5.1.1

Important

Please read the upgrade notes before upgrading your instance.

What's Changed

Enhancements 🚀

• Backport: Refactor component metrics computation to avoid pathological query plans by @nscuro in #7364

Bug Fixes 🐛

• Backport: Run spotless:apply after Maven release plugin modifies them POM by @nscuro in #7140
• Backport: v4-migrator: Dedup PROJECT_PROPERTY rows of collapsed projects by @nscuro in #7360
• Backport: v4-migrator: Reconcile PROJECT collection logic and tag by @nscuro in #7361
• Backport: Add option to use Snyk's per-package endpoint when batching is not available by @nscuro in #7362
• Backport: Fix PURLs without version being submitted for analysis by @nscuro in #7363
• Backport: Remove unused LDAP properties by @nscuro in #7365
• Backport: Fix management server preventing shutdown on initialization failures by @nscuro in #7366
• Backport: Resolve project parent before other fields in updateProject by @nscuro in #7367
• Backport: Fix incorrect OpenAPI docs for POST /v1/project WRT parent semantics by @nscuro in #7368
• Backport: Fix project lookup endpoints not serving aggregate metrics for collection projects by @nscuro in #7369
• Backport: Fix DATASOURCE_MIRRORING notifications not being emitted by @nscuro in #7370
• Backport: Treat >=0 ranges as wildcard during vers matching by @nscuro in #7371
• Backport: Accumulate mirrored VulnerableSoftware by vulnerability key by @nscuro in #7373
• Backport: Fix Checkmarx model conversion NPEs by @nscuro in #7374
• Backport: Fix tag binding triggering unnecessary relationship loads by @nscuro in #7375
• Backport: Prevent NPEs during DataNucleus L1 cache eviction by @nscuro in #7376
• Backport: Fix proxy authentication for GitHub Advisories vuln data source by @nscuro in #7377
• Backport: Fix broken link to VulnCheck token creation by @nscuro in #7372
• Backport: Fix calculated CVSSv4 score only considering base metrics by @nscuro in #7378
• Backport: Fix NVD vuln data source iteration and watermarking issues by @nscuro in #7379
• Backport: Move vuln data source mirroring off JDO by @nscuro in #7384
• Backport: Fix lack of context in NVD & OSV unexpected status code exception messages by @nscuro in #7386

Dependency Updates 🤖

• chore(deps): Bump io.smallrye.config:smallrye-config-bom from 3.18.1 to 3.18.2 by @dependabot[bot] in #7144
• chore(deps): Bump com.networknt:json-schema-validator from 2.0.4 to 2.0.5 by @dependabot[bot] in #7147
• chore(deps): Bump com.networknt:json-schema-validator from 2.0.5 to 2.0.7 by @dependabot[bot] in #7154
• chore(deps): Bump the codeql group with 2 updates by @dependabot[bot] in #7158
• Bump com.uber.nullaway:nullaway from 0.13.8 to 0.14.0 by @dependabot[bot] in #7166
• Bump com.icegreen:greenmail-junit5 from 2.1.12 to 2.1.13 by @dependabot[bot] in #7190
• Bump com.adobe.testing:s3mock-testcontainers from 5.1.0 to 5.2.0 by @dependabot[bot] in #7189
• Bump actions/setup-java from 5.7.0 to 6.0.0 by @dependabot[bot] in #7191
• Bump org.openapitools:openapi-generator-maven-plugin from 7.24.0 to 7.25.0 by @dependabot[bot] in #7204
• Bump io.dropwizard.flywaydb:flyway-bom from 13.3.0 to 13.4.0 by @dependabot[bot] in #7221
• Bump org.apache.felix:maven-bundle-plugin from 6.1.0 to 6.1.2 by @dependabot[bot] in #7218
• Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.0 to 3.10.1 by @dependabot[bot] in #7219
• Bump com.github.luben:zstd-jni from 1.5.7-15 to 1.5.7-16 by @dependabot[bot] in #7233
• Bump org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0 by @dependabot[bot] in #7234
• Bump com.uber.nullaway:nullaway from 0.14.0 to 0.14.1 by @dependabot[bot] in #7235
• Bump the codeql group with 2 updates by @dependabot[bot] in #7236
• Bump oasdiff/oasdiff-action/breaking from 0.1.13 to 0.1.14 by @dependabot[bot] in #7237
• Bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 by @dependabot[bot] in #7238
• Bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.6 to 3.6.0 by @dependabot[bot] in #7253
• Bump org.apache.maven.plugins:maven-surefire-report-plugin from 3.5.6 to 3.6.0 by @dependabot[bot] in #7252
• Bump lib.swagger.version from 2.2.54 to 2.2.55 by @dependabot[bot] in #7251
• Bump lib.protobuf-java.version from 4.36.0 to 4.36.1 by @dependabot[bot] in #7268
• Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0 by @dependabot[bot] in #7269
• Bump io.swagger.parser.v3:swagger-parser from 2.1.47 to 2.1.48 by @dependabot[bot] in #7270
• Bump lib.jetty.version from 12.1.12 to 12.1.13 by @dependabot[bot] in #7285
• Bump org.metaeffekt.core:ae-security from 0.156.6 to 0.157.0 by @dependabot[bot] in #7286
• Bump lib.byte-buddy.version from 1.18.12 to 1.18.13 by @dependabot[bot] in #7284
• Bump com.h2database:h2 from 2.4.240 to 2.5.250 by @dependabot[bot] in #7304
• Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.1 to 3.10.2 by @dependabot[bot] in #7305
• Bump docker/setup-qemu-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #7306
• Bump oasdiff/oasdiff-action/breaking from 0.1.14 to 0.1.15 by @dependabot[bot] in #7307
• Bump io.dropwizard.flywaydb:flyway-bom from 13.4.0 to 13.5.0 by @dependabot[bot] in #7303
• chore(deps): Bump io.github.openfeign:feign-bom from 13.13 to 13.14 by @dependabot[bot] in #7145
• Bump org.jetbrains.kotlin:kotlin-bom from 2.4.10 to 2.4.20 by @dependabot[bot] in #7320
• Bump org.slf4j:slf4j-bom from 2.0.18 to 2.0.19 by @dependabot[bot] in #7318
• Bump io.github.openfeign:feign-bom from 13.14 to 13.15 by @dependabot[bot] in #7325
• Bump alpine from 3.24.1 to 3.24.2 in /apiserver/src/main/docker by @dependabot[bot] in #7342
• Bump eclipse-temurin from 09349d7 to 541729c in /apiserver/src/main/docker by @dependabot[bot] in #7343
• Bump com.microsoft.sqlserver:mssql-jdbc from 13.4.0.jre11 to 13.6.0.jre11 by @dependabot[bot] in #7344
• Backport: Bump alpine base image to 3.24.2 by @nscuro in #7381

Other Changes

• Backport: Address zizmor findings by @nscuro in #7194

Full Changelog: 5.1.0...5.1.1