThreadLocal for unrestricted project access by @nscuro in #6291
v4-migrator: Add TCP keepalive and optional socket timeout by @nscuro in #6302
v4-migrator: Fail fast when detecting bootstrap being pointed at v4 database by @nscuro in #6332
Allow out-of-order execution of Flyway migrations by @nscuro in #6365
Drop FK constraints from partitioned metrics tables by @nscuro in #6346
Add protobuf publishing option for webhook notifications by @Xenira in #6373
Add Squawk for migration linting by @nscuro in #6413
Resolve analysis rating overrides per method in findings and notifications by @nscuro in #6417
Apply OWASP rating from VEX import by @fahedouch in #6210
Add server release version to the OpenAPI spec info block by @GabrielBBaldez in #6426
Optimize portfolio-wide findings queries by @nscuro in #6459
Forward group_by parameter to DefectDojo, v5 version by @webdevred in #6416
Extend distro-aware version matching with Red Hat support by @nscuro in #6464
Forward analysis.detail to DefectDojo, v5 version by @webdevred in #6415
Add project isActive parameter for BOM upload API by @sahibamittal in #6475
Implemented Banner Backend. by @ElenaStroebele in #6440
Raise lock timeout for mirror-vuln-data-source activities and set explicit request timeouts for NVD downloads by @nscuro in #6508
Remove unnecessary enrichment when querying for individual projects by @nscuro in #6514
Bump cyclonedx-core-java and json-schema-validtor libs by @nscuro in #6515
Implement initial KEV support by @nscuro in #6516
Make KEV usable in component and vulnerability policies by @nscuro in #6545
Include KEV flag in notifications by @nscuro in #6546
Add GitHub App authentication for the GitHub Advisories mirror by @nissessenap in #6564
Reduce resource footprint of project metrics updates by @nscuro in #6655
Improve default data source config by @nscuro in #6678
dex: add missing indexes on workflow_run_id in task tables by @nscuro in #6721
dex: improve activity task scheduler polling efficiency for deep backlogs by @nscuro in #6723
dex: execute multiple deletion batches per maintenance cycle by @nscuro in #6734
Improve classification of retryable vuln analysis errors by @nscuro in #6744
Implement support for compressed SBOMs in multipart uploads by @Nihlus in #6769
dex: Make query timeout configurable by @nscuro in #6806
dex: improve workflow task scheduling performance for deep backlogs with concurrency keys by @nscuro in #6811
Log HTTP response body snippets on publish failures by @valentijnscholten in #6793
Avoid sequential scan of FINDINGATTRIBUTION in project-scoped queries by @nscuro in #6834
dex: enforce execution timeout for activities by @mehab in #6741
dex: define default activity execution timeout by @nscuro in #6836
Improve responsiveness to thread interruptions by @nscuro in #6837
Avoid potential nested loop in component metrics computation by @nscuro in #6839
dex: automatically heartbeat activities by @nscuro in #6807
dex: reduce metrics collection footprint by @nscuro in #6840
Don't assemble expensive notifications when no subscribing rule exists by @nscuro in #6843
Add component scope evaluation policy by @adamtorokaccreativetg in #6853
Introduce package metadata resolution state tracking by @nscuro in #6794
Add KEV dimension to time series metrics by @nscuro in #6552
Add Checkmarx SCA vulnerability analyser by @sahibamittal in #6804
Add CycloneDX 1.7 support by @nscuro in #6703
v4-migrator: Skip repeatable Flyway migrations by @nscuro in #6967
Leverage OSV's modified_id.csv list for full archive downloads by @nscuro in #6974
Stop bumping AffectedVersionAttribution.lastSeen by @nscuro in #6979
