5.1.0

Important

Please read the upgrade notes before upgrading your instance.

What's Changed

Enhancements 🚀

• Use ScopedValue instead of ThreadLocal for unrestricted project access by @nscuro in #6291
• v4-migrator: Add TCP keepalive and optional socket timeout by @nscuro in #6302
• v4-migrator: Fail fast when detecting bootstrap being pointed at v4 database by @nscuro in #6332
• Allow out-of-order execution of Flyway migrations by @nscuro in #6365
• Drop FK constraints from partitioned metrics tables by @nscuro in #6346
• Add protobuf publishing option for webhook notifications by @Xenira in #6373
• Add Squawk for migration linting by @nscuro in #6413
• Resolve analysis rating overrides per method in findings and notifications by @nscuro in #6417
• Apply OWASP rating from VEX import by @fahedouch in #6210
• Add server release version to the OpenAPI spec info block by @GabrielBBaldez in #6426
• Optimize portfolio-wide findings queries by @nscuro in #6459
• Forward group_by parameter to DefectDojo, v5 version by @webdevred in #6416
• Extend distro-aware version matching with Red Hat support by @nscuro in #6464
• Forward analysis.detail to DefectDojo, v5 version by @webdevred in #6415
• Add project isActive parameter for BOM upload API by @sahibamittal in #6475
• Implemented Banner Backend. by @ElenaStroebele in #6440
• Raise lock timeout for mirror-vuln-data-source activities and set explicit request timeouts for NVD downloads by @nscuro in #6508
• Remove unnecessary enrichment when querying for individual projects by @nscuro in #6514
• Bump cyclonedx-core-java and json-schema-validtor libs by @nscuro in #6515
• Implement initial KEV support by @nscuro in #6516
• Make KEV usable in component and vulnerability policies by @nscuro in #6545
• Include KEV flag in notifications by @nscuro in #6546
• Add GitHub App authentication for the GitHub Advisories mirror by @nissessenap in #6564
• Reduce resource footprint of project metrics updates by @nscuro in #6655
• Improve default data source config by @nscuro in #6678
• dex: add missing indexes on workflow_run_id in task tables by @nscuro in #6721
• dex: improve activity task scheduler polling efficiency for deep backlogs by @nscuro in #6723
• dex: execute multiple deletion batches per maintenance cycle by @nscuro in #6734
• Improve classification of retryable vuln analysis errors by @nscuro in #6744
• Implement support for compressed SBOMs in multipart uploads by @Nihlus in #6769
• dex: Make query timeout configurable by @nscuro in #6806
• dex: improve workflow task scheduling performance for deep backlogs with concurrency keys by @nscuro in #6811
• Log HTTP response body snippets on publish failures by @valentijnscholten in #6793
• Avoid sequential scan of FINDINGATTRIBUTION in project-scoped queries by @nscuro in #6834
• dex: enforce execution timeout for activities by @mehab in #6741
• dex: define default activity execution timeout by @nscuro in #6836
• Improve responsiveness to thread interruptions by @nscuro in #6837
• Avoid potential nested loop in component metrics computation by @nscuro in #6839
• dex: automatically heartbeat activities by @nscuro in #6807
• dex: reduce metrics collection footprint by @nscuro in #6840
• Don't assemble expensive notifications when no subscribing rule exists by @nscuro in #6843
• Add component scope evaluation policy by @adamtorokaccreativetg in #6853
• Introduce package metadata resolution state tracking by @nscuro in #6794
• Add KEV dimension to time series metrics by @nscuro in #6552
• Add Checkmarx SCA vulnerability analyser by @sahibamittal in #6804
• Add CycloneDX 1.7 support by @nscuro in #6703
• v4-migrator: Skip repeatable Flyway migrations by @nscuro in #6967
• Leverage OSV's modified_id.csv list for full archive downloads by @nscuro in #6974
• Stop bumping AffectedVersionAttribution.lastSeen by @nscuro in #6979
• Improve BOV model conversion for vulns with many affected components by @nscuro in #6981
• Log child projects deleted with their parent by @ElenaStroebele in #6976
• Support AWS-managed credentials for S3 storage by @fouad-j in #6874
• Add REST API endpoints to view and trigger KEV mirroring runs by @nscuro in #7007
• Enforce global database query timeout by @nscuro in #7009
• Bypass JDO for bulk deletions by @nscuro in #7011
• Support display names for extensions and KEV asserters by @nscuro in #7025
• Add VulnCheck KEV data source by @nscuro in #7027
• Pace creation of scheduled analyze-project workflows by @nscuro in #7049
• Enforce Maven build constraints by @nscuro in #7052
• Use modern CycloneDX tools metadata by @AKSHATSPAR in #6785
• Add JVN (Japan Vulnerability Notes) vulnerability data source by @mitsukado-shinagawa in #6640
• Declaratively define capabilities of CycloneDX export variants by @nscuro in #7075
• Align VEX semantics with CISA guidance and tooling ecosystem by @nscuro in #7076
• Fix excessive UPDATEs being issued during BOM import by @nscuro in #7099
• Define display names for all extensions by @nscuro in #7128
• Enforce consistent code formatting by @nscuro in #7053
• Check for optional columns via ResultSetMetaData instead of findColumn's exception by @nscuro in #7131
• dex: Avoid unnecessary allocations during history replay by @nscuro in #7136
• Expose workflow run status on BOM token polling endpoint by @Suhas2109 in #7127

Bug Fixes 🐛

• Make REPOSITORY.AUTHENTICATIONREQUIRED non-nullable by @nscuro in #6303
• Apply stricter PURL normalization for NPM package metadata resolution by @nscuro in #6304
• Bypass outbox for notification rule tests by @nscuro in #6305
• Fix NO_PROXY being rejected as legacy Alpine property by @nscuro in #6307
• v4-migrator: only run post-load actions when load phase completes suc...

5.0.5

Important

Please read the upgrade notes before upgrading your instance.

What's Changed

Enhancements 🚀

• Backport: Leverage OSV's modified_id.csv list for full archive downloads by @nscuro in #7073

Bug Fixes 🐛

• Backport: Fix teams being logged as object references instead of names by @nscuro in #7059
• Backport: Fix 500 in /v1/vulnerability/component/{uuid} when a project has >1 analysis for the same vuln by @nscuro in #7060
• Backport: v4-migrator: Fix unique constraint violation on duplicate OIDC group mappings by @nscuro in #7061
• Backport: Fix unassigned severity missing from component metrics by @nscuro in #7062
• Backport: Fix component license name not being returned by v2 component APIs by @nscuro in #7063
• Backport: Fix POLICY_VIOLATION notification templates referencing nonexistent policyCondition field by @nscuro in #7064
• Backport: Fix notification templates referencing nonexistent variables by @nscuro in #7069
• Backport: Fix conversion of OSV version ranges by @nscuro in #7072

Dependency Updates 🤖

• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.6 to 0.1.10 by @dependabot[bot] in #6888
• chore(deps): Bump docker/login-action from 4.4.0 to 4.5.2 by @dependabot[bot] in #6887
• chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-11 to 1.5.7-12 by @dependabot[bot] in #6886
• chore(deps): Bump com.google.cloud.sql:postgres-socket-factory from 1.28.6 to 1.29.0 by @dependabot[bot] in #6885
• chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.8.0 to 13.9.0 by @dependabot[bot] in #6883
• chore(deps): Bump lib.logback.version from 1.5.38 to 1.6.0 by @dependabot[bot] in #6868
• chore(deps): Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.2 to 5.6.3 by @dependabot[bot] in #6896
• chore(deps-dev): Bump org.apache.felix:maven-bundle-plugin from 6.0.2 to 6.1.0 by @dependabot[bot] in #6895
• chore(deps): Bump lib.logback.version from 1.6.0 to 1.6.1 by @dependabot[bot] in #6901
• chore(deps): Bump org.jspecify:jspecify from 1.0.0 to 1.0.1 by @dependabot[bot] in #6906
• chore(deps-dev): Bump org.cyclonedx:cyclonedx-maven-plugin from 2.9.2 to 2.9.3 by @dependabot[bot] in #6913
• chore(deps): Bump docker/login-action from 4.5.2 to 4.6.0 by @dependabot[bot] in #6927
• chore(deps): Bump io.github.jeremylong:open-vulnerability-clients from 9.0.5 to 9.0.6 by @dependabot[bot] in #6929
• chore(deps): Bump actions/setup-java from 5.6.0 to 5.7.0 by @dependabot[bot] in #6928
• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.10 to 0.1.11 by @dependabot[bot] in #6926
• chore(deps): Bump lib.jetty.version from 12.1.11 to 12.1.12 by @dependabot[bot] in #6950
• chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.45 to 2.1.46 by @dependabot[bot] in #6948
• chore(deps): Bump lib.swagger.version from 2.2.52 to 2.2.53 by @dependabot[bot] in #6947
• chore(deps-dev): Bump com.tngtech.archunit:archunit-junit5 from 1.4.2 to 1.5.0 by @dependabot[bot] in #6945
• chore(deps): Bump com.fasterxml.woodstox:woodstox-core from 7.2.1 to 7.2.2 by @dependabot[bot] in #6949
• chore(deps): Bump eclipse-temurin from 30d9f87 to 5ecfde8 in /apiserver/src/main/docker by @dependabot[bot] in #6965
• chore(deps): Bump com.icegreen:greenmail-junit5 from 2.1.11 to 2.1.12 by @dependabot[bot] in #6970
• chore(deps): Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4 by @dependabot[bot] in #6987
• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.11 to 0.1.12 by @dependabot[bot] in #7002
• chore(deps): Bump org.junit:junit-bom from 6.1.2 to 6.1.3 by @dependabot[bot] in #7003
• chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.9.0 to 13.10.0 by @dependabot[bot] in #7004
• chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-12 to 1.5.7-13 by @dependabot[bot] in #7005
• chore(deps): Bump io.github.ascopes:protobuf-maven-plugin from 5.1.7 to 5.1.8 by @dependabot[bot] in #7020
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.5 to 0.156.6 by @dependabot[bot] in #7021
• chore(deps): Bump lib.logback.version from 1.6.1 to 1.6.2 by @dependabot[bot] in #7033
• chore(deps): Bump lib.logback.version from 1.6.2 to 1.6.3 by @dependabot[bot] in #7048
• chore(deps): Bump org.apache.maven.extensions:maven-build-cache-extension from 1.2.3 to 1.3.0 by @dependabot[bot] in #7046
• chore(deps): Bump io.github.nscuro:versatile-core from 0.21.1 to 0.22.0 by @dependabot[bot] in #7047
• Backport: Bump Temurin base image to 25.0.4_7 by @nscuro in #7071
• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.1.12 to 0.1.13 by @dependabot[bot] in #7093
• chore(deps): Bump com.squareup.okhttp3:okhttp-jvm from 5.4.0 to 5.5.0 by @dependabot[bot] in #7092
• chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-13 to 1.5.7-15 by @dependabot[bot] in #7091
• chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.10.0 to 13.11.0 by @dependabot[bot] in #7090
• chore(deps): Bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #7089
• chore(deps): Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2 by @dependabot[bot] in #7088

