5.0.4

What's Changed

Enhancements 🚀

• Backport: dex: Make query timeout configurable by @nscuro in #6855
• Backport: dex: improve workflow task scheduling performance for deep backlogs with concurrency keys by @nscuro in #6858
• Backport: dex: execute multiple deletion batches per maintenance cycle by @nscuro in #6860
• Backport: dex: enforce execution timeout for activities by @nscuro in #6861
• Backport: dex: define default activity execution timeout by @nscuro in #6862
• Backport: dex: automatically heartbeat activities by @nscuro in #6864
• Backport: Improve responsiveness to thread interruptions by @nscuro in #6863

Bug Fixes 🐛

• Backport: Exclude project from components loaded during ImportBomActivity by @nscuro in #6856
• Backport: Fix failure to emit notification when vulnerability description is empty by @nscuro in #6857
• Backport: dex: fix too eager consumption of concurrency key wakeup hints by @nscuro in #6859
• Backport: Strip trailing / from baseUrl notification template variable by @nscuro in #6865

Dependency Updates 🤖

• chore(deps): Bump com.icegreen:greenmail-junit5 from 2.1.9 to 2.1.10 by @dependabot[bot] in #6784
• chore(deps): Bump org.jetbrains.kotlin:kotlin-bom from 2.4.0 to 2.4.10 by @dependabot[bot] in #6783
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.3 to 0.156.4 by @dependabot[bot] in #6780
• chore(deps): Bump com.icegreen:greenmail-junit5 from 2.1.10 to 2.1.11 by @dependabot[bot] in #6791
• chore(deps): Bump io.smallrye.config:smallrye-config-bom from 3.18.0 to 3.18.1 by @dependabot[bot] in #6790
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.4 to 0.156.5 by @dependabot[bot] in #6803
• chore(deps): Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 by @dependabot[bot] in #6821
• chore(deps): Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #6820
• chore(deps): Bump actions/setup-java from 5.5.0 to 5.6.0 by @dependabot[bot] in #6819
• chore(deps-dev): Bump org.openapitools:openapi-generator-maven-plugin from 7.23.0 to 7.24.0 by @dependabot[bot] in #6831
• chore(deps): Bump com.nimbusds:oauth2-oidc-sdk from 11.38.1 to 11.38.2 by @dependabot[bot] in #6847
• chore(deps): Bump io.github.nscuro:versatile-core from 0.18.3 to 0.21.1 by @dependabot[bot] in #6781

Full Changelog: 5.0.3...5.0.4

5.0.3

What's Changed

Enhancements 🚀

• Backport: Optimize portfolio-wide findings queries by @nscuro in #6571
• Backport: Improve default data source config by @nscuro in #6732
• Backport: dex: add missing indexes on workflow_run_id in task tables by @nscuro in #6733
• Backport: dex: improve activity task scheduler polling efficiency for deep backlogs by @nscuro in #6735
• Backport: Improve classification of retryable vuln analysis errors by @nscuro in #6745

Bug Fixes 🐛

• Backport: Fix getAffectedProjects endpoint not accounting for suppressed findings by @nscuro in #6541
• Backport: Fix badges for collection projects showing no metrics by @nscuro in #6540
• Backport: Fix excessive churn of vulnerable software associations during mirroring by @nscuro in #6543
• Backport: Fix slow vulnerability database maintenance by @nscuro in #6544
• Backport: Raise lock timeout for mirror-vuln-data-source activities and set explicit request timeouts for NVD downloads by @nscuro in #6542
• Backport: exit the JVM when init tasks fail instead of hanging unready by @nscuro in #6712
• Backport: Fix project sorting by version by @nscuro in #6715
• Backport: Fix prepare-vuln-analysis activity failing when components have properties without value by @nscuro in #6714
• Backport: Fix local file storage not anticipating Windows-style paths by @nscuro in #6713
• Backport: Fix build workflow not running for PRs to release branches by @nscuro in #6738
• Backport: Fix NPE and redundant queries in VEX/VDR export by @nscuro in #6743