Improve BOV model conversion for vulns with many affected components by @nscuro in #6981
Log child projects deleted with their parent by @ElenaStroebele in #6976
Support AWS-managed credentials for S3 storage by @fouad-j in #6874
Add REST API endpoints to view and trigger KEV mirroring runs by @nscuro in #7007
Enforce global database query timeout by @nscuro in #7009
Bypass JDO for bulk deletions by @nscuro in #7011
Support display names for extensions and KEV asserters by @nscuro in #7025
Add VulnCheck KEV data source by @nscuro in #7027
Pace creation of scheduled analyze-project workflows by @nscuro in #7049
Enforce Maven build constraints by @nscuro in #7052
Use modern CycloneDX tools metadata by @AKSHATSPAR in #6785
Add JVN (Japan Vulnerability Notes) vulnerability data source by @mitsukado-shinagawa in #6640
Declaratively define capabilities of CycloneDX export variants by @nscuro in #7075
Align VEX semantics with CISA guidance and tooling ecosystem by @nscuro in #7076
Fix excessive UPDATEs being issued during BOM import by @nscuro in #7099
Define display names for all extensions by @nscuro in #7128
Enforce consistent code formatting by @nscuro in #7053
Check for optional columns via ResultSetMetaData instead of findColumn's exception by @nscuro in #7131
dex: Avoid unnecessary allocations during history replay by @nscuro in #7136
Expose workflow run status on BOM token polling endpoint by @Suhas2109 in #7127

Bug Fixes 🐛

Make REPOSITORY.AUTHENTICATIONREQUIRED non-nullable by @nscuro in #6303
Apply stricter PURL normalization for NPM package metadata resolution by @nscuro in #6304
Bypass outbox for notification rule tests by @nscuro in #6305
Fix NO_PROXY being rejected as legacy Alpine property by @nscuro in #6307
v4-migrator: only run post-load actions when load phase completes successfully by @nscuro in #6310
Reject parent objects with null UUID when creating/updating/patching projects by @nscuro in #6314
Fix NPE during LDAP auth when bind credentials are not configured by @nscuro in #6317
Fix suppressed vulns being considered for policy evaluation by @nscuro in #6320
Fix incomplete field coverage of /v1/finding/project/{uuid}'s searchText filter by @nscuro in #6323
Fix OIDC UserInfo endpoint not being invoked when team sync is enabled and ID token contains no teams claim by @nscuro in #6324
Fix URL-encoding of OSV ecosystem names by @nscuro in #6329
v4-migrator: Fix confusing debug log for missing tgt_permission table by @nscuro in #6340
Support non-UTC timezones for metrics operations by @nscuro in #6344
Fix URL-encoding of OSV ecosystem names when retrieving incremental advisories by @basclaessen in #6374
Handle PAC-inaccessible target projects more gracefully for BOM uploads with autoCreate=true by @nscuro in #6376
Fix broken HTTP proxy basic auth by @nscuro in #6380
Fix team of API key not being auto-assigned project access after project creation by @nscuro in #6388
Fix bad CPE query performance for internal vuln analyzer by @nscuro in #6439
Fix admin re-seeding when USER table is populated by @Clark1945 in #6431
v4-migrator: Don't migrate obsolete notification groups for notification rules by @nscuro in #6443
Fix duplicate project name/version handling for /v1/project POST and PATCH endpoints by @nscuro in #6445
dex: Fix over-reporting of activity task queue depth metric by @nscuro in #6446
Fix MIME type of email notification templates not being set correctly by @nscuro in #6454
Fix slow vulnerability database maintenance by @nscuro in #6497
Fix excessive churn of vulnerable software associations during mirroring by @nscuro in #6499
Make banner config readable without permissions by @nscuro in #6507