Other Changes

• Backport: Add zizmor CI job by @nscuro in #7065
• Backport: Add CodeQL analysis by @nscuro in #7066
• Backport: Generate SLSA build provenance by @nscuro in #7067
• Backport: Have release notes refer to upgrade notes by @nscuro in #7095

Full Changelog: 5.0.4...5.0.5

5.0.4

What's Changed

Enhancements 🚀

• Backport: dex: Make query timeout configurable by @nscuro in #6855
• Backport: dex: improve workflow task scheduling performance for deep backlogs with concurrency keys by @nscuro in #6858
• Backport: dex: execute multiple deletion batches per maintenance cycle by @nscuro in #6860
• Backport: dex: enforce execution timeout for activities by @nscuro in #6861
• Backport: dex: define default activity execution timeout by @nscuro in #6862
• Backport: dex: automatically heartbeat activities by @nscuro in #6864
• Backport: Improve responsiveness to thread interruptions by @nscuro in #6863

Bug Fixes 🐛

• Backport: Exclude project from components loaded during ImportBomActivity by @nscuro in #6856
• Backport: Fix failure to emit notification when vulnerability description is empty by @nscuro in #6857
• Backport: dex: fix too eager consumption of concurrency key wakeup hints by @nscuro in #6859
• Backport: Strip trailing / from baseUrl notification template variable by @nscuro in #6865

Dependency Updates 🤖

• chore(deps): Bump com.icegreen:greenmail-junit5 from 2.1.9 to 2.1.10 by @dependabot[bot] in #6784
• chore(deps): Bump org.jetbrains.kotlin:kotlin-bom from 2.4.0 to 2.4.10 by @dependabot[bot] in #6783
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.3 to 0.156.4 by @dependabot[bot] in #6780
• chore(deps): Bump com.icegreen:greenmail-junit5 from 2.1.10 to 2.1.11 by @dependabot[bot] in #6791
• chore(deps): Bump io.smallrye.config:smallrye-config-bom from 3.18.0 to 3.18.1 by @dependabot[bot] in #6790
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.4 to 0.156.5 by @dependabot[bot] in #6803
• chore(deps): Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 by @dependabot[bot] in #6821
• chore(deps): Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #6820
• chore(deps): Bump actions/setup-java from 5.5.0 to 5.6.0 by @dependabot[bot] in #6819
• chore(deps-dev): Bump org.openapitools:openapi-generator-maven-plugin from 7.23.0 to 7.24.0 by @dependabot[bot] in #6831
• chore(deps): Bump com.nimbusds:oauth2-oidc-sdk from 11.38.1 to 11.38.2 by @dependabot[bot] in #6847
• chore(deps): Bump io.github.nscuro:versatile-core from 0.18.3 to 0.21.1 by @dependabot[bot] in #6781

