Important
Please read the upgrade notes before upgrading your instance.
What's Changed
Bug Fixes 🐛
- Backport: Fix invalid PURLs causing list API endpoints to fail by @nscuro in #7554
- Backport: Fix failure to match CPE with wildcard version and version range >=0 by @nscuro in #7555
- Backport: Fix internal vulns with finding attributions failing deletion by @nscuro in #7558
- Backport: PEP 503-normalize PyPI package names for vuln matching by @nscuro in #7559
- Backport: Fix manually assigned findings being deactivated on analysis by @nscuro in #7560
- Backport: Treat NuGet package names as case-insensitive for vuln matching by @nscuro in #7562
- Backport: Fix Trivy findings dropped for PURLs with URL-valued qualifiers by @nscuro in #7596
Dependency Updates 🤖
- Bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2 by @dependabot[bot] in #7402
- Bump org.apache.maven.plugins:maven-deploy-plugin from 3.1.4 to 3.2.0 by @dependabot[bot] in #7403
- Bump io.dropwizard.flywaydb:flyway-bom from 13.5.0 to 13.6.0 by @dependabot[bot] in #7404
- Bump io.github.jeremylong:open-vulnerability-clients from 9.0.6 to 9.0.7 by @dependabot[bot] in #7405
- Bump the codeql group with 2 updates by @dependabot[bot] in #7406
- Bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 by @dependabot[bot] in #7407
- Bump oasdiff/oasdiff-action/breaking from 0.1.15 to 0.1.16 by @dependabot[bot] in #7408
- Bump actions/setup-java from 6.0.0 to 6.0.1 by @dependabot[bot] in #7409
- Bump io.github.ascopes:protobuf-maven-plugin from 5.1.8 to 5.1.9 by @dependabot[bot] in #7416
- Bump lib.byte-buddy.version from 1.18.13 to 1.18.14 by @dependabot[bot] in #7418
- Bump org.apache.maven.plugins:maven-install-plugin from 3.1.4 to 3.2.0 by @dependabot[bot] in #7419
- Bump org.apache.felix:maven-bundle-plugin from 6.1.2 to 6.2.0 by @dependabot[bot] in #7417
- Bump io.prometheus:prometheus-metrics-bom from 1.8.0 to 1.9.0 by @dependabot[bot] in #7429
- Bump org.codehaus.mojo:exec-maven-plugin from 3.6.3 to 3.6.4 by @dependabot[bot] in #7430
- Bump io.github.nscuro:versatile-core from 0.24.0 to 0.25.0 by @dependabot[bot] in #7431
- Bump org.metaeffekt.core:ae-security from 0.157.0 to 0.157.1 by @dependabot[bot] in #7432
- Bump com.github.luben:zstd-jni from 1.5.7-16 to 1.5.7-17 by @dependabot[bot] in #7441
- Bump com.adobe.testing:s3mock-testcontainers from 5.2.0 to 5.2.2 by @dependabot[bot] in #7439
- Bump io.dropwizard.flywaydb:flyway-bom from 13.6.0 to 13.7.0 by @dependabot[bot] in #7442
- Bump io.smallrye.config:smallrye-config-bom from 3.18.2 to 3.18.3 by @dependabot[bot] in #7440
- Bump lib.protobuf-java.version from 4.36.1 to 4.36.2 by @dependabot[bot] in #7456
- Bump com.github.ben-manes.caffeine:caffeine from 3.2.4 to 3.3.0 by @dependabot[bot] in #7486
- Bump io.github.ascopes:protobuf-maven-plugin from 5.1.9 to 5.1.10 by @dependabot[bot] in #7487
- Bump com.github.luben:zstd-jni from 1.5.7-17 to 1.5.7-18 by @dependabot[bot] in #7488
- Bump com.icegreen:greenmail-junit5 from 2.1.13 to 2.1.14 by @dependabot[bot] in #7489
- Bump the codeql group with 2 updates by @dependabot[bot] in #7490
- Bump docker/setup-qemu-action from 4.3.0 to 4.4.0 by @dependabot[bot] in #7491
- Bump oasdiff/oasdiff-action/breaking from 0.1.16 to 0.1.17 by @dependabot[bot] in #7492
- Bump docker/setup-buildx-action from 4.3.0 to 4.4.1 by @dependabot[bot] in #7493
- Bump docker/build-push-action from 7.3.0 to 7.4.0 by @dependabot[bot] in #7494
- Bump org.eclipse.microprofile.config:microprofile-config-api from 3.1.1 to 3.1.2 by @dependabot[bot] in #7507
- Bump tools.jackson:jackson-bom from 3.2.2 to 3.2.3 by @dependabot[bot] in #7508
- Bump com.adobe.testing:s3mock-testcontainers from 5.2.2 to 5.2.3 by @dependabot[bot] in #7510
- Bump com.fasterxml.jackson:jackson-bom from 2.22.2 to 2.22.3 by @dependabot[bot] in #7509
- Bump org.slf4j:slf4j-bom from 2.0.19 to 2.0.20 by @dependabot[bot] in #7520
- Bump com.github.luben:zstd-jni from 1.5.7-18 to 1.5.7-19 by @dependabot[bot] in #7524
- Bump org.metaeffekt.core:ae-security from 0.157.1 to 0.157.2 by @dependabot[bot] in #7532
- Bump org.mockito:mockito-bom from 5.23.0 to 5.24.0 by @dependabot[bot] in #7531
- Bump io.dropwizard.flywaydb:flyway-bom from 13.7.0 to 13.8.0 by @dependabot[bot] in #7538
- Bump lib.logback.version from 1.6.3 to 1.6.4 by @dependabot[bot] in #7539
- Bump com.uber.nullaway:nullaway from 0.14.1 to 0.14.2 by @dependabot[bot] in #7540
- Backport: Bump versatile to 0.26.0 by @nscuro in #7556
- Bump eclipse-temurin from 25.0.4_7-jdk-alpine to 25.0.4.1_1-jdk-alpine in /apiserver/src/main/docker by @dependabot[bot] in #7575
- Bump com.tngtech.archunit:archunit-junit5 from 1.5.0 to 1.5.1 by @dependabot[bot] in #7576
- Bump org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0 by @dependabot[bot] in #7577
- Bump com.github.luben:zstd-jni from 1.5.7-19 to 1.5.7-20 by @dependabot[bot] in #7578
- Bump the codeql group with 2 updates by @dependabot[bot] in #7579
- Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.2 to 3.10.3 by @dependabot[bot] in #7589
- Bump com.h2database:h2 from 2.5.250 to 2.5.252 by @dependabot[bot] in #7590
- Bump org.jdbi:jdbi3-bom from 3.54.0 to 3.55.0 by @dependabot[bot] in #7591
Other Changes
- Backport: Improve effectiveness of caching in CI by @nscuro in #7550
- Backport: Disable caching in docker/setup-qemu-action by @nscuro in #7557
Full Changelog: 5.1.1...5.1.2