5.2.1

Important

Please read the upgrade notes before upgrading your instance.

What's Changed

Bug Fixes 🐛

• Backport: Accept pipe-separated UUIDs on dependency graph path by @nscuro in #7745
• Backport: Resolve BOM upload tokens to root workflow runs only by @nscuro in #7746
• Backport: Skip analyzer when checking if enabled fails by @nscuro in #7747
• Backport: Fix collection tag missing in project lookup response by @nscuro in #7748
• Backport: Fix BOM validation failing when XML contains CDATA by @nscuro in #7750
• Backport: Map unknown or retired vulnerability sources to UNKNOWN in v4-migrator by @nscuro in #7752
• Backport: Remove eMudhra from container image cacerts by @nscuro in #7760
• Backport: Fix tag maintenance failing when tag is used only by collection projects by @nscuro in #7761
• Backport: Fix ineffective ACL check for /v1/finding/project/{uuid}/analyze by @nscuro in #7777

Dependency Updates 🤖

• Bump com.networknt:json-schema-validator from 2.0.4 to 2.0.7 by @dependabot[bot] in #7629
• Bump org.glassfish.jersey:jersey-bom from 4.0.2 to 4.0.3 by @dependabot[bot] in #7630
• Bump oasdiff/oasdiff-action/breaking from 0.1.17 to 0.1.18 by @dependabot[bot] in #7634
• Bump io.dropwizard.flywaydb:flyway-bom from 13.8.0 to 13.8.1 by @dependabot[bot] in #7639
• Bump com.networknt:json-schema-validator from 2.0.7 to 2.0.8 by @dependabot[bot] in #7640
• Bump org.metaeffekt.core:ae-security from 0.157.2 to 0.158.0 by @dependabot[bot] in #7660
• Bump io.dropwizard.flywaydb:flyway-bom from 13.8.1 to 13.9.0 by @dependabot[bot] in #7661
• Bump commons-codec:commons-codec from 1.22.1 to 1.23.0 by @dependabot[bot] in #7662
• Bump com.github.luben:zstd-jni from 1.5.7-20 to 1.5.7-21 by @dependabot[bot] in #7663
• Bump io.github.nscuro:versatile-core from 0.26.0 to 0.26.1 by @dependabot[bot] in #7678
• Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.4 to 5.6.5 by @dependabot[bot] in #7679
• Bump lib.jetty.version from 12.1.13 to 12.1.14 by @dependabot[bot] in #7680
• Bump net.javacrumbs.json-unit:json-unit-assertj from 6.2.0 to 6.3.0 by @dependabot[bot] in #7681
• Bump org.jetbrains.kotlin:kotlin-bom from 2.4.20 to 2.4.21 by @dependabot[bot] in #7688
• Bump org.openapitools:openapi-generator-maven-plugin from 7.25.0 to 7.26.0 by @dependabot[bot] in #7689
• Bump com.github.luben:zstd-jni from 1.5.7-21 to 1.5.7-22 by @dependabot[bot] in #7690
• Bump io.github.openfeign:feign-bom from 13.15 to 13.16 by @dependabot[bot] in #7692
• Bump org.apache.kafka:kafka-clients from 4.3.1 to 4.4.0 by @dependabot[bot] in #7691
• Bump org.postgresql:postgresql from 42.7.13 to 42.7.14 by @dependabot[bot] in #7701
• Bump com.diffplug.spotless:spotless-maven-plugin from 3.10.3 to 3.10.4 by @dependabot[bot] in #7702
• Bump io.github.openfeign:feign-bom from 13.16 to 13.17 by @dependabot[bot] in #7703
• Bump actions/download-artifact from 8.0.1 to 8.0.2 by @dependabot[bot] in #7719
• Bump org.metaeffekt.core:ae-security from 0.158.0 to 0.159.0 by @dependabot[bot] in #7715
• Bump com.github.luben:zstd-jni from 1.5.7-22 to 1.5.7-23 by @dependabot[bot] in #7716
• Bump the codeql group with 2 updates by @dependabot[bot] in #7717
• Bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #7718
• Bump com.github.ben-manes.caffeine:caffeine from 3.3.0 to 3.3.1 by @dependabot[bot] in #7727
• Bump lib.byte-buddy.version from 1.18.14 to 1.18.15 by @dependabot[bot] in #7729
• Bump com.microsoft.sqlserver:mssql-jdbc from 13.6.0.jre11 to 13.6.1.jre11 by @dependabot[bot] in #7735
• Backport: Bump Alpine base image to 3.24.3 by @nscuro in #7766
• Bump io.prometheus:prometheus-metrics-bom from 1.9.0 to 1.10.0 by @dependabot[bot] in #7769
• Bump com.google.crypto.tink:tink from 1.23.0 to 1.24.0 by @dependabot[bot] in #7772
• Backport: Bump cyclonedx-core-java to 13.4.0 by @nscuro in #7778

Other Changes

• Backport: Make test coverage reporting more efficient by @nscuro in #7749

Full Changelog: 5.2.0...5.2.1