Skip to content

chore(deps): bump org.owasp:dependency-check-maven from 8.4.0 to 9.0.6#2345

Closed
dependabot[bot] wants to merge 1 commit intodevfrom
dependabot/maven/org.owasp-dependency-check-maven-9.0.6
Closed

chore(deps): bump org.owasp:dependency-check-maven from 8.4.0 to 9.0.6#2345
dependabot[bot] wants to merge 1 commit intodevfrom
dependabot/maven/org.owasp-dependency-check-maven-9.0.6

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Dec 18, 2023

Bumps org.owasp:dependency-check-maven from 8.4.0 to 9.0.6.

Release notes

Sourced from org.owasp:dependency-check-maven's releases.

Version 9.0.6

Refer to the CHANGELOG.md for information about improvements and upgrade notes.

Version 9.0.5

Refer to the CHANGELOG.md for information about improvements and upgrade notes.

Version 9.0.4

  • fix: utilize maven proxy if present (#6255)
  • fix: allow api key in cli to be quoted (#6253)
  • fix: use correct maven plugin reporting plugin (#6244)
  • fix: correct trailing comma in JSON report (#6245)

See the full listing of changes.

Version 9.0.3

  • fix: use Java properties for proxy configuration (#6238)
  • docs: update proxy configuration documentation (#6237)
  • docs: add documentation on caching (#6204)
  • docs: Clarify H2 database caching strategy (#6220)
  • docs: Update list of supported report formats (#6224)
  • docs: example 5 with new nvdDatafeedUrl parameter (#6215)
  • fix: prevent NPEs (#6232 and #6206)
  • fix: check valid for hours for NVD API (#6225)
  • fix: correct NVD cache last checked logic (#6218)
  • fix: nvd datafeed should process current year (#6213)
  • fix: correct references to cvssv2 and cvssv3 fields in json and xml reports (#6212)
  • fix: correct name on reference links in report (#6205)
  • fix: flaws int the gitlab report (#6193)

See the full listing of changes.

v9.0.2

  • fix: remove virtual match string on NVD API Request (#6177)
  • fix: correct meta data in report after switching the NVD API (#6154)
  • fix: retry HTTP connections to NVD on 502 and 504 errors (#6151)
  • fix: Gitlab report format needs severity capitalized (#6182)
  • fix: improve JDK update version parsing (#6163)
  • fix: mute JCS logging (again) (#6153)

See the full listing of changes.

Version 9.0.1

  • fix: check java 8 update version; minimum JRE is 8 update 251 (#6118)
  • fix: add retry for failed NVD API requests (#6136)
  • docs: add default values to documentation for the NVD API Delay (#6135)
  • chore: Revert "build(deps): bump com.h2database:h2 from 2.1.214 to 2.2.224" (#6131)
    • this is a breaking change for anyone that successfully created the H2 database with 9.0.0.
  • fix: mute jcs logging (#6130)
  • docs: update NVD notice (#6110)
  • fix: Use the correct key for NVD API-Key from Maven Settings serverId (#6109)

... (truncated)

Changelog

Sourced from org.owasp:dependency-check-maven's changelog.

Version 9.0.6 (2023-12-15)

  • build: bump open-vulnerability-clients@5.1.1 (#6308)
  • fix: mask nvd.api.key in logs (#6307)
  • fix: update java version check (#6297)
  • fix: more efficient memory usage (#6299)
  • fix: stream NVD data via Jackson to reduce memory footprint (#6275)
  • docs: document github action caching (#6301)

See the full listing of changes.

Version 9.0.5 (2023-12-13)

  • fix: make NVD API endpoint configurable (#6287)
  • fix: synch last modified timestamp for NVD API (#6281)
  • fix: read NVD cache meta files if cache.properties does not exist (#6282)
  • fix: correct property for nonProxyHosts (#6285)
  • fix: reduce apache http logging (#6280)
  • fix: store last modified timestamp for RetireJS and the Hosted Suppression File in db (#6271)
  • build: bump golang in the docker image (#6274)
  • fix: use temporary files to reduce memory usage during the NVD Update (#6270)
  • fix: use BIT for Oracle DB instead of Boolean when calling prepared statements (#6264)
  • fix: showing all reference tags in reports (#6259)

See the full listing of changes.

Version 9.0.4 (2023-12-08)

  • fix: utilize maven proxy if present (#6255)
  • fix: allow api key in cli to be quoted (#6253)
  • fix: use correct maven plugin reporting plugin (#6244)
  • fix: correct trailing comma in JSON report (#6245)

See the full listing of changes.

Version 9.0.3 (2023-12-06)

  • fix: use Java properties for proxy configuration (#6238)
  • docs: update proxy configuration documentation (#6237)
  • docs: add documentation on caching (#6204)
  • docs: Clarify H2 database caching strategy (#6220)
  • docs: Update list of supported report formats (#6224)
  • docs: example 5 with new nvdDatafeedUrl parameter (#6215)
  • fix: prevent NPEs (#6232 and #6206)
  • fix: check valid for hours for NVD API (#6225)
  • fix: correct NVD cache last checked logic (#6218)
  • fix: nvd datafeed should process current year (#6213)
  • fix: correct references to cvssv2 and cvssv3 fields in json and xml reports (#6212)
  • fix: correct name on reference links in report (#6205)
  • fix: flaws int the gitlab report (#6193)

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [org.owasp:dependency-check-maven](https://github.com/jeremylong/DependencyCheck) from 8.4.0 to 9.0.6.
- [Release notes](https://github.com/jeremylong/DependencyCheck/releases)
- [Changelog](https://github.com/jeremylong/DependencyCheck/blob/main/CHANGELOG.md)
- [Commits](jeremylong/DependencyCheck@v8.4.0...v9.0.6)

---
updated-dependencies:
- dependency-name: org.owasp:dependency-check-maven
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Dec 18, 2023
@bossenti bossenti closed this Dec 18, 2023
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Dec 18, 2023

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot bot deleted the dependabot/maven/org.owasp-dependency-check-maven-9.0.6 branch December 18, 2023 06:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant