build(deps-dev): bump org.owasp:dependency-check-maven from 12.1.0 to 13.0.0

[dependabot]

Bumps org.owasp:dependency-check-maven from 12.1.0 to 13.0.0.

Release notes

Sourced from org.owasp:dependency-check-maven's releases.

Version 13.0.0

What's Changed

• chore: tidy changelog; highlighting 12.2.2 DB schema change by @​chadlwilson in dependency-check/DependencyCheck#8476
• build(deps): bump golang from 1.26.2-alpine to 1.26.3-alpine by @​dependabot[bot] in dependency-check/DependencyCheck#8492
• build(deps): bump org.apache.groovy:groovy-ant from 5.0.5 to 5.0.6 by @​dependabot[bot] in dependency-check/DependencyCheck#8491
• fix(reports): Correct XML report attribute denoting matched status for a suppressed vulnerability by @​chadlwilson in dependency-check/DependencyCheck#8487
• docs: correct Core Engine menu display by @​chadlwilson in dependency-check/DependencyCheck#8481
• chore: deprecate Nexus v2 support for removal by @​chadlwilson in dependency-check/DependencyCheck#8455
• build(deps): bump org.apache.maven.plugins:maven-invoker-plugin from 3.10.0 to 3.10.1 by @​dependabot[bot] in dependency-check/DependencyCheck#8480
• chore(fp): remove duplicate Jetty FPs already handled in hosted suppressions by @​chadlwilson in dependency-check/DependencyCheck#8486
• build(deps): bump slf4j.version from 2.0.17 to 2.0.18 by @​dependabot[bot] in dependency-check/DependencyCheck#8502
• fix: ensure working hostedSuppressions/RetireJS forceUpdate & correct cache validForHours checks by @​chadlwilson in dependency-check/DependencyCheck#8494
• fix(cli): correct displayed application name and deprecations in help text by @​chadlwilson in dependency-check/DependencyCheck#8496
• chore(fp): remove unnecessary prometheus suppressions by @​chadlwilson in dependency-check/DependencyCheck#8500
• test: fix expectations for RetireJS against AngularJS integration test by @​chadlwilson in dependency-check/DependencyCheck#8511
• fix: migrate git-commit-id-plugin to maintained io.github.git-commit-id coordinates by @​Umesh042005 in dependency-check/DependencyCheck#8473
• test: make yarn tests agnostic of corepack defaults by @​chadlwilson in dependency-check/DependencyCheck#8413
• chore(fp): remove unnecessary grpc suppressions by @​chadlwilson in dependency-check/DependencyCheck#8505
• chore(fp): use more conservative CPE 22 prefix suppression syntax to avoid false negatives by @​chadlwilson in dependency-check/DependencyCheck#8509
• fix: publish-suppressions action trigger by @​jeremylong in dependency-check/DependencyCheck#8516
• docs: clarify Sonatype Guide OSS Index suggestions by @​chadlwilson in dependency-check/DependencyCheck#8477
• build(deps): bump org.apache.maven.plugins:maven-enforcer-plugin from 3.6.2 to 3.6.3 by @​dependabot[bot] in dependency-check/DependencyCheck#8517
• ci: fix FP ops workflow to generate CPE regex for optional suffix matches by @​chadlwilson in dependency-check/DependencyCheck#8531
• ci: automatically publish suppressions after merged PRs by @​chadlwilson in dependency-check/DependencyCheck#8527
• fix(analyzer): detect OpenSSL 3.x in OpenSSLAnalyzer by @​shawnjohnjr in dependency-check/DependencyCheck#8484
• docs(cli): fix escaping by @​chadlwilson in dependency-check/DependencyCheck#8551