Full Changelog: 5.0.3...5.0.4

5.0.3

What's Changed

Enhancements 🚀

• Backport: Optimize portfolio-wide findings queries by @nscuro in #6571
• Backport: Improve default data source config by @nscuro in #6732
• Backport: dex: add missing indexes on workflow_run_id in task tables by @nscuro in #6733
• Backport: dex: improve activity task scheduler polling efficiency for deep backlogs by @nscuro in #6735
• Backport: Improve classification of retryable vuln analysis errors by @nscuro in #6745

Bug Fixes 🐛

• Backport: Fix getAffectedProjects endpoint not accounting for suppressed findings by @nscuro in #6541
• Backport: Fix badges for collection projects showing no metrics by @nscuro in #6540
• Backport: Fix excessive churn of vulnerable software associations during mirroring by @nscuro in #6543
• Backport: Fix slow vulnerability database maintenance by @nscuro in #6544
• Backport: Raise lock timeout for mirror-vuln-data-source activities and set explicit request timeouts for NVD downloads by @nscuro in #6542
• Backport: exit the JVM when init tasks fail instead of hanging unready by @nscuro in #6712
• Backport: Fix project sorting by version by @nscuro in #6715
• Backport: Fix prepare-vuln-analysis activity failing when components have properties without value by @nscuro in #6714
• Backport: Fix local file storage not anticipating Windows-style paths by @nscuro in #6713
• Backport: Fix build workflow not running for PRs to release branches by @nscuro in #6738
• Backport: Fix NPE and redundant queries in VEX/VDR export by @nscuro in #6743