Fix getAffectedProjects endpoint not accounting for suppressed findings by @nscuro in #6522
Fix badges for collection projects showing no metrics by @nscuro in #6539
Fix prepare-vuln-analysis activity failing when components have properties without value by @nscuro in #6573
Fix local file storage not anticipating Windows-style paths by @nscuro in #6628
Fix project sorting by version by @bergerst in #6652
fix: exit the JVM when init tasks fail instead of hanging unready by @taleodor in #6690
Fix BufferTest flakiness by @nscuro in #6718
Fix build workflow not running for PRs to release branches by @nscuro in #6736
Port: Fix NPE and redundant queries in VEX/VDR export by @nscuro in #6739
Fix swallowed LDAP exception stack traces during context creation by @nscuro in #6797
Strip trailing / from baseUrl notification template variable by @kamilkrzywanski in #6799
Exclude project from components loaded during ImportBomActivity by @Nihlus in #6824
Fix NotificationOutboxRelayTest flakiness by @nscuro in #6825
dex: fix eager too consumption of concurrency key wakeup hints by @nscuro in #6833
Fix failure to emit notification when vulnerability description is empty by @nscuro in #6844
Fix teams being logged as object references instead of names by @ElenaStroebele in #6919
Fix : Add Checkmarx API client fix by @sahibamittal in #6902
Fix 500 in /v1/vulnerability/component/{uuid} when a project has >1 analysis for the same vuln by @nscuro in #6930
v4-migrator: Fix unique constraint violation on duplicate OIDC group mappings by @nscuro in #6952
Fix unassigned severity missing from component metrics by @ElenaStroebele in #6962
Fix POLICY_VIOLATION notification templates referencing nonexistent p… by @fffinkel in #6995
Fix notification templates referencing nonexistent variables by @nscuro in #6996
Fix component license name not being returned by v2 component APIs by @nscuro in #7023
Allow partial count for findings endpoints by @nscuro in #7035
Fix project-create team picker stopping at 100 teams. by @ElenaStroebele in #6992
Fix KEV filter performance regression in findings endpoints by @nscuro in #7036
Fix conversion of OSV version ranges by @nscuro in #7058
Fix JsonParser leakage in DataNucleus attribute converters by @nscuro in #7098
Fix incorrect equality of data classification and external reference types by @nscuro in #7100
Fix BOM import change detection of JSON and array values by @nscuro in #7101

Dependency Updates 🤖

chore(deps): Bump docker/setup-qemu-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6293
chore(deps): Bump imjasonh/setup-crane from 0.5 to 0.6 by @dependabot[bot] in #6294
chore(deps): Bump com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.22.0 by @dependabot[bot] in #6296
chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.4.2 to 13.5.0 by @dependabot[bot] in #6297
chore(deps): Bump io.dropwizard.flywaydb:flyway-bom from 12.6.1 to 12.7.0 by @dependabot[bot] in #6321
chore(deps): Bump lib.jetty.version from 12.1.9 to 12.1.10 by @dependabot[bot] in #6322
chore(deps): Bump com.github.kagkarlsson:db-scheduler from 16.11.0 to 16.12.0 by @dependabot[bot] in #6336
chore(deps): Bump lib.logback.version from 1.5.33 to 1.5.34 by @dependabot[bot] in #6338
chore(deps): Bump com.google.cloud.sql:postgres-socket-factory from 1.28.3 to 1.28.4 by @dependabot[bot] in #6298
chore(deps): Bump oasdiff/oasdiff-action from 0.0.48 to 0.0.51 by @dependabot[bot] in #6295
chore(deps): Bump io.pebbletemplates:pebble from 4.1.1 to 4.1.2 by @dependabot[bot] in #6372
chore(deps-dev): Bump org.apache.maven.plugins:maven-surefire-report-plugin from 3.5.5 to 3.5.6 by @dependabot[bot] in #6371
chore(deps): Bump org.jetbrains.kotlin:kotlin-bom from 2.3.21 to 2.4.0 by @dependabot[bot] in #6385