Dependency Updates 🤖

• Backport: chore(deps): Bump oasdiff/oasdiff-action from 0.0.48 to 0.0.51 by @nscuro in #6611
• chore(deps): Bump actions/cache from 5.0.5 to 6.1.0 by @dependabot[bot] in #6609
• chore(deps): Bump actions/setup-java from 5.2.0 to 5.4.0 by @dependabot[bot] in #6607
• chore(deps): Bump docker/setup-qemu-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6605
• chore(deps-dev): Bump org.cyclonedx:cyclonedx-maven-plugin from 2.9.1 to 2.9.2 by @dependabot[bot] in #6602
• chore(deps): Bump org.junit:junit-bom from 6.1.0 to 6.1.1 by @dependabot[bot] in #6601
• chore(deps): Bump imjasonh/setup-crane from 0.5 to 0.7 by @dependabot[bot] in #6600
• chore(deps): Bump actions/checkout from 6.0.2 to 7.0.0 by @dependabot[bot] in #6603
• chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-9 to 1.5.7-11 by @dependabot[bot] in #6606
• chore(deps): Bump lib.swagger.version from 2.2.50 to 2.2.52 by @dependabot[bot] in #6604
• chore(deps): Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.1 to 5.6.2 by @dependabot[bot] in #6622
• chore(deps): Bump io.takari.maven:takari-smart-builder from 1.1.0 to 1.1.1 by @dependabot[bot] in #6620
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.155.0 to 0.156.3 by @dependabot[bot] in #6619
• chore(deps): Bump lib.protobuf-java.version from 4.35.0 to 4.35.1 by @dependabot[bot] in #6618
• chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.43 to 2.1.45 by @dependabot[bot] in #6621
• chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.4.2 to 13.7.0 by @dependabot[bot] in #6635
• chore(deps): Bump com.fasterxml.woodstox:woodstox-core from 7.2.0 to 7.2.1 by @dependabot[bot] in #6634
• chore(deps): Bump dev.cel:cel from 0.13.0 to 0.13.1 by @dependabot[bot] in #6636
• chore(deps): Bump io.dropwizard.flywaydb:flyway-bom from 12.6.1 to 12.10.0 by @dependabot[bot] in #6632
• chore(deps): Bump lib.logback.version from 1.5.33 to 1.5.37 by @dependabot[bot] in #6633
• chore(deps): Bump com.squareup.okhttp3:okhttp-jvm from 5.3.2 to 5.4.0 by @dependabot[bot] in #6644
• chore(deps): Bump org.jetbrains.kotlin:kotlin-bom from 2.3.21 to 2.4.0 by @dependabot[bot] in #6646
• chore(deps-dev): Bump org.apache.maven.plugins:maven-surefire-report-plugin from 3.5.5 to 3.5.6 by @dependabot[bot] in #6648
• chore(deps-dev): Bump org.openapitools:openapi-generator-maven-plugin from 7.22.0 to 7.23.0 by @dependabot[bot] in #6649
• chore(deps): Bump org.apache.kafka:kafka-clients from 4.3.0 to 4.3.1 by @dependabot[bot] in #6647
• chore(deps): Bump com.icegreen:greenmail-junit5 from 2.1.8 to 2.1.9 by @dependabot[bot] in #6675
• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.0.51 to 0.1.5 by @dependabot[bot] in #6674
• chore(deps): Bump io.minio:minio from 9.0.1 to 9.0.3 by @dependabot[bot] in #6673
• chore(deps): Bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6671
• chore(deps): Bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6669
• chore(deps): Bump io.github.openfeign:feign-bom from 13.12 to 13.13 by @dependabot[bot] in #6668
• chore(deps): Bump com.google.crypto.tink:tink from 1.21.0 to 1.22.0 by @dependabot[bot] in #6667
• chore(deps): Bump docker/build-push-action from 7.2.0 to 7.3.0 by @dependabot[bot] in #6676
• chore(deps): Bump docker/login-action from 4.2.0 to 4.4.0 by @dependabot[bot] in #6672
• chore(deps-dev): Bump com.zaxxer:HikariCP from 7.0.2 to 7.1.0 by @dependabot[bot] in #6670
• chore(deps): Bump io.micrometer:micrometer-bom from 1.16.5 to 1.17.0 by @dependabot[bot] in #6685
• chore(deps): Bump com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.22.0 by @dependabot[bot] in #6684
• chore(deps): Bump io.github.ascopes:protobuf-maven-plugin from 5.1.4 to 5.1.7 by @dependabot[bot] in #6683
• chore(deps): Bump io.prometheus:prometheus-metrics-bom from 1.6.1 to 1.8.0 by @dependabot[bot] in #6686
• chore(deps): Bump org.eclipse.parsson:jakarta.json from 1.1.7 to 1.1.9 by @dependabot[bot] in #6700
• chore(deps): Bump com.google.cloud.sql:postgres-socket-factory from 1.28.3 to 1.28.6 by @dependabot[bot] in #6699
• chore(deps): Bump org.jdbi:jdbi3-bom from 3.53.0 to 3.54.0 by @dependabot[bot] in #6698
• chore(deps): Bump org.postgresql:postgresql from 42.7.11 to 42.7.13 by @dependabot[bot] in #6697
• chore(deps): Bump lib.jetty.version from 12.1.9 to 12.1.11 by @dependabot[bot] in #6696
• chore(deps): Bump io.pebbletemplates:pebble from 4.1.1 to 4.1.2 by @dependabot[bot] in #6708
• chore(deps): Bump com.fasterxml.jackson:jackson-bom from 2.22.0 to 2.22.1 by @dependabot[bot] in #6709
• chore(deps): Bump com.adobe.testing:s3mock-testcontainers from 5.0.0 to 5.1.0 by @dependabot[bot] in #6707
• chore(deps): Bump io.smallrye.config:smallrye-config-bom from 3.17.2 to 3.18.0 by @dependabot[bot] in https://github.com/DependencyTrack/dependency-tra...

