Important
Please read the upgrade notes before upgrading your instance.
What's Changed
Bug Fixes 🐛
- Backport: Accept pipe-separated UUIDs on dependency graph path by @nscuro in #7745
- Backport: Resolve BOM upload tokens to root workflow runs only by @nscuro in #7746
- Backport: Skip analyzer when checking if enabled fails by @nscuro in #7747
- Backport: Fix collection tag missing in project lookup response by @nscuro in #7748
- Backport: Fix BOM validation failing when XML contains CDATA by @nscuro in #7750
- Backport: Map unknown or retired vulnerability sources to UNKNOWN in v4-migrator by @nscuro in #7752
- Backport: Remove eMudhra from container image cacerts by @nscuro in #7760
- Backport: Fix tag maintenance failing when tag is used only by collection projects by @nscuro in #7761
- Backport: Fix ineffective ACL check for
/v1/finding/project/{uuid}/analyzeby @nscuro in #7777
Dependency Updates 🤖
- Bump com.networknt:json-schema-validator from 2.0.4 to 2.0.7 by @dependabot[bot] in #7629
- Bump org.glassfish.jersey:jersey-bom from 4.0.2 to 4.0.3 by @dependabot[bot] in #7630
- Bump oasdiff/oasdiff-action/breaking from 0.1.17 to 0.1.18 by @dependabot[bot] in #7634
- Bump io.dropwizard.flywaydb:flyway-bom from 13.8.0 to 13.8.1 by @dependabot[bot] in #7639
- Bump com.networknt:json-schema-validator from 2.0.7 to 2.0.8 by @dependabot[bot] in #7640
- Bump org.metaeffekt.core:ae-security from 0.157.2 to 0.158.0 by @dependabot[bot] in #7660
- Bump io.dropwizard.flywaydb:flyway-bom from 13.8.1 to 13.9.0 by @dependabot[bot] in #7661
- Bump commons-codec:commons-codec from 1.22.1 to 1.23.0 by @dependabot[bot] in #7662
- Bump com.github.luben:zstd-jni from 1.5.7-20 to 1.5.7-21 by @dependabot[bot] in #7663
- Bump io.github.nscuro:versatile-core from 0.26.0 to 0.26.1 by @dependabot[bot] in #7678
- Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.4 to 5.6.5 by @dependabot[bot] in #7679
- Bump lib.jetty.version from 12.1.13 to 12.1.14 by @dependabot[bot] in #7680
- Bump net.javacrumbs.json-unit:json-unit-assertj from 6.2.0 to 6.3.0 by @dependabot[bot] in #7681
- Bump org.jetbrains.kotlin:kotlin-bom from 2.4.20 to 2.4.21 by @dependabot[bot] in #7688
- Bump org.openapitools:openapi-generator-maven-plugin from 7.25.0 to 7.26.0 by @dependabot[bot] in #7689
- Bump com.github.luben:zstd-jni from 1.5.7-21 to 1.5.7-22 by @dependabot[bot] in #7690
- Bump io.github.openfeign:feign-bom from 13.15 to 13.16 by @dependabot[bot] in #7692
- Bump org.apache.kafka:kafka-clients from 4.3.1 to 4.4.0 by @dependabot[bot] in #7691
- Bump org.postgresql:postgresql from 42.7.13 to 42.7.14 by @dependabot[bot] in #7701
- Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.3 to 3.10.4 by @dependabot[bot] in #7702
- Bump io.github.openfeign:feign-bom from 13.16 to 13.17 by @dependabot[bot] in #7703
- Bump actions/download-artifact from 8.0.1 to 8.0.2 by @dependabot[bot] in #7719
- Bump org.metaeffekt.core:ae-security from 0.158.0 to 0.159.0 by @dependabot[bot] in #7715
- Bump com.github.luben:zstd-jni from 1.5.7-22 to 1.5.7-23 by @dependabot[bot] in #7716
- Bump the codeql group with 2 updates by @dependabot[bot] in #7717
- Bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #7718
- Bump com.github.ben-manes.caffeine:caffeine from 3.3.0 to 3.3.1 by @dependabot[bot] in #7727
- Bump lib.byte-buddy.version from 1.18.14 to 1.18.15 by @dependabot[bot] in #7729
- Bump com.microsoft.sqlserver:mssql-jdbc from 13.6.0.jre11 to 13.6.1.jre11 by @dependabot[bot] in #7735
- Backport: Bump Alpine base image to 3.24.3 by @nscuro in #7766
- Bump io.prometheus:prometheus-metrics-bom from 1.9.0 to 1.10.0 by @dependabot[bot] in #7769
- Bump com.google.crypto.tink:tink from 1.23.0 to 1.24.0 by @dependabot[bot] in #7772
- Backport: Bump cyclonedx-core-java to 13.4.0 by @nscuro in #7778
Other Changes
Full Changelog: 5.2.0...5.2.1