Dependency Updates 🤖

• Backport: chore(deps): Bump oasdiff/oasdiff-action from 0.0.48 to 0.0.51 by @nscuro in #6611
• chore(deps): Bump actions/cache from 5.0.5 to 6.1.0 by @dependabot[bot] in #6609
• chore(deps): Bump actions/setup-java from 5.2.0 to 5.4.0 by @dependabot[bot] in #6607
• chore(deps): Bump docker/setup-qemu-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6605
• chore(deps-dev): Bump org.cyclonedx:cyclonedx-maven-plugin from 2.9.1 to 2.9.2 by @dependabot[bot] in #6602
• chore(deps): Bump org.junit:junit-bom from 6.1.0 to 6.1.1 by @dependabot[bot] in #6601
• chore(deps): Bump imjasonh/setup-crane from 0.5 to 0.7 by @dependabot[bot] in #6600
• chore(deps): Bump actions/checkout from 6.0.2 to 7.0.0 by @dependabot[bot] in #6603
• chore(deps): Bump com.github.luben:zstd-jni from 1.5.7-9 to 1.5.7-11 by @dependabot[bot] in #6606
• chore(deps): Bump lib.swagger.version from 2.2.50 to 2.2.52 by @dependabot[bot] in #6604
• chore(deps): Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.1 to 5.6.2 by @dependabot[bot] in #6622
• chore(deps): Bump io.takari.maven:takari-smart-builder from 1.1.0 to 1.1.1 by @dependabot[bot] in #6620
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.155.0 to 0.156.3 by @dependabot[bot] in #6619
• chore(deps): Bump lib.protobuf-java.version from 4.35.0 to 4.35.1 by @dependabot[bot] in #6618
• chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.43 to 2.1.45 by @dependabot[bot] in #6621
• chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.4.2 to 13.7.0 by @dependabot[bot] in #6635
• chore(deps): Bump com.fasterxml.woodstox:woodstox-core from 7.2.0 to 7.2.1 by @dependabot[bot] in #6634
• chore(deps): Bump dev.cel:cel from 0.13.0 to 0.13.1 by @dependabot[bot] in #6636
• chore(deps): Bump io.dropwizard.flywaydb:flyway-bom from 12.6.1 to 12.10.0 by @dependabot[bot] in #6632
• chore(deps): Bump lib.logback.version from 1.5.33 to 1.5.37 by @dependabot[bot] in #6633
• chore(deps): Bump com.squareup.okhttp3:okhttp-jvm from 5.3.2 to 5.4.0 by @dependabot[bot] in #6644
• chore(deps): Bump org.jetbrains.kotlin:kotlin-bom from 2.3.21 to 2.4.0 by @dependabot[bot] in #6646
• chore(deps-dev): Bump org.apache.maven.plugins:maven-surefire-report-plugin from 3.5.5 to 3.5.6 by @dependabot[bot] in #6648
• chore(deps-dev): Bump org.openapitools:openapi-generator-maven-plugin from 7.22.0 to 7.23.0 by @dependabot[bot] in #6649
• chore(deps): Bump org.apache.kafka:kafka-clients from 4.3.0 to 4.3.1 by @dependabot[bot] in #6647
• chore(deps): Bump com.icegreen:greenmail-junit5 from 2.1.8 to 2.1.9 by @dependabot[bot] in #6675
• chore(deps): Bump oasdiff/oasdiff-action/breaking from 0.0.51 to 0.1.5 by @dependabot[bot] in #6674
• chore(deps): Bump io.minio:minio from 9.0.1 to 9.0.3 by @dependabot[bot] in #6673
• chore(deps): Bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6671
• chore(deps): Bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6669
• chore(deps): Bump io.github.openfeign:feign-bom from 13.12 to 13.13 by @dependabot[bot] in #6668
• chore(deps): Bump com.google.crypto.tink:tink from 1.21.0 to 1.22.0 by @dependabot[bot] in #6667
• chore(deps): Bump docker/build-push-action from 7.2.0 to 7.3.0 by @dependabot[bot] in #6676
• chore(deps): Bump docker/login-action from 4.2.0 to 4.4.0 by @dependabot[bot] in #6672
• chore(deps-dev): Bump com.zaxxer:HikariCP from 7.0.2 to 7.1.0 by @dependabot[bot] in #6670
• chore(deps): Bump io.micrometer:micrometer-bom from 1.16.5 to 1.17.0 by @dependabot[bot] in #6685
• chore(deps): Bump com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.22.0 by @dependabot[bot] in #6684
• chore(deps): Bump io.github.ascopes:protobuf-maven-plugin from 5.1.4 to 5.1.7 by @dependabot[bot] in #6683
• chore(deps): Bump io.prometheus:prometheus-metrics-bom from 1.6.1 to 1.8.0 by @dependabot[bot] in #6686
• chore(deps): Bump org.eclipse.parsson:jakarta.json from 1.1.7 to 1.1.9 by @dependabot[bot] in #6700
• chore(deps): Bump com.google.cloud.sql:postgres-socket-factory from 1.28.3 to 1.28.6 by @dependabot[bot] in #6699
• chore(deps): Bump org.jdbi:jdbi3-bom from 3.53.0 to 3.54.0 by @dependabot[bot] in #6698
• chore(deps): Bump org.postgresql:postgresql from 42.7.11 to 42.7.13 by @dependabot[bot] in #6697
• chore(deps): Bump lib.jetty.version from 12.1.9 to 12.1.11 by @dependabot[bot] in #6696
• chore(deps): Bump io.pebbletemplates:pebble from 4.1.1 to 4.1.2 by @dependabot[bot] in #6708
• chore(deps): Bump com.fasterxml.jackson:jackson-bom from 2.22.0 to 2.22.1 by @dependabot[bot] in #6709
• chore(deps): Bump com.adobe.testing:s3mock-testcontainers from 5.0.0 to 5.1.0 by @dependabot[bot] in #6707
• chore(deps): Bump io.smallrye.config:smallrye-config-bom from 3.17.2 to 3.18.0 by @dependabot[bot] in https://github.com/DependencyTrack/dependency-tra...

4.14.3

For official releases, refer to Dependency Track Docs >> Changelogs for information about improvements and upgrade notes.
If additional details are required, consult the closed issues for this release milestone.

# SHA1
40db3eb67df441382971c8fb6566b86bc65976f4  dependency-track-apiserver.jar
71a8e224166a55efb163922bb9874c151b3d95eb  dependency-track-bundled.jar
# SHA256
11a5c85616b745803b5653016d9da2195f2e23ac66fe6a85d2ae2b4661d393a9  dependency-track-apiserver.jar
4cbedd435f0f07b520216e4c30b9c81ca9a43044c569285ed1aa2e4f1533f5be  dependency-track-bundled.jar
# SHA512
804247f629c5b5bac7f7c667789478163c8f6fcbaa9b4a7978ebcb57766d4134e9d026e92c156981f8c717b390c5cc4ba1fc837afef661e653aee8e7096d2a6a  dependency-track-apiserver.jar
e047a7be9bac2b76e1f2a42722ca723a60b9b093e2bff3ed5df407a27e25a77ab6467c15ad124907fd5213781bff493e80e5563400360befb603f8e184463235  dependency-track-bundled.jar