4.14.3

For official releases, refer to Dependency Track Docs >> Changelogs for information about improvements and upgrade notes.
If additional details are required, consult the closed issues for this release milestone.

# SHA1
40db3eb67df441382971c8fb6566b86bc65976f4  dependency-track-apiserver.jar
71a8e224166a55efb163922bb9874c151b3d95eb  dependency-track-bundled.jar
# SHA256
11a5c85616b745803b5653016d9da2195f2e23ac66fe6a85d2ae2b4661d393a9  dependency-track-apiserver.jar
4cbedd435f0f07b520216e4c30b9c81ca9a43044c569285ed1aa2e4f1533f5be  dependency-track-bundled.jar
# SHA512
804247f629c5b5bac7f7c667789478163c8f6fcbaa9b4a7978ebcb57766d4134e9d026e92c156981f8c717b390c5cc4ba1fc837afef661e653aee8e7096d2a6a  dependency-track-apiserver.jar
e047a7be9bac2b76e1f2a42722ca723a60b9b093e2bff3ed5df407a27e25a77ab6467c15ad124907fd5213781bff493e80e5563400360befb603f8e184463235  dependency-track-bundled.jar

What's Changed

Enhancements 🚀

• Improve VEX import performance by @nscuro in #6141
• Update workflows for 4.14.x maintenance by @nscuro in #6171
• Send groupby to defect dojo by @webdevred in #6130
• Include analysis.detail in DefectDojo finding payload by @webdevred in #6181

Bug Fixes 🐛

• Exclude retrieval of components and aliases during OSVDownloadTask by @ElenaStroebele in #6345
• Backport: Reject parent objects with null UUID when creating/updating/patching projects by @nscuro in #6355
• Fix Docker Hub secret names by @nscuro in #6390
• Fix NPE and redundant queries in VEX/VDR export by @heyiamwahab236 in #6614

