5.1.0

Important

Please read the upgrade notes before upgrading your instance.

What's Changed

Enhancements 🚀

• Use ScopedValue instead of ThreadLocal for unrestricted project access by @nscuro in #6291
• v4-migrator: Add TCP keepalive and optional socket timeout by @nscuro in #6302
• v4-migrator: Fail fast when detecting bootstrap being pointed at v4 database by @nscuro in #6332
• Allow out-of-order execution of Flyway migrations by @nscuro in #6365
• Drop FK constraints from partitioned metrics tables by @nscuro in #6346
• Add protobuf publishing option for webhook notifications by @Xenira in #6373
• Add Squawk for migration linting by @nscuro in #6413
• Resolve analysis rating overrides per method in findings and notifications by @nscuro in #6417
• Apply OWASP rating from VEX import by @fahedouch in #6210
• Add server release version to the OpenAPI spec info block by @GabrielBBaldez in #6426
• Optimize portfolio-wide findings queries by @nscuro in #6459
• Forward group_by parameter to DefectDojo, v5 version by @webdevred in #6416
• Extend distro-aware version matching with Red Hat support by @nscuro in #6464
• Forward analysis.detail to DefectDojo, v5 version by @webdevred in #6415
• Add project isActive parameter for BOM upload API by @sahibamittal in #6475
• Implemented Banner Backend. by @ElenaStroebele in #6440
• Raise lock timeout for mirror-vuln-data-source activities and set explicit request timeouts for NVD downloads by @nscuro in #6508
• Remove unnecessary enrichment when querying for individual projects by @nscuro in #6514
• Bump cyclonedx-core-java and json-schema-validtor libs by @nscuro in #6515
• Implement initial KEV support by @nscuro in #6516
• Make KEV usable in component and vulnerability policies by @nscuro in #6545
• Include KEV flag in notifications by @nscuro in #6546
• Add GitHub App authentication for the GitHub Advisories mirror by @nissessenap in #6564
• Reduce resource footprint of project metrics updates by @nscuro in #6655
• Improve default data source config by @nscuro in #6678
• dex: add missing indexes on workflow_run_id in task tables by @nscuro in #6721
• dex: improve activity task scheduler polling efficiency for deep backlogs by @nscuro in #6723
• dex: execute multiple deletion batches per maintenance cycle by @nscuro in #6734
• Improve classification of retryable vuln analysis errors by @nscuro in #6744
• Implement support for compressed SBOMs in multipart uploads by @Nihlus in #6769
• dex: Make query timeout configurable by @nscuro in #6806
• dex: improve workflow task scheduling performance for deep backlogs with concurrency keys by @nscuro in #6811
• Log HTTP response body snippets on publish failures by @valentijnscholten in #6793
• Avoid sequential scan of FINDINGATTRIBUTION in project-scoped queries by @nscuro in #6834
• dex: enforce execution timeout for activities by @mehab in #6741
• dex: define default activity execution timeout by @nscuro in #6836
• Improve responsiveness to thread interruptions by @nscuro in #6837
• Avoid potential nested loop in component metrics computation by @nscuro in #6839
• dex: automatically heartbeat activities by @nscuro in #6807
• dex: reduce metrics collection footprint by @nscuro in #6840
• Don't assemble expensive notifications when no subscribing rule exists by @nscuro in #6843
• Add component scope evaluation policy by @adamtorokaccreativetg in #6853
• Introduce package metadata resolution state tracking by @nscuro in #6794
• Add KEV dimension to time series metrics by @nscuro in #6552
• Add Checkmarx SCA vulnerability analyser by @sahibamittal in #6804
• Add CycloneDX 1.7 support by @nscuro in #6703
• v4-migrator: Skip repeatable Flyway migrations by @nscuro in #6967
• Leverage OSV's modified_id.csv list for full archive downloads by @nscuro in #6974
• Stop bumping AffectedVersionAttribution.lastSeen by @nscuro in #6979
• Improve BOV model conversion for vulns with many affected components by @nscuro in #6981
• Log child projects deleted with their parent by @ElenaStroebele in #6976
• Support AWS-managed credentials for S3 storage by @fouad-j in #6874
• Add REST API endpoints to view and trigger KEV mirroring runs by @nscuro in #7007
• Enforce global database query timeout by @nscuro in #7009
• Bypass JDO for bulk deletions by @nscuro in #7011
• Support display names for extensions and KEV asserters by @nscuro in #7025
• Add VulnCheck KEV data source by @nscuro in #7027
• Pace creation of scheduled analyze-project workflows by @nscuro in #7049
• Enforce Maven build constraints by @nscuro in #7052
• Use modern CycloneDX tools metadata by @AKSHATSPAR in #6785
• Add JVN (Japan Vulnerability Notes) vulnerability data source by @mitsukado-shinagawa in #6640
• Declaratively define capabilities of CycloneDX export variants by @nscuro in #7075
• Align VEX semantics with CISA guidance and tooling ecosystem by @nscuro in #7076
• Fix excessive UPDATEs being issued during BOM import by @nscuro in #7099
• Define display names for all extensions by @nscuro in #7128
• Enforce consistent code formatting by @nscuro in #7053
• Check for optional columns via ResultSetMetaData instead of findColumn's exception by @nscuro in #7131
• dex: Avoid unnecessary allocations during history replay by @nscuro in #7136
• Expose workflow run status on BOM token polling endpoint by @Suhas2109 in #7127

