diff --git a/.github/ISSUE_TEMPLATE/false-positive-report.yml b/.github/ISSUE_TEMPLATE/false-positive-report.yml
index b14906835fc..080828b4c7f 100644
--- a/.github/ISSUE_TEMPLATE/false-positive-report.yml
+++ b/.github/ISSUE_TEMPLATE/false-positive-report.yml
@@ -6,6 +6,8 @@ body:
- type: markdown
attributes:
value: |
+ **Ensure you are using the latest version of dependency-check.**
+
**Automation is used to process most false positives reports**; failure to follow these guidelines will delay the process:
- Only enter a **single (1) Package URL**.
@@ -27,7 +29,7 @@ body:
id: cpe
attributes:
label: CPE
- description: Please enter the single Common Platform enumeration (CPE) as identified in the HTML Report. Only a **single CPE** can be specified. **Please put backtic characters around the CPE to ensure it displays correctly**.
+ description: Please enter the single Common Platform enumeration (CPE) as identified in the HTML Report. Only a **single CPE** can be specified. **Please put backtick characters around the CPE to ensure it displays correctly**.
placeholder: ex. `cpe:2.3:a:apache:log4j:2.12.1:*:*:*:*:*:*:*`
validations:
required: true
@@ -35,7 +37,7 @@ body:
id: cve
attributes:
label: CVE
- description: The vulnerability name as identified in the HTML Report. If specifying a CPE this is not necassary; if entered please enter only a **signle CVE**; if multiple CVE should be suppressed please enter multiple FP reports. This is optional and may not be needed as most FP reports are due to an incorrect CPE.
+ description: The vulnerability name as identified in the HTML Report. If specifying a CPE this is not necessary; if entered please enter only a **single CVE**; if multiple CVE should be suppressed please enter multiple FP reports. This is optional and may not be needed as most FP reports are due to an incorrect CPE.
placeholder: ex. CVE-2021-44228
validations:
required: false
@@ -66,4 +68,4 @@ body:
label: Description
description: Additional information regarding the false positive report.
validations:
- required: false
\ No newline at end of file
+ required: false
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e9847615dd6..850054c0bb5 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -20,9 +20,9 @@ jobs:
- name: Install gpg secret key
id: install-gpg-key
run: |
- cat <(echo -e "${{ secrets.OSSRH_GPG_SECRET_KEY }}") | gpg --batch --import
+ cat <(echo -e "${{ secrets.GPG_PRIVATE_KEY }}") | gpg --batch --import
gpg --list-secret-keys --keyid-format LONG
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v5
- name: Check Maven Cache
id: maven-cache
uses: actions/cache@v4
@@ -43,30 +43,31 @@ jobs:
with:
path: core/target/data
key: odc-data
- - uses: actions/setup-dotnet@v4.3.1
+ - uses: actions/setup-dotnet@v5.0.0
with:
dotnet-version: '8.0.x'
- name: Set up JDK 11
id: jdk-11
- uses: actions/setup-java@v4
+ uses: actions/setup-java@v5
with:
java-version: 11
distribution: 'zulu'
- server-id: ossrh
- server-username: ${{ secrets.OSSRH_USERNAME }}
- server-password: ${{ secrets.OSSRH_TOKEN }}
- - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+ server-id: central
+ server-username: ${{ secrets.CENTRAL_USER }}
+ server-password: ${{ secrets.CENTRAL_PASSWORD }}
+ - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
with:
version: 6.0.2
- name: Build Snapshot with Maven
id: build-snapshot
env:
- MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
- MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }}
+ MAVEN_USERNAME: ${{ secrets.CENTRAL_USER }}