Dependency Updates 🤖

• build(deps): bump debian from 8f0c555 to a053c41 in /src/main/docker by @dependabot[bot] in #6126
• build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by @dependabot[bot] in #6142
• build(deps): bump docker/login-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6143
• build(deps-dev): bump io.github.ascopes:protobuf-maven-plugin from 5.1.3 to 5.1.4 by @dependabot[bot] in #6144
• build(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by @dependabot[bot] in #6145
• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in #6146
• build(deps): bump docker/build-push-action from 6.19.2 to 7.1.0 by @dependabot[bot] in #6147
• build(deps): bump lib.protobuf-java.version from 4.34.1 to 4.35.0 by @dependabot[bot] in #6158
• build(deps): bump debian from a053c41 to 5012d05 in /src/main/docker by @dependabot[bot] in #6157
• build(deps-dev): bump io.swagger.parser.v3:swagger-parser from 2.1.41 to 2.1.42 by @dependabot[bot] in #6155
• build(deps): bump org.slf4j:log4j-over-slf4j from 2.0.17 to 2.0.18 by @dependabot[bot] in #6154
• build(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @dependabot[bot] in #6148
• build(deps): bump eclipse-temurin from 25.0.2_10-jdk-alpine to 25.0.3_9-jdk-alpine in /src/main/docker by @dependabot[bot] in #6161
• build(deps): bump org.metaeffekt.core:ae-security from 0.154.0 to 0.155.0 by @dependabot[bot] in #6164
• build(deps): bump org.apache.maven:maven-artifact from 3.9.15 to 3.9.16 by @dependabot[bot] in #6160
• chore(deps): Bump docker/build-push-action from 7.1.0 to 7.2.0 by @dependabot[bot] in #6177
• chore(deps): Bump dessant/lock-threads from 6.0.0 to 6.0.1 by @dependabot[bot] in #6174
• chore(deps): Bump dessant/lock-threads from 6.0.1 to 6.0.2 by @dependabot[bot] in #6236
• chore(deps): Bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6235
• chore(deps): Bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6234
• chore(deps): Bump com.google.cloud.sql:postgres-socket-factory from 1.28.3 to 1.28.4 by @dependabot[bot] in #6256
• chore(deps): Bump com.google.cloud.sql:cloud-sql-connector-jdbc-sqlserver from 1.28.3 to 1.28.4 by @dependabot[bot] in #6258
• chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.42 to 2.1.43 by @dependabot[bot] in #6259
• chore(deps): Bump com.google.cloud.sql:mysql-socket-factory-connector-j-8 from 1.28.3 to 1.28.4 by @dependabot[bot] in #6257
• chore(deps): Bump io.github.nscuro:versatile-core from 0.18.1 to 0.18.3 by @dependabot[bot] in #6339
• chore(deps): Bump alpine from 3.23 to 3.24 in /src/main/docker by @dependabot[bot] in #6337
• chore(deps): Bump io.pebbletemplates:pebble from 4.1.1 to 4.1.2 by @dependabot[bot] in #6300
• chore(deps): Bump docker/setup-qemu-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6299
• chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.3.0 to 13.5.0 by @dependabot[bot] in #6301
• chore(deps): Bump debian from 5012d05 to da0bfd2 in /src/main/docker by @dependabot[bot] in #6370
• chore(deps): Bump debian from da0bfd2 to 34363c2 in /src/main/docker by @dependabot[bot] in #6384
• build(deps): bump com.fasterxml.woodstox:woodstox-core from 7.1.1 to 7.2.0 by @dependabot[bot] in #6168
• Bump Alpine to 3.8.0 by @nscuro in #6391
• chore(deps): Bump com.fasterxml.woodstox:woodstox-core from 7.2.0 to 7.2.1 by @dependabot[bot] in #6409
• chore(deps): Bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #6410
• chore(deps): Bump lib.protobuf-java.version from 4.35.0 to 4.35.1 by @dependabot[bot] in #6425
• chore(deps): Bump alpine from a2d49ea to f5064d3 in /src/main/docker by @dependabot[bot] in #6421
• chore(deps): Bump alpine from 3.24 to 3.24.1 in /src/main/docker by @dependabot[bot] in #6432
• chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.43 to 2.1.44 by @dependabot[bot] in #6469
• chore(deps-dev): Bump com.icegreen:greenmail-junit5 from 2.1.8 to 2.1.9 by @dependabot[bot] in #6484
• chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.5.0 to 13.6.0 by @dependabot[bot] in #6485
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.155.0 to 0.156.0 by @dependabot[bot] in #6486
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.0 to 0.156.1 by @dependabot[bot] in #6489
• chore(deps): Bump eclipse-temurin from c3e62cd to c3e62cd in /src/main/docker by @dependabot[bot] in #6487
• chore(deps): Bump debian from 34363c2 to ee12ffb in /src/main/docker by @dependabot[bot] in #6503
• chore(deps-dev): Bump io.github.ascopes:protobuf-maven-plugin from 5.1.4 to 5.1.5 by @dependabot[bot] in #6510
• chore(deps): Bump io.github.nscuro:versatile-core from 0.18.3 to 0.19.0 by @dependabot[bot] in #6534
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.1 to 0.156.2 by @dependabot[bot] in #6535
• chore(deps): Bump actions/setup-java from 5.2.0 to 5.3.0 by @dependabot[bot] in #6536
• chore(deps): Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #6537...