Bug Fixes 🐛

• Make REPOSITORY.AUTHENTICATIONREQUIRED non-nullable by @nscuro in #6303
• Apply stricter PURL normalization for NPM package metadata resolution by @nscuro in #6304
• Bypass outbox for notification rule tests by @nscuro in #6305
• Fix NO_PROXY being rejected as legacy Alpine property by @nscuro in #6307
• v4-migrator: only run post-load actions when load phase completes successfully by @nscuro in #6310
• Reject parent objects with null UUID when creating/updating/patching projects by @nscuro in #6314
• Fix NPE during LDAP auth when bind credentials are not configured by @nscuro in #6317
• Fix suppressed vulns being considered for policy evaluation by @nscuro in #6320
• Fix incomplete field coverage of /v1/finding/project/{uuid}'s searchText filter by @nscuro in #6323
• Fix OIDC UserInfo endpoint not being invoked when team sync is enabled and ID token contains no teams claim by @nscuro in #6324
• Fix URL-encoding of OSV ecosystem names by @nscuro in #6329
• v4-migrator: Fix confusing debug log for missing tgt_permission table by @nscuro in #6340
• Support non-UTC timezones for metrics operations by @nscuro in #6344
• Fix URL-encoding of OSV ecosystem names when retrieving incremental advisories by @basclaessen in #6374
• Handle PAC-inaccessible target projects more gracefully for BOM uploads with autoCreate=true by @nscuro in #6376
• Fix broken HTTP proxy basic auth by @nscuro in #6380
• Fix team of API key not being auto-assigned project access after project creation by @nscuro in #6388
• Fix bad CPE query performance for internal vuln analyzer by @nscuro in #6439
• Fix admin re-seeding when USER table is populated by @Clark1945 in #6431
• v4-migrator: Don't migrate obsolete notification groups for notification rules by @nscuro in #6443
• Fix duplicate project name/version handling for /v1/project POST and PATCH endpoints by @nscuro in #6445
• dex: Fix over-reporting of activity task queue depth metric by @nscuro in #6446
• Fix MIME type of email notification templates not being set correctly by @nscuro in #6454
• Fix slow vulnerability database maintenance by @nscuro in #6497
• Fix excessive churn of vulnerable software associations during mirroring by @nscuro in #6499
• Make banner config readable without permissions by @nscuro in #6507
• Fix getAffectedProjects endpoint not accounting for suppressed findings by @nscuro in #6522
• Fix badges for collection projects showing no metrics by @nscuro in #6539
• Fix prepare-vuln-analysis activity failing when components have properties without value by @nscuro in #6573
• Fix local file storage not anticipating Windows-style paths by @nscuro in #6628
• Fix project sorting by version by @bergerst in #6652
• fix: exit the JVM when init tasks fail instead of hanging unready by @taleodor in #6690
• Fix BufferTest flakiness by @nscuro in #6718
• Fix build workflow not running for PRs to release branches by @nscuro in #6736
• Port: Fix NPE and redundant queries in VEX/VDR export by @nscuro in #6739
• Fix swallowed LDAP exception stack traces during context creation by @nscuro in #6797
• Strip trailing / from baseUrl notification template variable by @kamilkrzywanski in #6799
• Exclude project from components loaded during ImportBomActivity by @Nihlus in #6824
• Fix NotificationOutboxRelayTest flakiness by @nscuro in #6825
• dex: fix eager too consumption of concurrency key wakeup hints by @nscuro in #6833
• Fix failure to emit notification when vulnerability description is empty by @nscuro in #6844
• Fix teams being logged as object references instead of names by @ElenaStroebele in #6919
• Fix : Add Checkmarx API client fix by @sahibamittal in #6902
• Fix 500 in /v1/vulnerability/component/{uuid} when a project has >1 analysis for the same vuln by @nscuro in #6930
• v4-migrator: Fix unique constraint violation on duplicate OIDC group mappings by @nscuro in #6952
• Fix unassigned severity missing from component metrics by @ElenaStroebele in #6962
• Fix POLICY_VIOLATION notification templates referencing nonexistent p… by @fffinkel in #6995
• Fix notification templates referencing nonexistent variables by @nscuro in #6996
• Fix component license name not being returned by v2 component APIs by @nscuro in #7023
• Allow partial count for findings endpoints by @nscuro in #7035
• Fix project-create team picker stopping at 100 teams. by @ElenaStroebele in #6992
• Fix KEV filter performance regression in findings endpoints by @nscuro in #7036
• Fix conversion of OSV version ranges by @nscuro in #7058
• Fix JsonParser leakage in DataNucleus attribute converters by @nscuro in #7098
• Fix incorrect equality of data classification and external reference types by @nscuro in #7100
• Fix BOM import change detection of JSON and array values by @nscuro in #7101