+ MAVEN_PASSWORD: ${{ secrets.CENTRAL_PASSWORD }}
+ MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PRIVATE_KEY_PASSWORD }}
NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
- run: mvn -V -s settings.xml -Prelease clean package verify source:jar javadoc:jar gpg:sign deploy -DreleaseTesting --no-transfer-progress --batch-mode -Dgpg.passphrase=${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }}
+ run: mvn -V -s settings.xml -Prelease clean package verify source:jar javadoc:jar gpg:sign deploy -DreleaseTesting --no-transfer-progress --batch-mode
- name: SARIF Multitool
- uses: microsoft/sarif-actions@v0.1
+ uses: microsoft/sarif-actions@v0.2
with:
# Command to be sent to SARIF Multitool
command: 'validate core/target/test-reports/Report.sarif'
@@ -100,20 +101,20 @@ jobs:
ant/target/*.zip
cli/target/*.zip
- publish_coverage:
- name: publish code coverage reports
- runs-on: ubuntu-latest
- needs: build
- steps:
- - name: Download coverage reports
- uses: actions/download-artifact@v4
- with:
- name: code-coverage-report
- - name: Run codacy-coverage-reporter
- uses: codacy/codacy-coverage-reporter-action@master
- with:
- project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
- coverage-reports: utils/target/jacoco-results/jacoco.xml,core/target/jacoco-results/jacoco.xml,maven/target/jacoco-results/jacoco.xml,ant/target/jacoco-results/jacoco.xml,cli/target/jacoco-results/jacoco.xml
+# publish_coverage:
+# name: publish code coverage reports
+# runs-on: ubuntu-latest
+# needs: build
+# steps:
+# - name: Download coverage reports
+# uses: actions/download-artifact@v5
+# with:
+# name: code-coverage-report
+# - name: Run codacy-coverage-reporter
+# uses: codacy/codacy-coverage-reporter-action@master
+# with:
+# project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
+# coverage-reports: utils/target/jacoco-results/jacoco.xml,core/target/jacoco-results/jacoco.xml,maven/target/jacoco-results/jacoco.xml,ant/target/jacoco-results/jacoco.xml,cli/target/jacoco-results/jacoco.xml
docker:
permissions:
@@ -127,7 +128,7 @@ jobs:
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
steps:
- name: Checkout code
- uses: actions/checkout@v4
+ uses: actions/checkout@v5
- name: Check Maven Cache
id: maven-cache
uses: actions/cache@v4
@@ -137,9 +138,21 @@ jobs:
restore-keys: |
${{ runner.os }}-maven-
- name: Download release build
- uses: actions/download-artifact@v4
+ uses: actions/download-artifact@v5
with:
name: archive-snapshot
+ - name: Set up Docker
+ uses: docker/setup-docker-action@v4
+ with:
+ daemon-config: |
+ {
+ "debug": true,
+ "features": {
+ "containerd-snapshotter": true
+ }
+ }
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v3
- name: Build Docker Image
run: ./build-docker.sh
- name: build scan target
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 665a11d4f62..428f96ee81a 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -33,11 +33,11 @@ jobs:
steps:
- name: Checkout repository
- uses: actions/checkout@v4
+ uses: actions/checkout@v5
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
- uses: github/codeql-action/init@v3
+ uses: github/codeql-action/init@v4
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -61,4 +61,4 @@ jobs:
mvn -s settings.xml clean package -DskipTests=true --no-transfer-progress --batch-mode
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v3
+ uses: github/codeql-action/analyze@v4
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
deleted file mode 100644
index a4ef6b2aea6..00000000000
--- a/.github/workflows/coverity.yml
+++ /dev/null
@@ -1,37 +0,0 @@
-name: coverity-scan
-on:
- schedule:
- - cron: '0 0 * * SAT'
-
-permissions:
- contents: read
-
-jobs:
- scan:
- runs-on: ubuntu-latest
- steps:
- - uses: actions/checkout@v4
- - name: Set up JDK 11
- id: jdk-11
- uses: actions/setup-java@v4
- with:
- java-version: 11
- distribution: 'zulu'
- - name: Get coverity cli
- run: |
- wget https://scan.coverity.com/download/linux64 --no-verbose --post-data "token=${{ secrets.COVERITY_TOKEN }}&project=dependency-check%2FDependencyCheck" -O coverity_tool.tgz
- mkdir coverity_tool
- tar xzf coverity_tool.tgz --strip 1 -C coverity_tool
- - name: Perform coverity scan
- run: |
- export PATH=`pwd`/coverity_tool/bin:$PATH
- cov-build --dir cov-int mvn -DskipTests=true package --no-transfer-progress --batch-mode
- - name: Submit coverity scan
- run: |
- tar czvf scan.tgz cov-int
- curl --form token=${{ secrets.COVERITY_TOKEN }} \
- --form email=jeremy.long@gmail.com \
- --form file=@scan.tgz \
- --form version="main" \
- --form description="Weekly Scan" \
- https://scan.coverity.com/builds?project=dependency-check%2FDependencyCheck
diff --git a/.github/workflows/false-positive-approvals.yml b/.github/workflows/false-positive-approvals.yml
index 24bca4e69c3..32b978d9e96 100644
--- a/.github/workflows/false-positive-approvals.yml
+++ b/.github/workflows/false-positive-approvals.yml
@@ -18,19 +18,20 @@ jobs:
(github.event.comment.user.login == 'jeremylong' ||
github.event.comment.user.login == 'aikebah' ||
github.event.comment.user.login == 'nhumblot' ||
+ github.event.comment.user.login == 'marcelstoer' ||
github.event.comment.user.login == 'chadlwilson') }}
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v5
with:
ref: generatedSuppressions
- - uses: actions/setup-node@v4.3.0
+ - uses: actions/setup-node@v5.0.0
- run: |
npm install fast-xml-parser@4.0.9
npm install fs
- name: Commit Suppression Rule
id: fp-ops-commit
- uses: actions/github-script@v7.0.1
+ uses: actions/github-script@v8.0.0
with:
script: |
const { execSync } = require("child_process");
@@ -158,7 +159,7 @@ jobs:
target-folder: suppressions
- name: Message failure
if: ${{ failure() || steps.fp-ops-commit.outputs.failed }}
- uses: actions/github-script@v7.0.1
+ uses: actions/github-script@v8.0.0
with:
script: |
github.rest.issues.createComment({
diff --git a/.github/workflows/false-positive-ops.yml b/.github/workflows/false-positive-ops.yml
index 3ea10dc092f..81b0bb9f6db 100644
--- a/.github/workflows/false-positive-ops.yml
+++ b/.github/workflows/false-positive-ops.yml
@@ -15,7 +15,7 @@ jobs:
steps:
- name: Remove Labels
if: contains(github.event.issue.labels.*.name, 'pending more information')
- uses: actions/github-script@v7.0.1
+ uses: actions/github-script@v8.0.0
with:
script: |
github.rest.issues.removeLabel({
@@ -32,7 +32,7 @@ jobs:
repo: context.repo.repo
})
)
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v5
with:
path: odc
- name: Parse False Positive Issue
@@ -41,7 +41,7 @@ jobs:
with:
issue-body: ${{ github.event.issue.body }}
template-path: odc/.github/ISSUE_TEMPLATE/false-positive-report.yml
- - uses: actions/setup-node@v4.3.0
+ - uses: actions/setup-node@v5.0.0
with:
node-version: 14
- name: Initialize npm
@@ -50,7 +50,7 @@ jobs:
npm install packageurl-js
- name: Parse Package URL
id: purl-parser
- uses: actions/github-script@v7.0.1
+ uses: actions/github-script@v8.0.0
env:
PURL: ${{ fromJSON(steps.issue-parser.outputs.jsonString).purl }}
with:
@@ -111,7 +111,7 @@ jobs:
cd ..