What's Changed

Enhancements 🚀

• Improve VEX import performance by @nscuro in #6141
• Update workflows for 4.14.x maintenance by @nscuro in #6171
• Send groupby to defect dojo by @webdevred in #6130
• Include analysis.detail in DefectDojo finding payload by @webdevred in #6181

Bug Fixes 🐛

• Exclude retrieval of components and aliases during OSVDownloadTask by @ElenaStroebele in #6345
• Backport: Reject parent objects with null UUID when creating/updating/patching projects by @nscuro in #6355
• Fix Docker Hub secret names by @nscuro in #6390
• Fix NPE and redundant queries in VEX/VDR export by @heyiamwahab236 in #6614

Dependency Updates 🤖

• build(deps): bump debian from 8f0c555 to a053c41 in /src/main/docker by @dependabot[bot] in #6126
• build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by @dependabot[bot] in #6142
• build(deps): bump docker/login-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6143
• build(deps-dev): bump io.github.ascopes:protobuf-maven-plugin from 5.1.3 to 5.1.4 by @dependabot[bot] in #6144
• build(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by @dependabot[bot] in #6145
• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in #6146
• build(deps): bump docker/build-push-action from 6.19.2 to 7.1.0 by @dependabot[bot] in #6147
• build(deps): bump lib.protobuf-java.version from 4.34.1 to 4.35.0 by @dependabot[bot] in #6158
• build(deps): bump debian from a053c41 to 5012d05 in /src/main/docker by @dependabot[bot] in #6157
• build(deps-dev): bump io.swagger.parser.v3:swagger-parser from 2.1.41 to 2.1.42 by @dependabot[bot] in #6155
• build(deps): bump org.slf4j:log4j-over-slf4j from 2.0.17 to 2.0.18 by @dependabot[bot] in #6154
• build(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @dependabot[bot] in #6148
• build(deps): bump eclipse-temurin from 25.0.2_10-jdk-alpine to 25.0.3_9-jdk-alpine in /src/main/docker by @dependabot[bot] in #6161
• build(deps): bump org.metaeffekt.core:ae-security from 0.154.0 to 0.155.0 by @dependabot[bot] in #6164
• build(deps): bump org.apache.maven:maven-artifact from 3.9.15 to 3.9.16 by @dependabot[bot] in #6160
• chore(deps): Bump docker/build-push-action from 7.1.0 to 7.2.0 by @dependabot[bot] in #6177
• chore(deps): Bump dessant/lock-threads from 6.0.0 to 6.0.1 by @dependabot[bot] in #6174
• chore(deps): Bump dessant/lock-threads from 6.0.1 to 6.0.2 by @dependabot[bot] in #6236
• chore(deps): Bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6235
• chore(deps): Bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #6234
• chore(deps): Bump com.google.cloud.sql:postgres-socket-factory from 1.28.3 to 1.28.4 by @dependabot[bot] in #6256
• chore(deps): Bump com.google.cloud.sql:cloud-sql-connector-jdbc-sqlserver from 1.28.3 to 1.28.4 by @dependabot[bot] in #6258
• chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.42 to 2.1.43 by @dependabot[bot] in #6259
• chore(deps): Bump com.google.cloud.sql:mysql-socket-factory-connector-j-8 from 1.28.3 to 1.28.4 by @dependabot[bot] in #6257
• chore(deps): Bump io.github.nscuro:versatile-core from 0.18.1 to 0.18.3 by @dependabot[bot] in #6339
• chore(deps): Bump alpine from 3.23 to 3.24 in /src/main/docker by @dependabot[bot] in #6337
• chore(deps): Bump io.pebbletemplates:pebble from 4.1.1 to 4.1.2 by @dependabot[bot] in #6300
• chore(deps): Bump docker/setup-qemu-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #6299
• chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.3.0 to 13.5.0 by @dependabot[bot] in #6301
• chore(deps): Bump debian from 5012d05 to da0bfd2 in /src/main/docker by @dependabot[bot] in #6370
• chore(deps): Bump debian from da0bfd2 to 34363c2 in /src/main/docker by @dependabot[bot] in #6384
• build(deps): bump com.fasterxml.woodstox:woodstox-core from 7.1.1 to 7.2.0 by @dependabot[bot] in #6168
• Bump Alpine to 3.8.0 by @nscuro in #6391
• chore(deps): Bump com.fasterxml.woodstox:woodstox-core from 7.2.0 to 7.2.1 by @dependabot[bot] in #6409
• chore(deps): Bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #6410
• chore(deps): Bump lib.protobuf-java.version from 4.35.0 to 4.35.1 by @dependabot[bot] in #6425
• chore(deps): Bump alpine from a2d49ea to f5064d3 in /src/main/docker by @dependabot[bot] in #6421
• chore(deps): Bump alpine from 3.24 to 3.24.1 in /src/main/docker by @dependabot[bot] in #6432
• chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.43 to 2.1.44 by @dependabot[bot] in #6469
• chore(deps-dev): Bump com.icegreen:greenmail-junit5 from 2.1.8 to 2.1.9 by @dependabot[bot] in #6484
• chore(deps): Bump com.puppycrawl.tools:checkstyle from 13.5.0 to 13.6.0 by @dependabot[bot] in #6485
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.155.0 to 0.156.0 by @dependabot[bot] in #6486
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.0 to 0.156.1 by @dependabot[bot] in #6489
• chore(deps): Bump eclipse-temurin from c3e62cd to c3e62cd in /src/main/docker by @dependabot[bot] in #6487
• chore(deps): Bump debian from 34363c2 to ee12ffb in /src/main/docker by @dependabot[bot] in #6503
• chore(deps-dev): Bump io.github.ascopes:protobuf-maven-plugin from 5.1.4 to 5.1.5 by @dependabot[bot] in #6510
• chore(deps): Bump io.github.nscuro:versatile-core from 0.18.3 to 0.19.0 by @dependabot[bot] in #6534
• chore(deps): Bump org.metaeffekt.core:ae-security from 0.156.1 to 0.156.2 by @dependabot[bot] in #6535
• chore(deps): Bump actions/setup-java from 5.2.0 to 5.3.0 by @dependabot[bot] in #6536
• chore(deps): Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #6537...