Dependency Updates 🤖

• chore(deps): Bump docker/setup-qemu-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6293
• chore(deps): Bump imjasonh/setup-crane from 0.5 to 0.6 by @dependabot[bot] in #6294
• chore(deps): Bump com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.22.0 by @dependabot[bot] in #6296
• chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.4.2 to 13.5.0 by @dependabot[bot] in #6297
• chore(deps): Bump io.dropwizard.flywaydb:flyway-bom from 12.6.1 to 12.7.0 by @dependabot[bot] in #6321
• chore(deps): Bump lib.jetty.version from 12.1.9 to 12.1.10 by @dependabot[bot] in #6322
• chore(deps): Bump com.github.kagkarlsson:db-scheduler from 16.11.0 to 16.12.0 by @dependabot[bot] in #6336
• chore(deps): Bump lib.logback.version from 1.5.33 to 1.5.34 by @dependabot[bot] in #6338
• chore(deps): Bump com.google.cloud.sql:postgres-socket-factory from 1.28.3 to 1.28.4 by @dependabot[bot] in #6298
• chore(deps): Bump oasdiff/oasdiff-action from 0.0.48 to 0.0.51 by @dependabot[bot] in #6295
• chore(deps): Bump io.pebbletemplates:pebble from 4.1.1 to 4.1.2 by @dependabot[bot] in #6372
• chore(deps-dev): Bump org.apache.maven.plugins:maven-surefire-report-plugin from 3.5.5 to 3.5.6 by @dependabot[bot] in #6371
• chore(deps): Bump org.jetbrains.kotlin:kotlin-bom from 2.3.21 to 2.4.0 by @dependabot[bot] in #6385
• chore(deps): Bump io.prometheus:prometheus-metrics-bom from 1.6.1 to 1.7.0 by @dependabot[bot] in #6386
• chore(deps): Bump oasdiff/oasdiff-action from 0.0.51 to 0.0.57 by @dependabot[bot] in #6403
• chore(deps): Bump alpine from 3.23 to 3.24 in /apiserver/src/main/docker by @dependabot[bot] in #6411
• chore(deps): Bump com.fasterxml.woodstox:woodstox-core from 7.2.0 to 7.2.1 by @dependabot[bot] in #6408
• chore(deps-dev): Bump com.zaxxer:HikariCP from 7.0.2 to 7.1.0 by @dependabot[bot] in #6407
• chore(deps): Bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #6404
• chore(deps): Bump org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15 by @dependabot[bot] in #6406
• chore(deps): Bump io.micrometer:micrometer-bom from 1.16.5 to 1.17.0 by @dependabot[bot] in #6424
• chore(deps): Bump org.eclipse.parsson:jakarta.json from 1.1.7 to 1.1.9 by @dependabot[bot] in #6423
• chore(deps): Bump com.squareup.okhttp3:okhttp-jvm from 5.3.2 to 5.4.0 by @dependabot[bot] in #6422
• chore(deps-dev): Bump org.openapitools:openapi-generator-maven-plugin from 7.22.0 to 7.23.0 by @dependabot[bot] in #6433
• chore(deps): Bump io.minio:minio from 9.0.1 to 9.0.2 by @dependabot[bot] in #6434
• chore(deps): Bump lib.protobuf-java.version from 4.35.0 to 4.35.1 by @dependabot[bot] in #6435
• Bump Alpine base image to 3.24.1 by @nscuro in #6450
• chore(deps): Bump io.minio:minio from 9.0.2 to 9.0.3 by @dependabot[bot] in #6468
• chore(deps): Bump io.prometheus:prometheus-metrics-bom from 1.7.0 to 1.8.0 by @dependabot[bot] in #6467
• chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.43 to 2.1.44 by @dependabot[bot] in #6466
• chore(deps): Bump oasdiff/oasdiff-action from 0.0.57 to 0.1.1 by @dependabot[bot] in #6478
• chore(deps): Bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #6479