• build(deps): bump org.junit:junit-bom from 5.14.3 to 5.14.4 by @​dependabot[bot] in dependency-check/DependencyCheck#8547
• build(deps): bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 by @​dependabot[bot] in dependency-check/DependencyCheck#8556
• build(deps): bump org.apache.maven.plugins:maven-dependency-plugin from 3.10.0 to 3.11.0 by @​dependabot[bot] in dependency-check/DependencyCheck#8557
• build(deps-dev): bump org.apache.maven.plugins:maven-surefire-report-plugin from 3.5.5 to 3.5.6 by @​dependabot[bot] in dependency-check/DependencyCheck#8555
• build(deps-dev): bump org.eclipse.parsson:jakarta.json from 1.1.7 to 1.1.9 by @​dependabot[bot] in dependency-check/DependencyCheck#8552
• fix(core): add missing nvd.api.key entry to dependencycheck.properties by @​anand1416 in dependency-check/DependencyCheck#8549
• fix(fp): allow stricter matching of suppression CPE 2.2 URI prefixes to only whole parts by @​chadlwilson in dependency-check/DependencyCheck#8548
• build(deps): bump org.apache.maven.plugins:maven-site-plugin from 3.21.0 to 3.22.0 by @​dependabot[bot] in dependency-check/DependencyCheck#8545
• build(deps): bump org.json:json from 20251224 to 20260522 by @​dependabot[bot] in dependency-check/DependencyCheck#8546
• build(deps): Pin Lock Threads action to v6.0.2 SHA by @​jeremylong with @​Copilot in dependency-check/DependencyCheck#8559
• build(deps): bump the actions-deps group with 4 updates by @​dependabot[bot] in dependency-check/DependencyCheck#8563
• build(deps): bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.5 to 3.5.6 by @​dependabot[bot] in dependency-check/DependencyCheck#8562
• fix: improve Java 17+ compatibility by removing jdiagnostics by @​chadlwilson in dependency-check/DependencyCheck#8565
• build(deps): bump golang from 1.26.3-alpine to 1.26.4-alpine by @​dependabot[bot] in dependency-check/DependencyCheck#8569
• build(deps): bump org.codehaus.gmavenplus:gmavenplus-plugin from 4.3.1 to 5.0.0 by @​dependabot[bot] in dependency-check/DependencyCheck#8568
• build(deps): bump com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.22.0 by @​dependabot[bot] in dependency-check/DependencyCheck#8561
• build(deps): bump org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15 by @​dependabot[bot] in dependency-check/DependencyCheck#8574
• fix(fp): extend service project suppression to all Maven artifacts by @​chadlwilson in dependency-check/DependencyCheck#8677
• fix(windows): use JAVA_HOME when java is not on PATH by @​mohan485 in dependency-check/DependencyCheck#8656
• docs: document configuration of Gradle connection timeouts by @​chadlwilson in dependency-check/DependencyCheck#8490
• build(deps-dev): bump com.github.spotbugs:spotbugs-maven-plugin from 4.9.8.3 to 4.10.2.0 by @​dependabot[bot] in dependency-check/DependencyCheck#8585
• fix(reports): render CVSSv4 baseScore = 0.0 in JSON+XML reports by @​chadlwilson in dependency-check/DependencyCheck#8663
• build(deps): bump the actions-deps group with 7 updates by @​dependabot[bot] in dependency-check/DependencyCheck#8647
• build(deps): bump httpcomponents.client.version from 5.6.1 to 5.6.2 by @​dependabot[bot] in dependency-check/DependencyCheck#8646