5.0.2

What's Changed

Bug Fixes 🐛

• Backport: Fix bad CPE query performance for internal vuln analyzer by @nscuro in #6441
• Backport: Fix admin re-seeding when USER table is populated by @nscuro in #6442
• Backport: v4-migrator: Don't migrate obsolete notification groups for notification rules by @nscuro in #6444
• Backport: dex: Fix over-reporting of activity task queue depth metric by @nscuro in #6447
• Backport: Fix duplicate project name/version handling for /v1/project POST and PATCH endpoints by @nscuro in #6448
• Backport: Fix MIME type of email notification templates not being set correctly by @nscuro in #6455

Dependency Updates 🤖

• Backport: Bump Alpine base image to 3.24.1 by @nscuro in #6451

Full Changelog: 5.0.1...5.0.2

5.0.1

What's Changed

Enhancements 🚀

• Backport: v4-migrator: Add TCP keepalive and optional socket timeout by @nscuro in #6348
• Backport: v4-migrator: Fail fast when detecting bootstrap being pointed at v4 database by @nscuro in #6361
• Backport: Allow out-of-order execution of Flyway migrations by @nscuro in #6366

Bug Fixes 🐛

• Backport: Make REPOSITORY.AUTHENTICATIONREQUIRED non-nullable by @nscuro in #6349
• Backport: Apply stricter PURL normalization for NPM package metadata resolution by @nscuro in #6350
• Backport: Bypass outbox for notification rule tests by @nscuro in #6351
• Backport: Fix NO_PROXY being rejected as legacy Alpine property by @nscuro in #6352
• Backport: Reject parent objects with null UUID when creating/updating/patching projects by @nscuro in #6354
• Backport: v4-migrator: only run post-load actions when load phase completes successfully by @nscuro in #6353
• Backport: Fix NPE during LDAP auth when bind credentials are not configured by @nscuro in #6356
• Backport: Fix suppressed vulns being considered for policy evaluation by @nscuro in #6357
• Backport: Fix incomplete field coverage of /v1/finding/project/{uuid}'s searchText filter by @nscuro in #6358
• Backport: Fix OIDC UserInfo endpoint not being invoked when team sync is enabled and ID token contains no teams claim by @nscuro in #6359
• Backport: Fix URL-encoding of OSV ecosystem names by @nscuro in #6360
• Backport: Support non-UTC timezones for metrics operations by @nscuro in #6363
• Backport: Fix email notification publisher not populating the "From" header by @nscuro in #6362
• Backport: v4-migrator: Fix confusing debug log for missing tgt_permission table by @nscuro in #6364
• Backport: Fix URL-encoding of OSV ecosystem names when retrieving incremental advisories by @nscuro in #6375
• Backport: Handle PAC-inaccessible target projects more gracefully for BOM uploads with autoCreate=true by @nscuro in #6377
• Backport: Fix broken HTTP proxy basic auth by @nscuro in #6381
• Backport: Fix team of API key not being auto-assigned project access after project creation by @nscuro in #6389