• chore(deps): Bump lib.swagger.version from 2.2.50 to 2.2.51 by @dependabot[bot] in #6480
• chore(deps): Bump dev.cel:cel from 0.13.0 to 0.13.1 by @dependabot[bot] in #6481
• chore(deps): Bump com.icegreen:greenmail-junit5 from 2.1.8 to 2.1.9 by @dependabot[bot] in #6482
• chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-9 to 1.5.7-11 by @dependabot[bot] in #6483
• chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.5.0 to 13.6.0 by @dependabot[bot] in #6492
• chore(deps): Bump io.takari.maven:takari-smart-builder from 1.1.0 to 1.1.1 by @dependabot[bot] in #6491
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.155.0 to 0.156.1 by @dependabot[bot] in #6490
• chore(deps): Bump io.github.openfeign:feign-bom from 13.12 to 13.13 by @dependabot[bot] in #6488
• chore(deps): Bump io.github.ascopes:protobuf-maven-plugin from 5.1.4 to 5.1.5 by @dependabot[bot] in #6509
• chore(deps): Bump org.apache.kafka:kafka-clients from 4.3.0 to 4.3.1 by @dependabot[bot] in #6511
• chore(deps): Bump com.google.crypto.tink:tink from 1.21.0 to 1.22.0 by @dependabot[bot] in #6517
• chore(deps): Bump io.dropwizard.flywaydb:flyway-bom from 12.7.0 to 12.9.0 by @dependabot[bot] in #6518
• chore(deps): Bump actions/setup-java from 5.2.0 to 5.3.0 by @dependabot[bot] in #6527
• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.1 to 0.1.3 by @dependabot[bot] in #6528
• chore(deps): Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #6529
• chore(deps): Bump com.adobe.testing:s3mock-testcontainers from 5.0.0 to 5.1.0 by @dependabot[bot] in #6530
• chore(deps-dev): Bump org.cyclonedx:cyclonedx-maven-plugin from 2.9.1 to 2.9.2 by @dependabot[bot] in #6531
• chore(deps): Bump io.github.nscuro:versatile-core from 0.18.3 to 0.19.0 by @dependabot[bot] in #6532
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.1 to 0.156.2 by @dependabot[bot] in #6533
• chore(deps): Bump io.github.ascopes:protobuf-maven-plugin from 5.1.5 to 5.1.6 by @dependabot[bot] in #6550
• chore(deps): Bump lib.swagger.version from 2.2.51 to 2.2.52 by @dependabot[bot] in #6547
• chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.44 to 2.1.45 by @dependabot[bot] in #6557
• chore(deps): Bump lib.logback.version from 1.5.34 to 1.5.35 by @dependabot[bot] in #6558
• Import Jackson 3 BOM by @nscuro in #6560
• chore(deps): Bump lib.logback.version from 1.5.35 to 1.5.36 by @dependabot[bot] in #6568
• chore(deps): Bump actions/setup-java from 5.3.0 to 5.4.0 by @dependabot[bot] in #6576
• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.3 to 0.1.4 by @dependabot[bot] in #6577
• chore(deps): Bump imjasonh/setup-crane from 0.6 to 0.7 by @dependabot[bot] in #6578
• chore(deps): Bump actions/cache from 5.0.5 to 6.1.0 by @dependabot[bot] in #6579
• chore(deps): Bump lib.logback.version from 1.5.36 to 1.5.37 by @dependabot[bot] in #6580
• chore(deps): Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.1 to 5.6.2 by @dependabot[bot] in #6581
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.2 to 0.156.3 by @dependabot[bot] in #6582
