Update dependency org.owasp:dependency-check-maven to v6.5.3 #194

renovate · 2022-02-28T20:32:34Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
org.owasp:dependency-check-maven	`6.1.6` -> `6.5.3`

jeremylong/DependencyCheck

Performance improvements for some Maven projects (see #3923 and #3931).
Fixed bug in npm version handling introduced in 6.5.2 (see #3956).
Improved the node package analyzer to correctly report the origin of a dependency (see #3970).
General code maintenance and false positive reductions.
See the full listing of changes.

Updated the dependency-check-maven plugin to correctly support SNAPSHOT version when a classifier is specified (#3787).
Improved the analysis of Swift package manager (package.resolved - see #3813).
General code maintenance and false positive reductions.
See the full listing of changes.

Added download attempts with increasing wait time for CVE meta files from the NVD to prevent rate limiting issues (see #3725).
See the full listing of changes.

Increased timeout between downloads from the NVD to prevent rate limiting issues (see #3722).
- cveStartYear is now configurable and can be set to any year from 2002 to present.
- cveWaitTime is a new configuration option to define how many milliseconds to wait between NVD downloads; default is 4000 ms (see #3690).
- The NVD CVE data files are now being cached for up to 4 hours in case a download fails, re-running ODC will use the cached version.
Fixed NPE in the ODC maven plugin (see #3702.
See the full listing of changes.

Reduced chance of rate limiting when download files from NVD (see #2670).
Fixed bug causing some transitive dependencies being skipped in the odc-maven-plugin (see #3627).
See the full listing of changes.

Many updates were made to improve performance on large scans, reduce false positives, and other bug fixes.
Increased the width of four columns in the database; if you use a an external database you should also update the width (see upgrade_5.1.sql).
See the full listing of changes.

Added an experimental Perl CPAN analyzer #3378
- Note that the full DSL of the CPAN is not yet supported so any required dependency is analyzed (i.e. there is no way to exclude development requirements)
Improved database performance #3206
The archive analyzer now extracts files from RPM archives #3226
Ensure ordered output in reports #3243
Several minor bug fixes and updates to reduce false positives
See the full listing of changes.