Full Changelog: 5.0.0...5.0.1

5.0.0

Warning

Upgrading from v4 requires manual action.

• Migration is manual. See the migration guide. v4 must be ≥ 4.14.2 and offline during the upgrade. v5 requires PostgreSQL 14+ (H2, MySQL, SQL Server dropped).
• See Changes in v5 for what's new and what changed, including container-only distribution (no more WAR), REST API v1 changes, and new notification schemas.
• The official Helm chart is not yet compatible and fails rendering on v5 tags. Hold off if you deploy via Helm. See the Kubernetes deployment guide.

What's Changed

Enhancements 🚀

• Add problem type for invalid sort field errors by @nscuro in #6281
• Change tie-breaker sort columns for finding queries to allow more efficient sorting by @nscuro in #6289

Bug Fixes 🐛

• Fix LocalFileStorageTest flakiness by @nscuro in #6282
• v4-migrator: Grant SECRET_MANAGEMENT to principals with SYSTEM_CONFIGURATION permission by @nscuro in #6283
• Do not suggest internal sort tie-breaker columns as sortable via API by @nscuro in #6286
• Fix AuthZ being enforced on CORS preflight requests by @nscuro in #6288

Documentation 📃

• Add quickstart section to README by @nscuro in #6287
• Update README for GA release by @nscuro in #6290

Other Changes

• Remove unused code and unnecessary indirections by @nscuro in #6284

Full Changelog: 5.0.0-rc.5...5.0.0

5.0.0-rc.5

What's Changed

Enhancements 🚀

• v4-migrator: Add completion logs and annotate row-count diffs in verify phase by @nscuro in #6261
• Include isLatest flag in nested versions object of /api/v1/project responses by @nscuro in #6263
• Support component hash mismatch policy conditions by @nscuro in #6266
• Make latest version publish timestamp available to CEL policy engine by @nscuro in #6267

Bug Fixes 🐛

• v4-migrator: Explicitly cast ID columns to BIGINT during extract phase by @nscuro in #6253
• Fix missing allowed permission for /api/v2/projects/{uuid}/clone by @nscuro in #6262
• Fix missing fields from GET /api/v1/project response by @nscuro in #6275
• Fix EPSS < and <= policy conditions matching when vuln has no EPSS score by @nscuro in #6274
• Improve escaping of quoted strings for CEL policy inputs by @nscuro in #6276
• Restore legacy behavior of LICENSE and LICENSE_GROUP policy conditions by @nscuro in #6273
• v4-migrator: Fix scheduled notification rules not being migrated by @nscuro in #6277

Dependency Updates 🤖

• chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.42 to 2.1.43 by @dependabot[bot] in #6254
• chore(deps): Bump lib.logback.version from 1.5.32 to 1.5.33 by @dependabot[bot] in #6255
• chore(deps): Bump net.javacrumbs.json-unit:json-unit-assertj from 5.1.1 to 5.1.2 by @dependabot[bot] in #6270
• chore(deps): Bump com.github.kagkarlsson:db-scheduler from 16.10.0 to 16.11.0 by @dependabot[bot] in #6269

Documentation 📃

• Add community meeting reference to README by @nscuro in #6265
• Update ADR-011 with follow-up about Kafka removal by @nscuro in #6278
• Document expected ADR format and writing style by @nscuro in #6279