• chore(deps): Bump com.google.cloud.sql:postgres-socket-factory from 1.28.4 to 1.28.6 by @dependabot[bot] in #6583
• chore(deps): Bump io.github.ascopes:protobuf-maven-plugin from 5.1.6 to 5.1.7 by @dependabot[bot] in #6591
• chore(deps): Bump org.junit:junit-bom from 6.1.0 to 6.1.1 by @dependabot[bot] in #6592
• chore(deps): Bump org.postgresql:postgresql from 42.7.11 to 42.7.12 by @dependabot[bot] in #6594
• chore(deps-dev): Bump com.diffplug.spotless:spotless-maven-plugin from 3.7.0 to 3.8.0 by @dependabot[bot] in #6595
• chore(deps): Bump io.github.nscuro:versatile-core from 0.19.0 to 0.20.0 by @dependabot[bot] in #6610
• chore(deps): Bump io.github.nscuro:versatile-core from 0.20.0 to 0.21.0 by @dependabot[bot] in #6616
• chore(deps): Bump io.dropwizard.flywaydb:flyway-bom from 12.9.0 to 12.10.0 by @dependabot[bot] in #6631
• chore(deps): Bump org.jdbi:jdbi3-bom from 3.53.0 to 3.54.0 by @dependabot[bot] in #6630
• chore(deps): Bump lib.jetty.version from 12.1.10 to 12.1.11 by @dependabot[bot] in #6645
• chore(deps): Bump docker/login-action from 4.2.0 to 4.4.0 by @dependabot[bot] in #6657
• chore(deps): Bump io.smallrye.config:smallrye-config-bom from 3.17.2 to 3.18.0 by @dependabot[bot] in #6662
• chore(deps): Bump docker/build-push-action from 7.2.0 to 7.3.0 by @dependabot[bot] in #6661
• chore(deps): Bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6660
• chore(deps): Bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6659
• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.4 to 0.1.5 by @dependabot[bot] in #6658
• chore(deps): Bump org.postgresql:postgresql from 42.7.12 to 42.7.13 by @dependabot[bot] in #6681
• chore(deps): Bump net.javacrumbs.json-unit:json-unit-assertj from 5.1.2 to 6.0.0 by @dependabot[bot] in #6680
• chore(deps): Bump com.fasterxml.jackson:jackson-bom from 2.22.0 to 2.22.1 by @dependabot[bot] in #6695
• chore(deps): Bump net.javacrumbs.json-unit:json-unit-assertj from 6.0.0 to 6.0.1 by @dependabot[bot] in #6693
• chore(deps): Bump com.nimbusds:oauth2-oidc-sdk from 11.37.2 to 11.38 by @dependabot[bot] in #6728
• chore(deps): Bump lib.logback.version from 1.5.37 to 1.5.38 by @dependabot[bot] in #6726
• chore(deps): Bump com.google.crypto.tink:tink from 1.22.0 to 1.23.0 by @dependabot[bot] in #6725
• chore(deps): Bump com.nimbusds:oauth2-oidc-sdk from 11.38 to 11.38.1 by @dependabot[bot] in #6752
• chore(deps): Bump io.dropwizard.flywaydb:flyway-bom from 12.10.0 to 12.11.0 by @dependabot[bot] in #6751
• chore(deps): Bump org.junit:junit-bom from 6.1.1 to 6.1.2 by @dependabot[bot] in #6750
• chore(deps): Bump tools.jackson:jackson-bom from 3.2.0 to 3.2.1 by @dependabot[bot] in #6749
• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.5 to 0.1.6 by @dependabot[bot] in #6747
• chore(deps): Bump actions/setup-java from 5.4.0 to 5.5.0 by @dependabot[bot] in #6746
• chore(deps): Bump org.jetbrains.kotlin:kotlin-bom from 2.4.0 to 2.4.10 by @dependabot[bot] in #6782
• chore(deps): Bump io.github.nscuro:versatile-core from 0.21.0 to 0.21.1 by @dependabot[bot] in #6777
• chore(deps): Bump com.icegreen:greenmail-junit5 from 2.1.9 to 2.1.10 by @dependabot[bot] in #6776
