Skip to content

Releases: advanced-security/maven-dependency-submission-action

v5.0.0

21 May 19:37
b275d12
Compare
Choose a tag to compare

Improved multi-module support

This release improves multi-module support by reflecting which pom.xml file brings in a particular dependency. Previously, the dependencies were aggregated into the top-level pom.xml file. If a given package is brought in via multiple modules, that package will be reflected in all of the modules that reference it.

Because of this change in behavior, we've removed two configuration options:

  • snapshot-dependency-file-name: no longer applicable since we submit more than one manifest
  • snapshot-include-file-name: this flag determined whether the manifest object included the file path. It should always be available and there's no reason to omit it, so we've removed the flag.

v4.1.3

19 May 21:53
fe8d4d6
Compare
Choose a tag to compare

The release bumps dependency versions to stay up-to-date.

v4.1.2

04 Apr 20:06
aeab9f8
Compare
Choose a tag to compare

What's Changed

  • Add cycle safety for transitive dependencies by @juxtin in #103

New Contributors

Full Changelog: v4...v4.1.2

v4.1.1

07 Aug 14:33
Compare
Choose a tag to compare
chore: Updating release files

v4.1.0

03 Jul 10:01
Compare
Choose a tag to compare
  • Adds the ability to change the detector details for the dependency snapshots via the optional input parameters:

    • detector-name
    • detector-url
    • detector-version

    If the detector-name is specified, then all three become mandatory as there are no sensible defaults that can be attributed to the values.

v4.0.3

29 Apr 10:25
Compare
Choose a tag to compare
  • Updating the build process and tooling for Node 20 support in the CLI executables which were introduced when the dependency-submission-toolkit transitioned in to an ESM module

  • Fixes #69 #61

v4.0.2

05 Mar 16:35
Compare
Choose a tag to compare
chore: Updating release files

v4.0.1

15 Feb 16:43
Compare
Choose a tag to compare
  • Updating branding for the marketplace
  • Utilizing rollup to build cli executables as the ESM module for the dependency-submission-toolkit broke the 4.0.0 pkg based executable builds.

v4.0.0

23 Jan 16:34
Compare
Choose a tag to compare

Version 4.0.0 release:

  • Breaking change, the name presented in the submission report now matches the current name of the repository maven-dependency-submission-action (previously it was moved from a repository called maven-dependency-tree-action)
  • When running the GitHub Action the ref and sha are injected as inputs (with defaults to the current workflow values)
  • Updated dependencies, specifically dependency-submission-toolkit that includes improvements to uploading of the snapshots and error handling around unhappy path scenarios
  • CLI application options made compatible with the GitHub Actions inputs
  • CLI applications made available as part of the release process and notes
  • Project testing and releases - swapped jest out for vitest and added GitHub Actions release workflow

v3.0.3

19 Oct 11:32
fcd7eab
Compare
Choose a tag to compare
  • Fixes issue with POMs that set a non-default outputDirectory resulting is no dependency data being found and uploaded #48.