chore(deps): Bump io.prometheus:prometheus-metrics-bom from 1.6.1 to 1.7.0 by @dependabot[bot] in #6386
chore(deps): Bump oasdiff/oasdiff-action from 0.0.51 to 0.0.57 by @dependabot[bot] in #6403
chore(deps): Bump alpine from 3.23 to 3.24 in /apiserver/src/main/docker by @dependabot[bot] in #6411
chore(deps): Bump com.fasterxml.woodstox:woodstox-core from 7.2.0 to 7.2.1 by @dependabot[bot] in #6408
chore(deps-dev): Bump com.zaxxer:HikariCP from 7.0.2 to 7.1.0 by @dependabot[bot] in #6407
chore(deps): Bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #6404
chore(deps): Bump org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15 by @dependabot[bot] in #6406
chore(deps): Bump io.micrometer:micrometer-bom from 1.16.5 to 1.17.0 by @dependabot[bot] in #6424
chore(deps): Bump org.eclipse.parsson:jakarta.json from 1.1.7 to 1.1.9 by @dependabot[bot] in #6423
chore(deps): Bump com.squareup.okhttp3:okhttp-jvm from 5.3.2 to 5.4.0 by @dependabot[bot] in #6422
chore(deps-dev): Bump org.openapitools:openapi-generator-maven-plugin from 7.22.0 to 7.23.0 by @dependabot[bot] in #6433
chore(deps): Bump io.minio:minio from 9.0.1 to 9.0.2 by @dependabot[bot] in #6434
chore(deps): Bump lib.protobuf-java.version from 4.35.0 to 4.35.1 by @dependabot[bot] in #6435
Bump Alpine base image to 3.24.1 by @nscuro in #6450
chore(deps): Bump io.minio:minio from 9.0.2 to 9.0.3 by @dependabot[bot] in #6468
chore(deps): Bump io.prometheus:prometheus-metrics-bom from 1.7.0 to 1.8.0 by @dependabot[bot] in #6467
chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.43 to 2.1.44 by @dependabot[bot] in #6466
chore(deps): Bump oasdiff/oasdiff-action from 0.0.57 to 0.1.1 by @dependabot[bot] in #6478
chore(deps): Bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #6479
chore(deps): Bump lib.swagger.version from 2.2.50 to 2.2.51 by @dependabot[bot] in #6480
chore(deps): Bump dev.cel:cel from 0.13.0 to 0.13.1 by @dependabot[bot] in #6481
chore(deps): Bump com.icegreen:greenmail-junit5 from 2.1.8 to 2.1.9 by @dependabot[bot] in #6482
chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-9 to 1.5.7-11 by @dependabot[bot] in #6483
chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.5.0 to 13.6.0 by @dependabot[bot] in #6492
chore(deps): Bump io.takari.maven:takari-smart-builder from 1.1.0 to 1.1.1 by @dependabot[bot] in #6491
chore(deps): Bump org.metaeffekt.core:ae-security from 0.155.0 to 0.156.1 by @dependabot[bot] in #6490
chore(deps): Bump io.github.openfeign:feign-bom from 13.12 to 13.13 by @dependabot[bot] in #6488
chore(deps): Bump io.github.ascopes:protobuf-maven-plugin from 5.1.4 to 5.1.5 by @dependabot[bot] in #6509
chore(deps): Bump org.apache.kafka:kafka-clients from 4.3.0 to 4.3.1 by @dependabot[bot] in #6511
chore(deps): Bump com.google.crypto.tink:tink from 1.21.0 to 1.22.0 by @dependabot[bot] in #6517
chore(deps): Bump io.dropwizard.flywaydb:flyway-bom from 12.7.0 to 12.9.0 by @dependabot[bot] in #6518
chore(deps): Bump actions/setup-java from 5.2.0 to 5.3.0 by @dependabot[bot] in #6527
chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.1 to 0.1.3 by @dependabot[bot] in #6528
chore(deps): Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #6529
chore(deps): Bump com.adobe.testing:s3mock-testcontainers from 5.0.0 to 5.1.0 by @dependabot[bot] in #6530
chore(deps-dev): Bump org.cyclonedx:cyclonedx-maven-plugin from 2.9.1 to 2.9.2 by @dependabot[bot] in #6531
chore(deps): Bump io.github.nscuro:versatile-core from 0.18.3 to 0.19.0 by @dependabot[bot] in #6532
chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.1 to 0.156.2 by @dependabot[bot] in #6533
