5.0.5

Important

Please read the upgrade notes before upgrading your instance.

What's Changed

Enhancements 🚀

• Backport: Leverage OSV's modified_id.csv list for full archive downloads by @nscuro in #7073

Bug Fixes 🐛

• Backport: Fix teams being logged as object references instead of names by @nscuro in #7059
• Backport: Fix 500 in /v1/vulnerability/component/{uuid} when a project has >1 analysis for the same vuln by @nscuro in #7060
• Backport: v4-migrator: Fix unique constraint violation on duplicate OIDC group mappings by @nscuro in #7061
• Backport: Fix unassigned severity missing from component metrics by @nscuro in #7062
• Backport: Fix component license name not being returned by v2 component APIs by @nscuro in #7063
• Backport: Fix POLICY_VIOLATION notification templates referencing nonexistent policyCondition field by @nscuro in #7064
• Backport: Fix notification templates referencing nonexistent variables by @nscuro in #7069
• Backport: Fix conversion of OSV version ranges by @nscuro in #7072

Dependency Updates 🤖

• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.6 to 0.1.10 by @dependabot[bot] in #6888
• chore(deps): Bump docker/login-action from 4.4.0 to 4.5.2 by @dependabot[bot] in #6887
• chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-11 to 1.5.7-12 by @dependabot[bot] in #6886
• chore(deps): Bump com.google.cloud.sql:postgres-socket-factory from 1.28.6 to 1.29.0 by @dependabot[bot] in #6885
• chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.8.0 to 13.9.0 by @dependabot[bot] in #6883
• chore(deps): Bump lib.logback.version from 1.5.38 to 1.6.0 by @dependabot[bot] in #6868
• chore(deps): Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.2 to 5.6.3 by @dependabot[bot] in #6896
• chore(deps-dev): Bump org.apache.felix:maven-bundle-plugin from 6.0.2 to 6.1.0 by @dependabot[bot] in #6895
• chore(deps): Bump lib.logback.version from 1.6.0 to 1.6.1 by @dependabot[bot] in #6901
• chore(deps): Bump org.jspecify:jspecify from 1.0.0 to 1.0.1 by @dependabot[bot] in #6906
• chore(deps-dev): Bump org.cyclonedx:cyclonedx-maven-plugin from 2.9.2 to 2.9.3 by @dependabot[bot] in #6913
• chore(deps): Bump docker/login-action from 4.5.2 to 4.6.0 by @dependabot[bot] in #6927
• chore(deps): Bump io.github.jeremylong:open-vulnerability-clients from 9.0.5 to 9.0.6 by @dependabot[bot] in #6929
• chore(deps): Bump actions/setup-java from 5.6.0 to 5.7.0 by @dependabot[bot] in #6928
• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.10 to 0.1.11 by @dependabot[bot] in #6926
• chore(deps): Bump lib.jetty.version from 12.1.11 to 12.1.12 by @dependabot[bot] in #6950
• chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.45 to 2.1.46 by @dependabot[bot] in #6948
• chore(deps): Bump lib.swagger.version from 2.2.52 to 2.2.53 by @dependabot[bot] in #6947
• chore(deps-dev): Bump com.tngtech.archunit:archunit-junit5 from 1.4.2 to 1.5.0 by @dependabot[bot] in #6945
• chore(deps): Bump com.fasterxml.woodstox:woodstox-core from 7.2.1 to 7.2.2 by @dependabot[bot] in #6949
• chore(deps): Bump eclipse-temurin from 30d9f87 to 5ecfde8 in /apiserver/src/main/docker by @dependabot[bot] in #6965
• chore(deps): Bump com.icegreen:greenmail-junit5 from 2.1.11 to 2.1.12 by @dependabot[bot] in #6970
• chore(deps): Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4 by @dependabot[bot] in #6987
• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.11 to 0.1.12 by @dependabot[bot] in #7002
• chore(deps): Bump org.junit:junit-bom from 6.1.2 to 6.1.3 by @dependabot[bot] in #7003
• chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.9.0 to 13.10.0 by @dependabot[bot] in #7004
• chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-12 to 1.5.7-13 by @dependabot[bot] in #7005
• chore(deps): Bump io.github.ascopes:protobuf-maven-plugin from 5.1.7 to 5.1.8 by @dependabot[bot] in #7020
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.5 to 0.156.6 by @dependabot[bot] in #7021
• chore(deps): Bump lib.logback.version from 1.6.1 to 1.6.2 by @dependabot[bot] in #7033
• chore(deps): Bump lib.logback.version from 1.6.2 to 1.6.3 by @dependabot[bot] in #7048
• chore(deps): Bump org.apache.maven.extensions:maven-build-cache-extension from 1.2.3 to 1.3.0 by @dependabot[bot] in #7046
• chore(deps): Bump io.github.nscuro:versatile-core from 0.21.1 to 0.22.0 by @dependabot[bot] in #7047
• Backport: Bump Temurin base image to 25.0.4_7 by @nscuro in #7071
• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.12 to 0.1.13 by @dependabot[bot] in #7093
• chore(deps): Bump com.squareup.okhttp3:okhttp-jvm from 5.4.0 to 5.5.0 by @dependabot[bot] in #7092
• chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-13 to 1.5.7-15 by @dependabot[bot] in #7091
• chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.10.0 to 13.11.0 by @dependabot[bot] in #7090
• chore(deps): Bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #7089
• chore(deps): Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2 by @dependabot[bot] in #7088

Other Changes

• Backport: Add zizmor CI job by @nscuro in #7065
• Backport: Add CodeQL analysis by @nscuro in #7066
• Backport: Generate SLSA build provenance by @nscuro in #7067
• Backport: Have release notes refer to upgrade notes by @nscuro in #7095

Full Changelog: 5.0.4...5.0.5