- name: Setup dotnet
if: ${{ fromJSON(steps.purl-parser.outputs.result).type == 'nuget' }}
- uses: actions/setup-dotnet@v4.3.1
+ uses: actions/setup-dotnet@v5.0.0
with:
dotnet-version: '8.0.x'
- name: Setup dotnet fp-project
@@ -140,6 +140,8 @@ jobs:
args: >
--failOnCVSS 11
--enableExperimental
+ --ossIndexUsername ${{ secrets.OSS_INDEX_USERNAME }}
+ --ossIndexPassword ${{ secrets.OSS_INDEX_API_TOKEN }}
- name: Upload FP Report
if: steps.check_files.outputs.files_exists == 'true'
uses: actions/upload-artifact@v4
@@ -148,7 +150,7 @@ jobs:
path: ${{github.workspace}}/reports
- name: Comment on maven issue
if: ${{ fromJSON(steps.purl-parser.outputs.result).type == 'maven' }}
- uses: actions/github-script@v7.0.1
+ uses: actions/github-script@v8.0.0
env:
GROUPID: ${{ fromJSON(steps.purl-parser.outputs.result).namespace }}
ARTIFACTID: ${{ fromJSON(steps.purl-parser.outputs.result).name }}
@@ -199,7 +201,7 @@ jobs:
})
- name: Comment on npm issue
if: ${{ fromJSON(steps.purl-parser.outputs.result).type == 'npm' }}
- uses: actions/github-script@v7.0.1
+ uses: actions/github-script@v8.0.0
env:
NAME: ${{ fromJSON(steps.purl-parser.outputs.result).name }}
VERSION: ${{ fromJSON(steps.purl-parser.outputs.result).version }}
@@ -246,7 +248,7 @@ jobs:
})
- name: Comment on dotnet issue
if: ${{ fromJSON(steps.purl-parser.outputs.result).type == 'nuget' }}
- uses: actions/github-script@v7.0.1
+ uses: actions/github-script@v8.0.0
env:
NAME: ${{ fromJSON(steps.purl-parser.outputs.result).name }}
VERSION: ${{ fromJSON(steps.purl-parser.outputs.result).version }}
@@ -293,7 +295,7 @@ jobs:
- name: Message failure
if: ${{ failure() }}
- uses: actions/github-script@v7.0.1
+ uses: actions/github-script@v8.0.0
with:
script: |
github.rest.issues.createComment({
diff --git a/.github/workflows/lint-pr.yml b/.github/workflows/lint-pr.yml
index d990c5ae5a2..0c4125f1bd8 100644
--- a/.github/workflows/lint-pr.yml
+++ b/.github/workflows/lint-pr.yml
@@ -18,6 +18,6 @@ jobs:
statuses: write
runs-on: ubuntu-latest
steps:
- - uses: amannn/action-semantic-pull-request@v5.5.3
+ - uses: amannn/action-semantic-pull-request@v6.1.1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file
diff --git a/.github/workflows/publish-suppressions.yml b/.github/workflows/publish-suppressions.yml
new file mode 100644
index 00000000000..75245cb59f9
--- /dev/null
+++ b/.github/workflows/publish-suppressions.yml
@@ -0,0 +1,40 @@
+name: Publish Suppressions
+
+on:
+ workflow_dispatch:
+
+permissions: {}
+jobs:
+ update_suppression:
+ permissions:
+ contents: write # to push changes in repo (jamesives/github-pages-deploy-action)
+
+ name: Publish Suppressions
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v5
+ with:
+ ref: generatedSuppressions
+ - uses: actions/setup-node@v5.0.0
+ - run: |
+ npm install fs
+ - name: Create Generated Suppressions XML
+ uses: actions/github-script@v8.0.0
+ with:
+ script: |
+ const fs = require('fs');
+ const generatedSuppressions = fs.readFileSync('generatedSuppressions.xml', 'utf8');
+ if (!fs.existsSync('./suppressions')){
+ fs.mkdirSync('./suppressions');
+ }
+ fs.appendFileSync('suppressions/publishedSuppressions.xml', '\n' + generatedSuppressions + '\n', function (err) {
+ if (err) throw err;
+ console.log('publishedSuppressions.xml created');
+ });
+ - name: Publish Updated Suppressions
+ uses: JamesIves/github-pages-deploy-action@v4.7.3
+ with:
+ branch: gh-pages
+ folder: suppressions
+ target-folder: suppressions
+
diff --git a/.github/workflows/pull_requests.yml b/.github/workflows/pull_requests.yml
index ceee74e7455..fc35f684891 100644
--- a/.github/workflows/pull_requests.yml
+++ b/.github/workflows/pull_requests.yml
@@ -14,7 +14,7 @@ jobs:
contents: read
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v5
- name: Check Maven Cache
id: maven-cache
uses: actions/cache@v4
@@ -23,16 +23,16 @@ jobs:
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
restore-keys: |
${{ runner.os }}-maven-
- - uses: actions/setup-dotnet@v4.3.1
+ - uses: actions/setup-dotnet@v5.0.0
with:
dotnet-version: '8.0.x'
- name: Set up JDK 11
id: jdk-11
- uses: actions/setup-java@v4
