What's Changed
- chore: tidy changelog; highlighting 12.2.2 DB schema change by @chadlwilson in #8476
- build(deps): bump golang from 1.26.2-alpine to 1.26.3-alpine by @dependabot[bot] in #8492
- build(deps): bump org.apache.groovy:groovy-ant from 5.0.5 to 5.0.6 by @dependabot[bot] in #8491
- fix(reports): Correct XML report attribute denoting matched status for a suppressed vulnerability by @chadlwilson in #8487
- docs: correct Core Engine menu display by @chadlwilson in #8481
- chore: deprecate Nexus v2 support for removal by @chadlwilson in #8455
- build(deps): bump org.apache.maven.plugins:maven-invoker-plugin from 3.10.0 to 3.10.1 by @dependabot[bot] in #8480
- chore(fp): remove duplicate Jetty FPs already handled in hosted suppressions by @chadlwilson in #8486
- build(deps): bump slf4j.version from 2.0.17 to 2.0.18 by @dependabot[bot] in #8502
- fix: ensure working hostedSuppressions/RetireJS forceUpdate & correct cache validForHours checks by @chadlwilson in #8494
- fix(cli): correct displayed application name and deprecations in help text by @chadlwilson in #8496
- chore(fp): remove unnecessary prometheus suppressions by @chadlwilson in #8500
- test: fix expectations for RetireJS against AngularJS integration test by @chadlwilson in #8511
- fix: migrate git-commit-id-plugin to maintained io.github.git-commit-id coordinates by @Umesh042005 in #8473
- test: make yarn tests agnostic of corepack defaults by @chadlwilson in #8413
- chore(fp): remove unnecessary grpc suppressions by @chadlwilson in #8505
- chore(fp): use more conservative CPE 22 prefix suppression syntax to avoid false negatives by @chadlwilson in #8509
- fix: publish-suppressions action trigger by @jeremylong in #8516
- docs: clarify Sonatype Guide OSS Index suggestions by @chadlwilson in #8477
- build(deps): bump org.apache.maven.plugins:maven-enforcer-plugin from 3.6.2 to 3.6.3 by @dependabot[bot] in #8517
- ci: fix FP ops workflow to generate CPE regex for optional suffix matches by @chadlwilson in #8531
- ci: automatically publish suppressions after merged PRs by @chadlwilson in #8527
- fix(analyzer): detect OpenSSL 3.x in OpenSSLAnalyzer by @shawnjohnjr in #8484
- docs(cli): fix escaping by @chadlwilson in #8551
- build(deps): bump org.junit:junit-bom from 5.14.3 to 5.14.4 by @dependabot[bot] in #8547
- build(deps): bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 by @dependabot[bot] in #8556
- build(deps): bump org.apache.maven.plugins:maven-dependency-plugin from 3.10.0 to 3.11.0 by @dependabot[bot] in #8557
- build(deps-dev): bump org.apache.maven.plugins:maven-surefire-report-plugin from 3.5.5 to 3.5.6 by @dependabot[bot] in #8555
- build(deps-dev): bump org.eclipse.parsson:jakarta.json from 1.1.7 to 1.1.9 by @dependabot[bot] in #8552
- fix(core): add missing nvd.api.key entry to dependencycheck.properties by @anand1416 in #8549
- fix(fp): allow stricter matching of suppression CPE 2.2 URI prefixes to only whole parts by @chadlwilson in #8548
- build(deps): bump org.apache.maven.plugins:maven-site-plugin from 3.21.0 to 3.22.0 by @dependabot[bot] in #8545
- build(deps): bump org.json:json from 20251224 to 20260522 by @dependabot[bot] in #8546
- build(deps): Pin Lock Threads action to v6.0.2 SHA by @jeremylong with @Copilot in #8559
- build(deps): bump the actions-deps group with 4 updates by @dependabot[bot] in #8563
- build(deps): bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.5 to 3.5.6 by @dependabot[bot] in #8562
- fix: improve Java 17+ compatibility by removing jdiagnostics by @chadlwilson in #8565
- build(deps): bump golang from 1.26.3-alpine to 1.26.4-alpine by @dependabot[bot] in #8569