5.0.2

What's Changed

Bug Fixes 🐛

• Backport: Fix bad CPE query performance for internal vuln analyzer by @nscuro in #6441
• Backport: Fix admin re-seeding when USER table is populated by @nscuro in #6442
• Backport: v4-migrator: Don't migrate obsolete notification groups for notification rules by @nscuro in #6444
• Backport: dex: Fix over-reporting of activity task queue depth metric by @nscuro in #6447
• Backport: Fix duplicate project name/version handling for /v1/project POST and PATCH endpoints by @nscuro in #6448
• Backport: Fix MIME type of email notification templates not being set correctly by @nscuro in #6455

Dependency Updates 🤖

• Backport: Bump Alpine base image to 3.24.1 by @nscuro in #6451

Full Changelog: 5.0.1...5.0.2

5.0.1

What's Changed

Enhancements 🚀

• Backport: v4-migrator: Add TCP keepalive and optional socket timeout by @nscuro in #6348
• Backport: v4-migrator: Fail fast when detecting bootstrap being pointed at v4 database by @nscuro in #6361
• Backport: Allow out-of-order execution of Flyway migrations by @nscuro in #6366

Bug Fixes 🐛

• Backport: Make REPOSITORY.AUTHENTICATIONREQUIRED non-nullable by @nscuro in #6349
• Backport: Apply stricter PURL normalization for NPM package metadata resolution by @nscuro in #6350
• Backport: Bypass outbox for notification rule tests by @nscuro in #6351
• Backport: Fix NO_PROXY being rejected as legacy Alpine property by @nscuro in #6352
• Backport: Reject parent objects with null UUID when creating/updating/patching projects by @nscuro in #6354
• Backport: v4-migrator: only run post-load actions when load phase completes successfully by @nscuro in #6353
• Backport: Fix NPE during LDAP auth when bind credentials are not configured by @nscuro in #6356
• Backport: Fix suppressed vulns being considered for policy evaluation by @nscuro in #6357
• Backport: Fix incomplete field coverage of /v1/finding/project/{uuid}'s searchText filter by @nscuro in #6358
• Backport: Fix OIDC UserInfo endpoint not being invoked when team sync is enabled and ID token contains no teams claim by @nscuro in #6359
• Backport: Fix URL-encoding of OSV ecosystem names by @nscuro in #6360
• Backport: Support non-UTC timezones for metrics operations by @nscuro in #6363
• Backport: Fix email notification publisher not populating the "From" header by @nscuro in #6362
• Backport: v4-migrator: Fix confusing debug log for missing tgt_permission table by @nscuro in #6364
• Backport: Fix URL-encoding of OSV ecosystem names when retrieving incremental advisories by @nscuro in #6375
• Backport: Handle PAC-inaccessible target projects more gracefully for BOM uploads with autoCreate=true by @nscuro in #6377
• Backport: Fix broken HTTP proxy basic auth by @nscuro in #6381
• Backport: Fix team of API key not being auto-assigned project access after project creation by @nscuro in #6389

Full Changelog: 5.0.0...5.0.1

5.0.0

Warning

Upgrading from v4 requires manual action.

