Important
Please read the upgrade notes before upgrading your instance.
What's Changed
Enhancements 🚀
- Backport: Refactor component metrics computation to avoid pathological query plans by @nscuro in #7364
Bug Fixes 🐛
- Backport: Run spotless:apply after Maven release plugin modifies them POM by @nscuro in #7140
- Backport: v4-migrator: Dedup PROJECT_PROPERTY rows of collapsed projects by @nscuro in #7360
- Backport: v4-migrator: Reconcile PROJECT collection logic and tag by @nscuro in #7361
- Backport: Add option to use Snyk's per-package endpoint when batching is not available by @nscuro in #7362
- Backport: Fix PURLs without version being submitted for analysis by @nscuro in #7363
- Backport: Remove unused LDAP properties by @nscuro in #7365
- Backport: Fix management server preventing shutdown on initialization failures by @nscuro in #7366
- Backport: Resolve project parent before other fields in updateProject by @nscuro in #7367
- Backport: Fix incorrect OpenAPI docs for POST /v1/project WRT parent semantics by @nscuro in #7368
- Backport: Fix project lookup endpoints not serving aggregate metrics for collection projects by @nscuro in #7369
- Backport: Fix DATASOURCE_MIRRORING notifications not being emitted by @nscuro in #7370
- Backport: Treat >=0 ranges as wildcard during vers matching by @nscuro in #7371
- Backport: Accumulate mirrored VulnerableSoftware by vulnerability key by @nscuro in #7373
- Backport: Fix Checkmarx model conversion NPEs by @nscuro in #7374
- Backport: Fix tag binding triggering unnecessary relationship loads by @nscuro in #7375
- Backport: Prevent NPEs during DataNucleus L1 cache eviction by @nscuro in #7376
- Backport: Fix proxy authentication for GitHub Advisories vuln data source by @nscuro in #7377
- Backport: Fix broken link to VulnCheck token creation by @nscuro in #7372
- Backport: Fix calculated CVSSv4 score only considering base metrics by @nscuro in #7378
- Backport: Fix NVD vuln data source iteration and watermarking issues by @nscuro in #7379
- Backport: Move vuln data source mirroring off JDO by @nscuro in #7384
- Backport: Fix lack of context in NVD & OSV unexpected status code exception messages by @nscuro in #7386
Dependency Updates 🤖
- chore(deps): Bump io.smallrye.config:smallrye-config-bom from 3.18.1 to 3.18.2 by @dependabot[bot] in #7144
- chore(deps): Bump com.networknt:json-schema-validator from 2.0.4 to 2.0.5 by @dependabot[bot] in #7147
- chore(deps): Bump com.networknt:json-schema-validator from 2.0.5 to 2.0.7 by @dependabot[bot] in #7154
- chore(deps): Bump the codeql group with 2 updates by @dependabot[bot] in #7158
- Bump com.uber.nullaway:nullaway from 0.13.8 to 0.14.0 by @dependabot[bot] in #7166
- Bump com.icegreen:greenmail-junit5 from 2.1.12 to 2.1.13 by @dependabot[bot] in #7190
- Bump com.adobe.testing:s3mock-testcontainers from 5.1.0 to 5.2.0 by @dependabot[bot] in #7189
- Bump actions/setup-java from 5.7.0 to 6.0.0 by @dependabot[bot] in #7191
- Bump org.openapitools:openapi-generator-maven-plugin from 7.24.0 to 7.25.0 by @dependabot[bot] in #7204
- Bump io.dropwizard.flywaydb:flyway-bom from 13.3.0 to 13.4.0 by @dependabot[bot] in #7221
- Bump org.apache.felix:maven-bundle-plugin from 6.1.0 to 6.1.2 by @dependabot[bot] in #7218
- Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.0 to 3.10.1 by @dependabot[bot] in #7219
- Bump com.github.luben:zstd-jni from 1.5.7-15 to 1.5.7-16 by @dependabot[bot] in #7233
- Bump org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0 by @dependabot[bot] in #7234
- Bump com.uber.nullaway:nullaway from 0.14.0 to 0.14.1 by @dependabot[bot] in #7235
- Bump the codeql group with 2 updates by @dependabot[bot] in #7236
- Bump oasdiff/oasdiff-action/breaking from 0.1.13 to 0.1.14 by @dependabot[bot] in #7237
- Bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 by @dependabot[bot] in #7238
- Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.6 to 3.6.0 by @dependabot[bot] in #7253
- Bump org.apache.maven.plugins:maven-surefire-report-plugin from 3.5.6 to 3.6.0 by @dependabot[bot] in #7252
- Bump lib.swagger.version from 2.2.54 to 2.2.55 by @dependabot[bot] in #7251
- Bump lib.protobuf-java.version from 4.36.0 to 4.36.1 by @dependabot[bot] in #7268
- Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0 by @dependabot[bot] in #7269
- Bump io.swagger.parser.v3:swagger-parser from 2.1.47 to 2.1.48 by @dependabot[bot] in #7270
- Bump lib.jetty.version from 12.1.12 to 12.1.13 by @dependabot[bot] in #7285
- Bump org.metaeffekt.core:ae-security from 0.156.6 to 0.157.0 by @dependabot[bot] in #7286
- Bump lib.byte-buddy.version from 1.18.12 to 1.18.13 by @dependabot[bot] in #7284
- Bump com.h2database:h2 from 2.4.240 to 2.5.250 by @dependabot[bot] in #7304
- Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.1 to 3.10.2 by @dependabot[bot] in #7305
- Bump docker/setup-qemu-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #7306
- Bump oasdiff/oasdiff-action/breaking from 0.1.14 to 0.1.15 by @dependabot[bot] in #7307
- Bump io.dropwizard.flywaydb:flyway-bom from 13.4.0 to 13.5.0 by @dependabot[bot] in #7303
- chore(deps): Bump io.github.openfeign:feign-bom from 13.13 to 13.14 by @dependabot[bot] in #7145
- Bump org.jetbrains.kotlin:kotlin-bom from 2.4.10 to 2.4.20 by @dependabot[bot] in #7320
- Bump org.slf4j:slf4j-bom from 2.0.18 to 2.0.19 by @dependabot[bot] in #7318
- Bump io.github.openfeign:feign-bom from 13.14 to 13.15 by @dependabot[bot] in #7325
- Bump alpine from 3.24.1 to 3.24.2 in /apiserver/src/main/docker by @dependabot[bot] in #7342
- Bump eclipse-temurin from
09349d7to541729cin /apiserver/src/main/docker by @dependabot[bot] in #7343 - Bump com.microsoft.sqlserver:mssql-jdbc from 13.4.0.jre11 to 13.6.0.jre11 by @dependabot[bot] in #7344
- Backport: Bump alpine base image to 3.24.2 by @nscuro in #7381
Other Changes
Full Changelog: 5.1.0...5.1.1