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.3 to 0.156.4 by @dependabot[bot] in #6774
• chore(deps): Bump com.icegreen:greenmail-junit5 from 2.1.10 to 2.1.11 by @dependabot[bot] in #6788
• chore(deps): Bump io.smallrye.config:smallrye-config-bom from 3.18.0 to 3.18.1 by @dependabot[bot] in #6787
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.4 to 0.156.5 by @dependabot[bot] in #6802
• chore(deps): Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 by @dependabot[bot] in #6815
• chore(deps): Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #6813
• chore(deps): Bump actions/setup-java from 5.5.0 to 5.6.0 by @dependabot[bot] in #6812
• chore(deps): Bump com.uber.nullaway:nullaway from 0.13.7 to 0.13.8 by @dependabot[bot] in #6814
• chore(deps): Bump io.dropwizard.flywaydb:flyway-bom from 12.11.0 to 13.0.0 by @dependabot[bot] in #6830
• chore(deps-dev): Bump org.openapitools:openapi-generator-maven-plugin from 7.23.0 to 7.24.0 by @dependabot[bot] in #6829
• chore(deps): Bump com.nimbusds:oauth2-oidc-sdk from 11.38.1 to 11.38.2 by @dependabot[bot] in #6846
• Remove unused dependencies by @nscuro in #6848
• chore(deps): Bump com.google.cloud.sql:postgres-socket-factory from 1.28.6 to 1.29.0 by @dependabot[bot] in #6878
• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.6 to 0.1.10 by @dependabot[bot] in #6876
• chore(deps): Bump docker/login-action from 4.4.0 to 4.5.2 by @dependabot[bot] in #6875
• chore(deps): Bump lib.logback.version from 1.5.38 to 1.6.0 by @dependabot[bot] in #6867
• chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-11 to 1.5.7-12 by @dependabot[bot] in #6877
• chore(deps): Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.2 to 5.6.3 by @dependabot[bot] in #6891
• chore(deps-dev): Bump com.diffplug.spotless:spotless-maven-plugin from 3.8.0 to 3.9.0 by @dependabot[bot] in #6894
• chore(deps-dev): Bump org.apache.felix:maven-bundle-plugin from 6.0.2 to 6.1.0 by @dependabot[bot] in #6893
• chore(deps): Bump lib.logback.version from 1.6.0 to 1.6.1 by @dependabot[bot] in #6900
• chore(deps): Bump org.jspecify:jspecify from 1.0.0 to 1.0.1 by @dependabot[bot] in #6905
• chore(deps-dev): Bump org.cyclonedx:cyclonedx-maven-plugin from 2.9.2 to 2.9.3 by @dependabot[bot] in #6912
• chore(deps): Bump io.github.jeremylong:open-vulnerability-clients from 9.0.5 to 9.0.6 by @dependabot[bot] in #6922
• chore(deps): Bump io.dropwizard.flywaydb:flyway-bom from 13.0.0 to 13.1.0 by @dependabot[bot] in #6921
• chore(deps): Bump docker/login-action from 4.5.2 to 4.6.0 by @dependabot[bot] in #6918
• chore(deps): Bump actions/setup-java from 5.6.0 to 5.7.0 by @dependabot[bot] in #6917
• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.10 to 0.1.11 by @dependabot[bot] in #6916
• chore(deps-dev): Bump com.tngtech.archunit:archunit-junit5 from 1.4.2 to 1.5.0 by @dependabot[bot] in #6946
• chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.45 to 2.1.46 by @dependabot[bot] in #6942
• chore(deps): Bump lib.jetty.version from 12.1.11 to 12.1.12 by @dependabot[bot] in #6941
• chore(deps): Bump com.fasterxml.woodstox:woodstox-core from 7.2.1 to 7.2.2 by @dependabot[bot] in #6940