+ uses: actions/setup-java@v5
with:
java-version: 11
distribution: 'zulu'
- - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+ - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
with:
version: 6.0.2
- name: Test with Maven
@@ -40,31 +40,43 @@ jobs:
run: |
mvn -V -s settings.xml -pl utils,core,cli,ant,archetype -am compile verify --no-transfer-progress --batch-mode
- name: SARIF Multitool
- uses: microsoft/sarif-actions@v0.1
+ uses: microsoft/sarif-actions@v0.2
with:
# Command to be sent to SARIF Multitool
command: 'validate core/target/test-reports/Report.sarif'
- name: Upload SARIF file
- uses: github/codeql-action/upload-sarif@v3
+ uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: utils/target/spotbugsSarif.json
category: spotbugs-utils
- name: Upload SARIF file
- uses: github/codeql-action/upload-sarif@v3
+ uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: cli/target/spotbugsSarif.json
category: spotbugs-cli
- name: Upload SARIF file
- uses: github/codeql-action/upload-sarif@v3
+ uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: ant/target/spotbugsSarif.json
category: spotbugs-ant
- name: Upload SARIF file
- uses: github/codeql-action/upload-sarif@v3
+ uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: core/target/spotbugsSarif.json
category: spotbugs-core
-
+ - name: Archive Snapshot
+ id: archive-snapshot
+ uses: actions/upload-artifact@v4
+ with:
+ name: archive-snapshot
+ retention-days: 1
+ path: |
+ **/target/*.asc
+ **/target/*.jar
+ **/target/*.pom
+ ant/target/*.zip
+ cli/target/*.zip
+
maven:
name: Regression Test Maven Plugin
permissions:
@@ -72,7 +84,7 @@ jobs:
contents: read
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v5
- name: Check Maven Cache
id: maven-cache
uses: actions/cache@v4
@@ -81,16 +93,16 @@ jobs:
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
restore-keys: |
${{ runner.os }}-maven-
- - uses: actions/setup-dotnet@v4.3.1
+ - uses: actions/setup-dotnet@v5.0.0
with:
dotnet-version: '8.0.x'
- name: Set up JDK 11
id: jdk-11
- uses: actions/setup-java@v4
+ uses: actions/setup-java@v5
with:
java-version: 11
distribution: 'zulu'
- - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+ - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
with:
version: 6.0.2
- name: Regression Test Maven Plugin
@@ -108,7 +120,7 @@ jobs:
retention-days: 7
path: maven/target/it/**/build.log
- name: Upload SARIF file
- uses: github/codeql-action/upload-sarif@v3
+ uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: maven/target/spotbugsSarif.json
category: spotbugs-maven
@@ -120,7 +132,7 @@ jobs:
contents: read
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v5
- name: Check Maven Cache
id: maven-cache
uses: actions/cache@v4
@@ -131,7 +143,7 @@ jobs:
${{ runner.os }}-maven-
- name: Set up JDK 11
id: jdk-11
- uses: actions/setup-java@v4
+ uses: actions/setup-java@v5
with:
java-version: 11
distribution: 'zulu'
@@ -140,7 +152,48 @@ jobs:
run: |
mvn -V -s settings.xml checkstyle:checkstyle-aggregate --no-transfer-progress --batch-mode
- name: Upload SARIF file
- uses: github/codeql-action/upload-sarif@v3
+ uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: target/checkstyle-result.sarif
- category: checkstyle
\ No newline at end of file
+ category: checkstyle
+
+ docker:
+ permissions:
+ contents: read # to fetch code (actions/checkout)
+
+ name: Build and Test Docker
+ runs-on: ubuntu-latest
+ needs: test
+ steps:
+ - name: Checkout code
+ uses: actions/checkout@v5
+ - name: Check Maven Cache
+ id: maven-cache
+ uses: actions/cache@v4
+ with:
+ path: ~/.m2/repository
+ key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
+ restore-keys: |
+ ${{ runner.os }}-maven-
+ - name: Download release build
+ uses: actions/download-artifact@v5
+ with:
+ name: archive-snapshot
+ - name: Set up Docker
+ uses: docker/setup-docker-action@v4
+ with:
+ daemon-config: |
+ {
+ "debug": true,
+ "features": {
+ "containerd-snapshotter": true
+ }
+ }
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v3
+ - name: Build Docker Image
+ run: ./build-docker.sh
+ - name: build scan target