• Migration is manual. See the migration guide. v4 must be ≥ 4.14.2 and offline during the upgrade. v5 requires PostgreSQL 14+ (H2, MySQL, SQL Server dropped).
• See Changes in v5 for what's new and what changed, including container-only distribution (no more WAR), REST API v1 changes, and new notification schemas.
• The official Helm chart is not yet compatible and fails rendering on v5 tags. Hold off if you deploy via Helm. See the Kubernetes deployment guide.

What's Changed

Enhancements 🚀

• Add problem type for invalid sort field errors by @nscuro in #6281
• Change tie-breaker sort columns for finding queries to allow more efficient sorting by @nscuro in #6289

Bug Fixes 🐛

• Fix LocalFileStorageTest flakiness by @nscuro in #6282
• v4-migrator: Grant SECRET_MANAGEMENT to principals with SYSTEM_CONFIGURATION permission by @nscuro in #6283
• Do not suggest internal sort tie-breaker columns as sortable via API by @nscuro in #6286
• Fix AuthZ being enforced on CORS preflight requests by @nscuro in #6288

Documentation 📃

• Add quickstart section to README by @nscuro in #6287
• Update README for GA release by @nscuro in #6290

Other Changes

• Remove unused code and unnecessary indirections by @nscuro in #6284

Full Changelog: 5.0.0-rc.5...5.0.0

5.0.0-rc.5

What's Changed

Enhancements 🚀

• v4-migrator: Add completion logs and annotate row-count diffs in verify phase by @nscuro in #6261
• Include isLatest flag in nested versions object of /api/v1/project responses by @nscuro in #6263
• Support component hash mismatch policy conditions by @nscuro in #6266
• Make latest version publish timestamp available to CEL policy engine by @nscuro in #6267

Bug Fixes 🐛

• v4-migrator: Explicitly cast ID columns to BIGINT during extract phase by @nscuro in #6253
• Fix missing allowed permission for /api/v2/projects/{uuid}/clone by @nscuro in #6262
• Fix missing fields from GET /api/v1/project response by @nscuro in #6275
• Fix EPSS < and <= policy conditions matching when vuln has no EPSS score by @nscuro in #6274
• Improve escaping of quoted strings for CEL policy inputs by @nscuro in #6276
• Restore legacy behavior of LICENSE and LICENSE_GROUP policy conditions by @nscuro in #6273
• v4-migrator: Fix scheduled notification rules not being migrated by @nscuro in #6277

Dependency Updates 🤖

• chore(deps-dev): Bump io.swagger.parser.v3:swagger-parser from 2.1.42 to 2.1.43 by @dependabot[bot] in #6254
• chore(deps): Bump lib.logback.version from 1.5.32 to 1.5.33 by @dependabot[bot] in #6255
• chore(deps): Bump net.javacrumbs.json-unit:json-unit-assertj from 5.1.1 to 5.1.2 by @dependabot[bot] in #6270
• chore(deps): Bump com.github.kagkarlsson:db-scheduler from 16.10.0 to 16.11.0 by @dependabot[bot] in #6269

Documentation 📃

• Add community meeting reference to README by @nscuro in #6265
• Update ADR-011 with follow-up about Kafka removal by @nscuro in #6278
• Document expected ADR format and writing style by @nscuro in #6279

Other Changes

• Always run manifest generation for DN plugin, even when restoring from cache by @nscuro in #6264
• Streamline responses of API v1 project list endpoints by @nscuro in #6280

Full Changelog: 5.0.0-rc.4...5.0.0-rc.5

5.0.0-rc.4

What's Changed

Enhancements 🚀

• Improve latest version detection for Cargo and Ruby Gems by @nscuro in #6245
• Try to only report stable versions as latest for Maven by @nscuro in #6244

Bug Fixes 🐛

• Enforce separate limits for compressed and uncompressed repository responses by @nscuro in #6239
• Fix ineffective assignment of random BOM refs during import by @nscuro in #6241
• Fix latent minor BOM import bugs by @nscuro in #6242
• v4-migrator: Run ANALYZE on staging src tables before transform by @nscuro in #6247
• v4-migrator: Dedupe components before join with repo meta component table by @nscuro in #6248
• dex: Prevent possible deadlock when creating task queues by @nscuro in #6249

Full Changelog: 5.0.0-rc.3...5.0.0-rc.4