• chore(deps): Bump lib.swagger.version from 2.2.52 to 2.2.53 by @dependabot[bot] in #6939
• Fix directory of Dependabot docker ecosystem for 5.0.x branch by @nscuro in #6964
• chore(deps): Bump com.icegreen:greenmail-junit5 from 2.1.11 to 2.1.12 by @dependabot[bot] in #6968
• chore(deps): Bump io.dropwizard.flywaydb:flyway-bom from 13.1.0 to 13.2.0 by @dependabot[bot] in #6984
• chore(deps): Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4 by @dependabot[bot] in #6986
• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.11 to 0.1.12 by @dependabot[bot] in #6998
• chore(deps): Bump org.junit:junit-bom from 6.1.2 to 6.1.3 by @dependabot[bot] in #6999
• chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-12 to 1.5.7-13 by @dependabot[bot] in #7000
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.5 to 0.156.6 by @dependabot[bot] in #7015
• chore(deps): Bump net.javacrumbs.json-unit:json-unit-assertj from 6.0.1 to 6.1.0 by @dependabot[bot] in #7016
• chore(deps): Bump io.github.ascopes:protobuf-maven-plugin from 5.1.7 to 5.1.8 by @dependabot[bot] in #7017
• chore(deps): Bump lib.logback.version from 1.6.1 to 1.6.2 by @dependabot[bot] in #7032
• chore(deps): Bump org.apache.maven.extensions:maven-build-cache-extension from 1.2.3 to 1.3.0 by @dependabot[bot] in #7045
• chore(deps): Bump net.javacrumbs.json-unit:json-unit-assertj from 6.1.0 to 6.2.0 by @dependabot[bot] in #7042
• chore(deps): Bump io.github.nscuro:versatile-core from 0.21.1 to 0.22.0 by @dependabot[bot] in #7044
• Bump Temurin base image to 25.0.4_7 by @nscuro in #7068
• chore(deps): Bump lib.byte-buddy.version from 1.18.3 to 1.18.12 by @dependabot[bot] in #7084
• chore(deps): Bump tools.jackson:jackson-bom from 3.2.1 to 3.2.2 by @dependabot[bot] in #7083
• chore(deps): Bump com.diffplug.spotless:spotless-maven-plugin from 3.9.0 to 3.10.0 by @dependabot[bot] in #7082
• chore(deps): Bump com.squareup.okhttp3:okhttp-jvm from 5.4.0 to 5.5.0 by @dependabot[bot] in #7081
• chore(deps): Bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #7079
• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.12 to 0.1.13 by @dependabot[bot] in #7078
• chore(deps): Bump lib.logback.version from 1.6.2 to 1.6.3 by @dependabot[bot] in #7080
• Bump cyclonedx-core-java to 13.2.0 by @nscuro in #7102
• chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-13 to 1.5.7-15 by @dependabot[bot] in #7108
• chore(deps): Bump com.google.guava:guava from 33.6.0-jre to 33.7.1-jre by @dependabot[bot] in #7109
• chore(deps): Bump dev.cel:cel from 0.13.1 to 0.14.0 by @dependabot[bot] in #7107
• chore(deps): Bump io.dropwizard.flywaydb:flyway-bom from 13.2.0 to 13.3.0 by @dependabot[bot] in #7106
• chore(deps-dev): Bump com.google.jimfs:jimfs from 1.3.1 to 1.3.2 by @dependabot[bot] in #7120
• chore(deps): Bump lib.swagger.version from 2.2.53 to 2.2.54 by @dependabot[bot] in #7121
• chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.46 to 2.1.47 by @dependabot[bot] in #7123
• chore(deps): Bump io.micrometer:micrometer-bom from 1.17.0 to 1.17.1 by @dependabot[bot] in #7132