chore(deps): Bump io.github.ascopes:protobuf-maven-plugin from 5.1.5 to 5.1.6 by @dependabot[bot] in #6550
chore(deps): Bump lib.swagger.version from 2.2.51 to 2.2.52 by @dependabot[bot] in #6547
chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.44 to 2.1.45 by @dependabot[bot] in #6557
chore(deps): Bump lib.logback.version from 1.5.34 to 1.5.35 by @dependabot[bot] in #6558
Import Jackson 3 BOM by @nscuro in #6560
chore(deps): Bump lib.logback.version from 1.5.35 to 1.5.36 by @dependabot[bot] in #6568
chore(deps): Bump actions/setup-java from 5.3.0 to 5.4.0 by @dependabot[bot] in #6576
chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.3 to 0.1.4 by @dependabot[bot] in #6577
chore(deps): Bump imjasonh/setup-crane from 0.6 to 0.7 by @dependabot[bot] in #6578
chore(deps): Bump actions/cache from 5.0.5 to 6.1.0 by @dependabot[bot] in #6579
chore(deps): Bump lib.logback.version from 1.5.36 to 1.5.37 by @dependabot[bot] in #6580
chore(deps): Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.1 to 5.6.2 by @dependabot[bot] in #6581
chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.2 to 0.156.3 by @dependabot[bot] in #6582
chore(deps): Bump com.google.cloud.sql:postgres-socket-factory from 1.28.4 to 1.28.6 by @dependabot[bot] in #6583
chore(deps): Bump io.github.ascopes:protobuf-maven-plugin from 5.1.6 to 5.1.7 by @dependabot[bot] in #6591
chore(deps): Bump org.junit:junit-bom from 6.1.0 to 6.1.1 by @dependabot[bot] in #6592
chore(deps): Bump org.postgresql:postgresql from 42.7.11 to 42.7.12 by @dependabot[bot] in #6594
chore(deps-dev): Bump com.diffplug.spotless:spotless-maven-plugin from 3.7.0 to 3.8.0 by @dependabot[bot] in #6595
chore(deps): Bump io.github.nscuro:versatile-core from 0.19.0 to 0.20.0 by @dependabot[bot] in #6610
chore(deps): Bump io.github.nscuro:versatile-core from 0.20.0 to 0.21.0 by @dependabot[bot] in #6616
chore(deps): Bump io.dropwizard.flywaydb:flyway-bom from 12.9.0 to 12.10.0 by @dependabot[bot] in #6631
chore(deps): Bump org.jdbi:jdbi3-bom from 3.53.0 to 3.54.0 by @dependabot[bot] in #6630
chore(deps): Bump lib.jetty.version from 12.1.10 to 12.1.11 by @dependabot[bot] in #6645
chore(deps): Bump docker/login-action from 4.2.0 to 4.4.0 by @dependabot[bot] in #6657
chore(deps): Bump io.smallrye.config:smallrye-config-bom from 3.17.2 to 3.18.0 by @dependabot[bot] in #6662
chore(deps): Bump docker/build-push-action from 7.2.0 to 7.3.0 by @dependabot[bot] in #6661
chore(deps): Bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6660
chore(deps): Bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6659
chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.4 to 0.1.5 by @dependabot[bot] in #6658
chore(deps): Bump org.postgresql:postgresql from 42.7.12 to 42.7.13 by @dependabot[bot] in #6681
chore(deps): Bump net.javacrumbs.json-unit:json-unit-assertj from 5.1.2 to 6.0.0 by @dependabot[bot] in #6680
chore(deps): Bump com.fasterxml.jackson:jackson-bom from 2.22.0 to 2.22.1 by @dependabot[bot] in #6695
chore(deps): Bump net.javacrumbs.json-unit:json-unit-assertj from 6.0.0 to 6.0.1 by @dependabot[bot] in #6693
chore(deps): Bump com.nimbusds:oauth2-oidc-sdk from 11.37.2 to 11.38 by @dependabot[bot] in #6728
chore(deps): Bump lib.logback.version from 1.5.37 to 1.5.38 by @dependabot[bot] in #6726
chore(deps): Bump com.google.crypto.tink:tink from 1.22.0 to 1.23.0 by @dependabot[bot] in #6725
chore(deps): Bump com.nimbusds:oauth2-oidc-sdk from 11.38 to 11.38.1 by @dependabot[bot] in #6752
chore(deps): Bump io.dropwizard.flywaydb:flyway-bom from 12.10.0 to 12.11.0 by @dependabot[bot] in #6751
chore(deps): Bump org.junit:junit-bom from 6.1.1 to 6.1.2 by @dependabot[bot] in #6750