- build(deps): bump org.codehaus.gmavenplus:gmavenplus-plugin from 4.3.1 to 5.0.0 by @dependabot[bot] in #8568
- build(deps): bump com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.22.0 by @dependabot[bot] in #8561
- build(deps): bump org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15 by @dependabot[bot] in #8574
- fix(fp): extend service project suppression to all Maven artifacts by @chadlwilson in #8677
- fix(windows): use JAVA_HOME when java is not on PATH by @mohan485 in #8656
- docs: document configuration of Gradle connection timeouts by @chadlwilson in #8490
- build(deps-dev): bump com.github.spotbugs:spotbugs-maven-plugin from 4.9.8.3 to 4.10.2.0 by @dependabot[bot] in #8585
- fix(reports): render CVSSv4 baseScore = 0.0 in JSON+XML reports by @chadlwilson in #8663
- build(deps): bump the actions-deps group with 7 updates by @dependabot[bot] in #8647
- build(deps): bump httpcomponents.client.version from 5.6.1 to 5.6.2 by @dependabot[bot] in #8646
- build(deps-dev): bump org.sonatype.central:central-publishing-maven-plugin from 0.10.0 to 0.11.0 by @dependabot[bot] in #8615
- docs: fix Maven debug command in
configuration.mdby @JackPGreen in #8610 - chore(fp): remove Glassfish server suppressions duplicated into generated/hosted suppressions by @chadlwilson in #8604
- build(deps): bump com.github.spotbugs:spotbugs-annotations from 4.9.8 to 4.10.2 by @dependabot[bot] in #8586
- build(deps)!: bump maven-core from 3.6.3 to 3.8.1 by @jeremylong in #7612
- fix(tests): update failing retireJs test by @jeremylong in #8682
- build(deps): bump golang from 1.26.4-alpine to 1.26.5-alpine by @dependabot[bot] in #8655
- build(deps): bump org.apache.httpcomponents.core5:httpcore5 from 5.4.2 to 5.4.3 by @dependabot[bot] in #8635
- build(deps): bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 by @dependabot[bot] in #8684
- fix(fp): remove duplicate oracle:projects base suppression by @chadlwilson in #8688
- build(deps-dev): bump com.github.spotbugs:spotbugs-maven-plugin from 4.10.2.0 to 4.10.3.0 by @dependabot[bot] in #8687
- build(deps): bump com.github.spotbugs:spotbugs-annotations from 4.10.2 to 4.10.3 by @dependabot[bot] in #8686
- docs: document NVD 2.0 data feeds by @Eljees in #8680
- build(deps): bump org.jspecify:jspecify from 1.0.0 to 1.0.1 by @dependabot[bot] in #8683
- build(deps): bump the actions-deps group with 9 updates by @dependabot[bot] in #8690
- fix(core): reopen database after update failure by @Eljees in #8679
- build(deps): bump com.mysql:mysql-connector-j from 9.7.0 to 26.7.0 by @dependabot[bot] in #8685
- docs: Clarify how suppress items are matched against files by @kwin in #8354
- build(deps): bump commons-codec:commons-codec from 1.22.0 to 1.22.1 by @dependabot[bot] in #8696
- build(deps): bump httpcomponents.client.version from 5.6.2 to 5.6.3 by @dependabot[bot] in #8695
- build(deps): bump com.fasterxml.jackson:jackson-bom from 2.22.0 to 2.22.1 by @dependabot[bot] in #8694
- build(deps): bump org.jsoup:jsoup from 1.22.2 to 1.23.1 by @dependabot[bot] in #8693
- build(deps): bump org.apache.groovy:groovy-ant from 5.0.6 to 5.0.8 by @dependabot[bot] in #8692
- chore!: drop deprecated configuration, integration options & Nexus V2 Search support by @chadlwilson in #8691
- build(deps): bump open-vulnerability-clients from 9.0.5 to 9.0.6 by @jeremylong in #8697
- build(deps): bump logback from 1.5.32 to 1.5.34 by @jeremylong in #8698
New Contributors
- @shawnjohnjr made their first contribution in #8484
- @anand1416 made their first contribution in #8549
- @mohan485 made their first contribution in #8656
- @Eljees made their first contribution in #8680
Full Changelog: v12.2.2...v13.0.0