Documentation 📃

• Document patch release procedure by @nscuro in #6367
• Add contributor docs for portfolio access control by @nscuro in #6378
• Add project structure docs by @nscuro in #6393
• Improve ADR instructions by @nscuro in #6412
• ADR for feature "Known Exploited Vulnerabilities" by @LukasChristel in #6315
• Fix outdated dev services property description by @nscuro in #6462
• Drop "strong" from possible dt.ldap.security-auth values by @nscuro in #6717
• Add (retroactive) ADR for partitioning of metrics tables by @nscuro in #6720
• Add contributor docs for nullability checking by @nscuro in #6742
• Add contributor docs for interruptibility constraints by @nscuro in #6841
• Fix S3 credential provider properties docs by @nscuro in #6997
• Make README more visually pleasing by @nscuro in #7070
• Fix duplicate ADR 036 numbering by @nscuro in #7074
• docs: point README CI badges at main branch by @CJstate in #7096

Other Changes

• Fix email notification publisher not populating the "From" header by @nscuro in #6334
• Decouple policy condition API from JDO models by @nscuro in #6394
• Decouple component/project properties APIs from JDO models by @nscuro in #6395
• Add arch test for rejecting JDO model usage in REST API v1 by @nscuro in #6396
• Decouple notification publisher API from JDO models by @nscuro in #6397
• Decouple license group API from JDO models by @nscuro in #6398
• Decouple repository API from JDO models by @nscuro in #6399
• Decouple license API from JDO models by @nscuro in #6400
• Decouple config property API from JDO models by @nscuro in #6401
• Decouple violation analysis API from JDO models by @nscuro in #6402
• Add e2e test for application of OWASP RR rating via VEX import by @nscuro in #6418
• Only truncate tables between tests that have rows by @nscuro in #6427
• Eliminate more unnecessary wait times in tests by @nscuro in #6428
• Centralize test DB lifecycle and reuse across modules by @nscuro in #6429
• Reuse testcontainers for dev mode by @nscuro in #6463
• Auto-close issues that do not use an issue template by @nscuro in #6504
• Use WireMock for NVD vuln data source tests by @nscuro in #6505
• Replace Checkstyle with Spotless by @nscuro in #6513
• Add 5.0.x branch to Dependabot config by @nscuro in #6599
• Enable compile-time null-ness checks using NullAway by @nscuro in #6691
• Expand JSpecify to vuln-data-source modules by @nscuro in #6719
• Fix activity task backlog age widget in Grafana dashboard by @nscuro in #6832
• Replace Maven UUID generator plugin with build helper plugin by @nscuro in #6838
• Fix KafkaNotificationPublisherTest flakiness by @nscuro in #6842
• Enable NullAway for dex modules by @nscuro in #6933
• Disable SELinux for traefik container in dev Docker Compose setup by @volodymyr-jdev in #6937
• Set format: binary in OpenAPI for multipart BOM upload by @gzm0 in #6958
• Set format: bytes in OpenAPI for base64 BOM upload by @gzm0 in #6959
• Make version parameter on project/lookup optional by @gzm0 in #6973
• Add missing @consumes annotations by @gzm0 in #6978
• Add zizmor CI job by @nscuro in #7008
• Add CodeQL analysis by @nscuro in #7022
• Add Claude skill for backport automation by @nscuro in #7024
• Generate SLSA build provenance by @nscuro in #7026
• Skip Maven enforcer for e2e module by @nscuro in #7057
• Have release notes refer to upgrade notes by @nscuro in #7077

New Contributors

• @basclaessen made their first contribution in #6374
• @Xenira made their first contribution in #6373
• @fahedouch made their first contribution in #6210
• @GabrielBBaldez made their first contribution in #6426
• @LukasChristel made their first contribution in #6315
• @Clark1945 made their first contribution in #6431
• @nissessenap made their first contribution in #6564
• @bergerst made their first contribution in #6652
• @taleodor made their first contribution in #6690
• @Nihlus made their first contribution in #6769
• @kamilkrzywanski made their first contribution in #6799
• @adamtorokaccreativetg made their first contribution in #6853
• @volodymyr-jdev made their first contribution in #6937
• @gzm0 made their first contribution in #6958
• @fffinkel made their first contribution in #6995
• @fouad-j made their first contribution in #6874
• @AKSHATSPAR made their first contribution in #6785
• @mitsukado-shinagawa made their first contribution in #6640
• @CJstate made their first contribution in #7096
• @Suhas2109 made their first contribution in #7127

Full Changelog: 5.0.0...5.1.0