chore(deps): Bump tools.jackson:jackson-bom from 3.2.0 to 3.2.1 by @dependabot[bot] in #6749
chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.5 to 0.1.6 by @dependabot[bot] in #6747
chore(deps): Bump actions/setup-java from 5.4.0 to 5.5.0 by @dependabot[bot] in #6746
chore(deps): Bump org.jetbrains.kotlin:kotlin-bom from 2.4.0 to 2.4.10 by @dependabot[bot] in #6782
chore(deps): Bump io.github.nscuro:versatile-core from 0.21.0 to 0.21.1 by @dependabot[bot] in #6777
chore(deps): Bump com.icegreen:greenmail-junit5 from 2.1.9 to 2.1.10 by @dependabot[bot] in #6776
chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.3 to 0.156.4 by @dependabot[bot] in #6774
chore(deps): Bump com.icegreen:greenmail-junit5 from 2.1.10 to 2.1.11 by @dependabot[bot] in #6788
chore(deps): Bump io.smallrye.config:smallrye-config-bom from 3.18.0 to 3.18.1 by @dependabot[bot] in #6787
chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.4 to 0.156.5 by @dependabot[bot] in #6802
chore(deps): Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 by @dependabot[bot] in #6815
chore(deps): Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #6813
chore(deps): Bump actions/setup-java from 5.5.0 to 5.6.0 by @dependabot[bot] in #6812
chore(deps): Bump com.uber.nullaway:nullaway from 0.13.7 to 0.13.8 by @dependabot[bot] in #6814
chore(deps): Bump io.dropwizard.flywaydb:flyway-bom from 12.11.0 to 13.0.0 by @dependabot[bot] in #6830
chore(deps-dev): Bump org.openapitools:openapi-generator-maven-plugin from 7.23.0 to 7.24.0 by @dependabot[bot] in #6829
chore(deps): Bump com.nimbusds:oauth2-oidc-sdk from 11.38.1 to 11.38.2 by @dependabot[bot] in #6846
Remove unused dependencies by @nscuro in #6848
chore(deps): Bump com.google.cloud.sql:postgres-socket-factory from 1.28.6 to 1.29.0 by @dependabot[bot] in #6878
chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.6 to 0.1.10 by @dependabot[bot] in #6876
chore(deps): Bump docker/login-action from 4.4.0 to 4.5.2 by @dependabot[bot] in #6875
chore(deps): Bump lib.logback.version from 1.5.38 to 1.6.0 by @dependabot[bot] in #6867
chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-11 to 1.5.7-12 by @dependabot[bot] in #6877
chore(deps): Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.2 to 5.6.3 by @dependabot[bot] in #6891
chore(deps-dev): Bump com.diffplug.spotless:spotless-maven-plugin from 3.8.0 to 3.9.0 by @dependabot[bot] in #6894
chore(deps-dev): Bump org.apache.felix:maven-bundle-plugin from 6.0.2 to 6.1.0 by @dependabot[bot] in #6893
chore(deps): Bump lib.logback.version from 1.6.0 to 1.6.1 by @dependabot[bot] in #6900
chore(deps): Bump org.jspecify:jspecify from 1.0.0 to 1.0.1 by @dependabot[bot] in #6905
chore(deps-dev): Bump org.cyclonedx:cyclonedx-maven-plugin from 2.9.2 to 2.9.3 by @dependabot[bot] in #6912
chore(deps): Bump io.github.jeremylong:open-vulnerability-clients from 9.0.5 to 9.0.6 by @dependabot[bot] in #6922
chore(deps): Bump io.dropwizard.flywaydb:flyway-bom from 13.0.0 to 13.1.0 by @dependabot[bot] in #6921
chore(deps): Bump docker/login-action from 4.5.2 to 4.6.0 by @dependabot[bot] in #6918
chore(deps): Bump actions/setup-java from 5.6.0 to 5.7.0 by @dependabot[bot] in #6917
chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.10 to 0.1.11 by @dependabot[bot] in #6916
chore(deps-dev): Bump com.tngtech.archunit:archunit-junit5 from 1.4.2 to 1.5.0 by @dependabot[bot] in #6946
chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.45 to 2.1.46 by @dependabot[bot] in #6942
chore(deps): Bump lib.jetty.version from 12.1.11 to 12.1.12 by @dependabot[bot] in #6941
chore(deps): Bump com.fasterxml.woodstox:woodstox-core from 7.2.1 to 7.2.2 by @dependabot[bot] in #6940
