5.1.2

Important

Please read the upgrade notes before upgrading your instance.

What's Changed

Bug Fixes 🐛

• Backport: Fix invalid PURLs causing list API endpoints to fail by @nscuro in #7554
• Backport: Fix failure to match CPE with wildcard version and version range >=0 by @nscuro in #7555
• Backport: Fix internal vulns with finding attributions failing deletion by @nscuro in #7558
• Backport: PEP 503-normalize PyPI package names for vuln matching by @nscuro in #7559
• Backport: Fix manually assigned findings being deactivated on analysis by @nscuro in #7560
• Backport: Treat NuGet package names as case-insensitive for vuln matching by @nscuro in #7562
• Backport: Fix Trivy findings dropped for PURLs with URL-valued qualifiers by @nscuro in #7596

Dependency Updates 🤖

• Bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2 by @dependabot[bot] in #7402
• Bump org.apache.maven.plugins:maven-deploy-plugin from 3.1.4 to 3.2.0 by @dependabot[bot] in #7403
• Bump io.dropwizard.flywaydb:flyway-bom from 13.5.0 to 13.6.0 by @dependabot[bot] in #7404
• Bump io.github.jeremylong:open-vulnerability-clients from 9.0.6 to 9.0.7 by @dependabot[bot] in #7405
• Bump the codeql group with 2 updates by @dependabot[bot] in #7406
• Bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 by @dependabot[bot] in #7407
• Bump oasdiff/oasdiff-action/breaking from 0.1.15 to 0.1.16 by @dependabot[bot] in #7408
• Bump actions/setup-java from 6.0.0 to 6.0.1 by @dependabot[bot] in #7409
• Bump io.github.ascopes:protobuf-maven-plugin from 5.1.8 to 5.1.9 by @dependabot[bot] in #7416
• Bump lib.byte-buddy.version from 1.18.13 to 1.18.14 by @dependabot[bot] in #7418
• Bump org.apache.maven.plugins:maven-install-plugin from 3.1.4 to 3.2.0 by @dependabot[bot] in #7419
• Bump org.apache.felix:maven-bundle-plugin from 6.1.2 to 6.2.0 by @dependabot[bot] in #7417
• Bump io.prometheus:prometheus-metrics-bom from 1.8.0 to 1.9.0 by @dependabot[bot] in #7429
• Bump org.codehaus.mojo:exec-maven-plugin from 3.6.3 to 3.6.4 by @dependabot[bot] in #7430
• Bump io.github.nscuro:versatile-core from 0.24.0 to 0.25.0 by @dependabot[bot] in #7431
• Bump org.metaeffekt.core:ae-security from 0.157.0 to 0.157.1 by @dependabot[bot] in #7432
• Bump com.github.luben:zstd-jni from 1.5.7-16 to 1.5.7-17 by @dependabot[bot] in #7441
• Bump com.adobe.testing:s3mock-testcontainers from 5.2.0 to 5.2.2 by @dependabot[bot] in #7439
• Bump io.dropwizard.flywaydb:flyway-bom from 13.6.0 to 13.7.0 by @dependabot[bot] in #7442
• Bump io.smallrye.config:smallrye-config-bom from 3.18.2 to 3.18.3 by @dependabot[bot] in #7440
• Bump lib.protobuf-java.version from 4.36.1 to 4.36.2 by @dependabot[bot] in #7456
• Bump com.github.ben-manes.caffeine:caffeine from 3.2.4 to 3.3.0 by @dependabot[bot] in #7486
• Bump io.github.ascopes:protobuf-maven-plugin from 5.1.9 to 5.1.10 by @dependabot[bot] in #7487
• Bump com.github.luben:zstd-jni from 1.5.7-17 to 1.5.7-18 by @dependabot[bot] in #7488
• Bump com.icegreen:greenmail-junit5 from 2.1.13 to 2.1.14 by @dependabot[bot] in #7489
• Bump the codeql group with 2 updates by @dependabot[bot] in #7490
• Bump docker/setup-qemu-action from 4.3.0 to 4.4.0 by @dependabot[bot] in #7491
• Bump oasdiff/oasdiff-action/breaking from 0.1.16 to 0.1.17 by @dependabot[bot] in #7492
• Bump docker/setup-buildx-action from 4.3.0 to 4.4.1 by @dependabot[bot] in #7493
• Bump docker/build-push-action from 7.3.0 to 7.4.0 by @dependabot[bot] in #7494
• Bump org.eclipse.microprofile.config:microprofile-config-api from 3.1.1 to 3.1.2 by @dependabot[bot] in #7507
• Bump tools.jackson:jackson-bom from 3.2.2 to 3.2.3 by @dependabot[bot] in #7508
• Bump com.adobe.testing:s3mock-testcontainers from 5.2.2 to 5.2.3 by @dependabot[bot] in #7510
• Bump com.fasterxml.jackson:jackson-bom from 2.22.2 to 2.22.3 by @dependabot[bot] in #7509
• Bump org.slf4j:slf4j-bom from 2.0.19 to 2.0.20 by @dependabot[bot] in #7520
• Bump com.github.luben:zstd-jni from 1.5.7-18 to 1.5.7-19 by @dependabot[bot] in #7524
• Bump org.metaeffekt.core:ae-security from 0.157.1 to 0.157.2 by @dependabot[bot] in #7532
• Bump org.mockito:mockito-bom from 5.23.0 to 5.24.0 by @dependabot[bot] in #7531
• Bump io.dropwizard.flywaydb:flyway-bom from 13.7.0 to 13.8.0 by @dependabot[bot] in #7538
• Bump lib.logback.version from 1.6.3 to 1.6.4 by @dependabot[bot] in #7539
• Bump com.uber.nullaway:nullaway from 0.14.1 to 0.14.2 by @dependabot[bot] in #7540
• Backport: Bump versatile to 0.26.0 by @nscuro in #7556
• Bump eclipse-temurin from 25.0.4_7-jdk-alpine to 25.0.4.1_1-jdk-alpine in /apiserver/src/main/docker by @dependabot[bot] in #7575
• Bump com.tngtech.archunit:archunit-junit5 from 1.5.0 to 1.5.1 by @dependabot[bot] in #7576
• Bump org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0 by @dependabot[bot] in #7577
• Bump com.github.luben:zstd-jni from 1.5.7-19 to 1.5.7-20 by @dependabot[bot] in #7578
• Bump the codeql group with 2 updates by @dependabot[bot] in #7579
• Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.2 to 3.10.3 by @dependabot[bot] in #7589
• Bump com.h2database:h2 from 2.5.250 to 2.5.252 by @dependabot[bot] in #7590
• Bump org.jdbi:jdbi3-bom from 3.54.0 to 3.55.0 by @dependabot[bot] in #7591

Other Changes

• Backport: Improve effectiveness of caching in CI by @nscuro in #7550
• Backport: Disable caching in docker/setup-qemu-action by @nscuro in #7557

Full Changelog: 5.1.1...5.1.2