Other Changes

• Always run manifest generation for DN plugin, even when restoring from cache by @nscuro in #6264
• Streamline responses of API v1 project list endpoints by @nscuro in #6280

Full Changelog: 5.0.0-rc.4...5.0.0-rc.5

5.0.0-rc.4

What's Changed

Enhancements 🚀

• Improve latest version detection for Cargo and Ruby Gems by @nscuro in #6245
• Try to only report stable versions as latest for Maven by @nscuro in #6244

Bug Fixes 🐛

• Enforce separate limits for compressed and uncompressed repository responses by @nscuro in #6239
• Fix ineffective assignment of random BOM refs during import by @nscuro in #6241
• Fix latent minor BOM import bugs by @nscuro in #6242
• v4-migrator: Run ANALYZE on staging src tables before transform by @nscuro in #6247
• v4-migrator: Dedupe components before join with repo meta component table by @nscuro in #6248
• dex: Prevent possible deadlock when creating task queues by @nscuro in #6249

Full Changelog: 5.0.0-rc.3...5.0.0-rc.4

5.0.0-rc.3

What's Changed

Enhancements 🚀

• Log application info on startup by @nscuro in #6227
• Bump CycloneDX proto to v1.7.1 by @nscuro in #6237

Bug Fixes 🐛

• v4-migrator: Fix overly paranoid schema name validation by @nscuro in #6219
• v4-migrator: Fix trigger deactivation for PROJECT_ACCESS_USERS by @nscuro in #6220
• v4-migrator: Populate PERMISSION table in bootstrap phase by @nscuro in #6221
• Fix e2e tests for Linux by @nscuro in #6222
• v4-migrator: Fix cross-schema type dependencies by @nscuro in #6226
• Fix lastRiskScore of collection projects missing from project list API endpoints by @nscuro in #6228
• Fix wait condition for apiserver container in e2e tests by @nscuro in #6238

Dependency Updates 🤖

• chore(deps-dev): Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.5 to 3.5.6 by @dependabot[bot] in #6233
• chore(deps): Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 by @dependabot[bot] in #6232
• chore(deps): Bump oasdiff/oasdiff-action from 0.0.47 to 0.0.48 by @dependabot[bot] in #6231
• chore(deps): Bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6230
• chore(deps): Bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6229

Other Changes

• Reduce logging noise of tests by @nscuro in #6223

Full Changelog: 5.0.0-rc.2...5.0.0-rc.3

5.0.0-rc.2

Warning

This release drops the compatibility shim that translated v4-era alpine.* and unprefixed property names (for example alpine.ldap.enabled, database.url, bcrypt.rounds) into their dt.* equivalents. Migrate any configuration still using those names to the current dt.* properties. The API server refuses to start when it encounters a legacy key to prevent silent misconfiguration.

The original alpine.* to dt.* migration is documented in the v0.7.0-alpha.3 upgrade notes. See Configuration Properties for the authoritative list of supported properties and their corresponding environment variable spellings.

Apologies for introducing breaking changes in an RC build.

Find the full upgrade guide here: https://dependencytrack.github.io/docs/next/guides/upgrading/v5.0.0-rc.2/

What's Changed

Breaking Changes 🚨

• Standardize config property names and remove legacy shims by @nscuro in #6215

Enhancements 🚀

• Migrate vulnerability metrics to materialized view by @nscuro in #6213

Bug Fixes 🐛

• Raise max response body size for Cargo by @nscuro in #6214

Documentation 📃

• Link to helm-charts and community repos in README by @nscuro in #6202
• Update dex README by @nscuro in #6207

Other Changes

• Update GHA job names to be more practical for status check enforcement by @nscuro in #6208
• Add GHA workflow for nightly e2e tests by @nscuro in #6209
• Remove unused code and drop unnecessary dependencies by @nscuro in #6211

Full Changelog: 5.0.0-rc.1...5.0.0-rc.2