chore(deps): Bump lib.swagger.version from 2.2.52 to 2.2.53 by @dependabot[bot] in #6939
Fix directory of Dependabot docker ecosystem for 5.0.x branch by @nscuro in #6964
chore(deps): Bump com.icegreen:greenmail-junit5 from 2.1.11 to 2.1.12 by @dependabot[bot] in #6968
chore(deps): Bump io.dropwizard.flywaydb:flyway-bom from 13.1.0 to 13.2.0 by @dependabot[bot] in #6984
chore(deps): Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4 by @dependabot[bot] in #6986
chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.11 to 0.1.12 by @dependabot[bot] in #6998
chore(deps): Bump org.junit:junit-bom from 6.1.2 to 6.1.3 by @dependabot[bot] in #6999
chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-12 to 1.5.7-13 by @dependabot[bot] in #7000
chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.5 to 0.156.6 by @dependabot[bot] in #7015
chore(deps): Bump net.javacrumbs.json-unit:json-unit-assertj from 6.0.1 to 6.1.0 by @dependabot[bot] in #7016
chore(deps): Bump io.github.ascopes:protobuf-maven-plugin from 5.1.7 to 5.1.8 by @dependabot[bot] in #7017
chore(deps): Bump lib.logback.version from 1.6.1 to 1.6.2 by @dependabot[bot] in #7032
chore(deps): Bump org.apache.maven.extensions:maven-build-cache-extension from 1.2.3 to 1.3.0 by @dependabot[bot] in #7045
chore(deps): Bump net.javacrumbs.json-unit:json-unit-assertj from 6.1.0 to 6.2.0 by @dependabot[bot] in #7042
chore(deps): Bump io.github.nscuro:versatile-core from 0.21.1 to 0.22.0 by @dependabot[bot] in #7044
Bump Temurin base image to 25.0.4_7 by @nscuro in #7068
chore(deps): Bump lib.byte-buddy.version from 1.18.3 to 1.18.12 by @dependabot[bot] in #7084
chore(deps): Bump tools.jackson:jackson-bom from 3.2.1 to 3.2.2 by @dependabot[bot] in #7083
chore(deps): Bump com.diffplug.spotless:spotless-maven-plugin from 3.9.0 to 3.10.0 by @dependabot[bot] in #7082
chore(deps): Bump com.squareup.okhttp3:okhttp-jvm from 5.4.0 to 5.5.0 by @dependabot[bot] in #7081
chore(deps): Bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #7079
chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.12 to 0.1.13 by @dependabot[bot] in #7078
chore(deps): Bump lib.logback.version from 1.6.2 to 1.6.3 by @dependabot[bot] in #7080
Bump cyclonedx-core-java to 13.2.0 by @nscuro in #7102
chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-13 to 1.5.7-15 by @dependabot[bot] in #7108
chore(deps): Bump com.google.guava:guava from 33.6.0-jre to 33.7.1-jre by @dependabot[bot] in #7109
chore(deps): Bump dev.cel:cel from 0.13.1 to 0.14.0 by @dependabot[bot] in #7107
chore(deps): Bump io.dropwizard.flywaydb:flyway-bom from 13.2.0 to 13.3.0 by @dependabot[bot] in #7106
chore(deps-dev): Bump com.google.jimfs:jimfs from 1.3.1 to 1.3.2 by @dependabot[bot] in #7120
chore(deps): Bump lib.swagger.version from 2.2.53 to 2.2.54 by @dependabot[bot] in #7121
chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.46 to 2.1.47 by @dependabot[bot] in #7123
chore(deps): Bump io.micrometer:micrometer-bom from 1.17.0 to 1.17.1 by @dependabot[bot] in #7132

Documentation 📃

Document patch release procedure by @nscuro in #6367
Add contributor docs for portfolio access control by @nscuro in #6378
Add project structure docs by @nscuro in #6393
Improve ADR instructions by @nscuro in #6412
ADR for feature "Known Exploited Vulnerabilities" by @LukasChristel in #6315
Fix outdated dev services property description by @nscuro in #6462
Drop "strong" from possible dt.ldap.security-auth values by @nscuro in #6717
Add (retroactive) ADR for partitioning of metrics tables by @nscuro in #6720
Add contributor docs for nullability checking by @nscuro in #6742
Add contributor docs for interruptibility constraints by @nscuro in #6841