... (truncated)

Changelog

Sourced from org.owasp:dependency-check-maven's changelog.

Change Log

For versions 13.0.0 and above, please see the the GitHub Releases page for the change log.

Version 12.2.2 (2026-05-03)

NOTE: The database schema was updated to fix #8466 - if using an external database the update scripts must be run!

• feat: improve Sonatype Guide / OSS Index cache handling and insufficient credits error reporting (#8451)
• feat: support and prefer githubID vuln identifiers from RetireJS (#8419)
• fix(db): widen reference URL column to handle long Mozilla CVE URLs (#8467)
• fix: add corepack to docker image (#8386)
• fix: bump open-vulnerability-clients to resolve NVD timestamp parsing errors (#8427)
• fix: de-duplicate and sort both includedBy and projectReferences in reports (#8440)
• fix: migrate default OSS Index API URL to Sonatype Guide; supporting optional username (#8404)
• docs: correct missing documentation for Gradle plugin (#8431)
• docs: tweak docs site structure; documenting missing analyzers (#8462)
• chore: remove spurious bundle-audit log line when there are no errors (#8454)
• chore: tidy CHANGELOG formatting (#8414)
• chore(fp): remove duplicate log4j FP suppressions (#8468)
• build(deps): bump apache.ant.version from 1.10.16 to 1.10.17 (#8416)
• build(deps): bump com.fasterxml.jackson:jackson-bom from 2.21.2 to 2.21.3 (#8465)
• build(deps): bump com.google.guava:guava from 33.5.0-jre to 33.6.0-jre (#8420)
• build(deps): bump com.mysql:mysql-connector-j from 9.6.0 to 9.7.0 (#8445)
• build(deps): bump commons-codec:commons-codec from 1.21.0 to 1.22.0 (#8453)
• build(deps): bump commons-io:commons-io from 2.21.0 to 2.22.0 (#8448)
• build(deps): bump httpcomponents.client.version from 5.6 to 5.6.1 (#8432)
• build(deps): bump joda-time:joda-time from 2.14.1 to 2.14.2 (#8464)
• build(deps): bump org.apache.maven.plugins:maven-invoker-plugin from 3.9.1 to 3.10.0 (#8452)
• build(deps): bump org.jsoup:jsoup from 1.22.1 to 1.22.2 (#8437)
• build(deps): bump org.postgresql:postgresql from 42.7.10 to 42.7.11 (#8463)
• build(deps): bump the actions-deps group with 8 updates (#8472)

See the full listing of changes

Version 12.2.1 (2026-04-11)

• fix(core): correct xml schema validation handling without needing external access (#8272)
• fix(deps): upgrade slf4j and logback (#8306)
• fix(test): disable pnpm analyzer during test (#8305)
• fix: Correct published/hosted suppressions namespace header and indent (#8258)
• fix: Suppress noisy WARN logging from Apache Lucene within Maven and Ant plugins (#8248)
• fix: #8140 AssemblyAnalyzer version resolution issue (#8352)
• fix: #8140 fix version resolution
• fix: #8140 hint azure_identity_library_for_.net
• fix: #8356 narrow down VersionFilterAnalyzer scope to JAR files (#8358)
• fix: correct parsing for CVSSv4 strings with Provider Urgency (#8377)
• fix: evidence source in Retire JS analyzer (#8303)
• fix: exclude deprecations from Yarn Berry audit results (#8380)
• fix: improve PEAnalyzer reliability by migrating to maintained PE/COFF 4J library fork (#8245)

... (truncated)

Commits

• 4aacdb1 build: prepare release v13.0.0
• ea6c70d docs: move changelog to github releases
• d10333c build(deps): bump logback from 1.5.32 to 1.5.34 (#8698)
• ef5fba7 build(deps): bump open-vulnerability-clients from 9.0.5 to 9.0.6 (#8697)
• 1547a6f chore!: drop deprecated configuration, integration options & Nexus V2 Search ...
• cddad18 build(deps): bump org.apache.groovy:groovy-ant from 5.0.6 to 5.0.8 (#8692)
• 78dfd95 build(deps): bump org.jsoup:jsoup from 1.22.2 to 1.23.1 (#8693)
• 2d3be64 build(deps): bump com.fasterxml.jackson:jackson-bom from 2.22.0 to 2.22.1 (#8...
• 57f6189 build(deps): bump httpcomponents.client.version from 5.6.2 to 5.6.3 (#8695)
• 30af761 build(deps): bump commons-codec:commons-codec from 1.22.0 to 1.22.1 (#8696)
• Additional commits viewable in compare view