Fix S3 credential provider properties docs by @nscuro in #6997
Make README more visually pleasing by @nscuro in #7070
Fix duplicate ADR 036 numbering by @nscuro in #7074
docs: point README CI badges at main branch by @CJstate in #7096

Other Changes

Fix email notification publisher not populating the "From" header by @nscuro in #6334
Decouple policy condition API from JDO models by @nscuro in #6394
Decouple component/project properties APIs from JDO models by @nscuro in #6395
Add arch test for rejecting JDO model usage in REST API v1 by @nscuro in #6396
Decouple notification publisher API from JDO models by @nscuro in #6397
Decouple license group API from JDO models by @nscuro in #6398
Decouple repository API from JDO models by @nscuro in #6399
Decouple license API from JDO models by @nscuro in #6400
Decouple config property API from JDO models by @nscuro in #6401
Decouple violation analysis API from JDO models by @nscuro in #6402
Add e2e test for application of OWASP RR rating via VEX import by @nscuro in #6418
Only truncate tables between tests that have rows by @nscuro in #6427
Eliminate more unnecessary wait times in tests by @nscuro in #6428
Centralize test DB lifecycle and reuse across modules by @nscuro in #6429
Reuse testcontainers for dev mode by @nscuro in #6463
Auto-close issues that do not use an issue template by @nscuro in #6504
Use WireMock for NVD vuln data source tests by @nscuro in #6505
Replace Checkstyle with Spotless by @nscuro in #6513
Add 5.0.x branch to Dependabot config by @nscuro in #6599
Enable compile-time null-ness checks using NullAway by @nscuro in #6691
Expand JSpecify to vuln-data-source modules by @nscuro in #6719
Fix activity task backlog age widget in Grafana dashboard by @nscuro in #6832
Replace Maven UUID generator plugin with build helper plugin by @nscuro in #6838
Fix KafkaNotificationPublisherTest flakiness by @nscuro in #6842
Enable NullAway for dex modules by @nscuro in #6933
Disable SELinux for traefik container in dev Docker Compose setup by @volodymyr-jdev in #6937
Set format: binary in OpenAPI for multipart BOM upload by @gzm0 in #6958
Set format: bytes in OpenAPI for base64 BOM upload by @gzm0 in #6959
Make version parameter on project/lookup optional by @gzm0 in #6973
Add missing @consumes annotations by @gzm0 in #6978
Add zizmor CI job by @nscuro in #7008
Add CodeQL analysis by @nscuro in #7022
Add Claude skill for backport automation by @nscuro in #7024
Generate SLSA build provenance by @nscuro in #7026
Skip Maven enforcer for e2e module by @nscuro in #7057
Have release notes refer to upgrade notes by @nscuro in #7077

New Contributors

@basclaessen made their first contribution in #6374
@Xenira made their first contribution in #6373
@fahedouch made their first contribution in #6210
@GabrielBBaldez made their first contribution in #6426
@LukasChristel made their first contribution in #6315
@Clark1945 made their first contribution in #6431
@nissessenap made their first contribution in #6564
@bergerst made their first contribution in #6652
@taleodor made their first contribution in #6690
@Nihlus made their first contribution in #6769
@kamilkrzywanski made their first contribution in #6799
@adamtorokaccreativetg made their first contribution in #6853
@volodymyr-jdev made their first contribution in #6937
@gzm0 made their first contribution in #6958
@fffinkel made their first contribution in #6995
@fouad-j made their first contribution in #6874
@AKSHATSPAR made their first contribution in #6785
@mitsukado-shinagawa made their first contribution in #6640
@CJstate made their first contribution in #7096
@Suhas2109 made their first contribution in #7127

Full Changelog: 5.0.0...5.1.0