+ run: mvn -V -s settings.xml package -DskipTests=true --no-transfer-progress --batch-mode
+ - name: Test Docker Image
+ run: ./test-docker.sh
diff --git a/.github/workflows/purge-cache.yml b/.github/workflows/purge-cache.yml
index babd4553f67..9820e850a90 100644
--- a/.github/workflows/purge-cache.yml
+++ b/.github/workflows/purge-cache.yml
@@ -10,7 +10,7 @@ jobs:
name: Purge GitHub Cache
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v5
- name: Check Maven Cache
id: maven-cache
uses: actions/cache@v4
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 081eb1e67ad..d2cbf30c8e7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,9 +24,9 @@ jobs:
- name: Install gpg secret key
id: install-gpg-key
run: |
- cat <(echo -e "${{ secrets.OSSRH_GPG_SECRET_KEY }}") | gpg --batch --import
+ cat <(echo -e "${{ secrets.GPG_PRIVATE_KEY }}") | gpg --batch --import
gpg --list-secret-keys --keyid-format LONG
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v5
- name: Check Maven Cache
id: maven-cache
uses: actions/cache@v4
@@ -45,19 +45,19 @@ jobs:
with:
path: core/target/data
key: odc-data
- - uses: actions/setup-dotnet@v4.3.1
+ - uses: actions/setup-dotnet@v5.0.0
with:
dotnet-version: '8.0.x'
- name: Set up JDK 11
id: jdk-11
- uses: actions/setup-java@v4
+ uses: actions/setup-java@v5
with:
java-version: 11
distribution: 'zulu'
- server-id: ossrh
- server-username: ${{ secrets.OSSRH_USERNAME }}
- server-password: ${{ secrets.OSSRH_TOKEN }}
- - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+ server-id: central
+ server-username: ${{ secrets.CENTRAL_USER }}
+ server-password: ${{ secrets.CENTRAL_PASSWORD }}
+ - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
with:
version: 6.0.2
- name: Configure Git user
@@ -72,11 +72,12 @@ jobs:
id: build-release
timeout-minutes: 120
env:
- MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
- MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }}
+ MAVEN_USERNAME: ${{ secrets.CENTRAL_USER }}
+ MAVEN_PASSWORD: ${{ secrets.CENTRAL_PASSWORD }}
+ MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PRIVATE_KEY_PASSWORD }}
NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
run: |
- mvn -V -s settings.xml -Prelease "-DnexusUrl=https://oss.sonatype.org/" clean package source:jar javadoc:jar gpg:sign deploy site site:stage -DreleaseTesting --no-transfer-progress --batch-mode -Dgpg.passphrase=${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }}
+ mvn -V -s settings.xml -Prelease clean package source:jar javadoc:jar gpg:sign deploy site site:stage -DreleaseTesting --no-transfer-progress --batch-mode
- name: Archive code coverage results
id: archive-coverage
uses: actions/upload-artifact@v4
@@ -107,20 +108,20 @@ jobs:
retention-days: 7
path: target/staging/
- publish_coverage:
- name: publish code coverage reports
- runs-on: ubuntu-latest
- needs: build
- steps:
- - name: Download coverage reports
- uses: actions/download-artifact@v4
- with:
- name: code-coverage-report
- - name: Run codacy-coverage-reporter
- uses: codacy/codacy-coverage-reporter-action@master
- with:
- project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
- coverage-reports: utils/target/jacoco-results/jacoco.xml,core/target/jacoco-results/jacoco.xml,maven/target/jacoco-results/jacoco.xml,ant/target/jacoco-results/jacoco.xml,cli/target/jacoco-results/jacoco.xml
+# publish_coverage:
+# name: publish code coverage reports
+# runs-on: ubuntu-latest
+# needs: build
+# steps:
+# - name: Download coverage reports
+# uses: actions/download-artifact@v5
+# with:
+# name: code-coverage-report
+# - name: Run codacy-coverage-reporter
+# uses: codacy/codacy-coverage-reporter-action@master
+# with:
+# project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
+# coverage-reports: utils/target/jacoco-results/jacoco.xml,core/target/jacoco-results/jacoco.xml,maven/target/jacoco-results/jacoco.xml,ant/target/jacoco-results/jacoco.xml,cli/target/jacoco-results/jacoco.xml
docker:
name: Publish Docker
@@ -143,11 +144,23 @@ jobs:
path: ~/OWASP-Dependency-Check
key: docker-repo
- name: Checkout code
- uses: actions/checkout@v4
+ uses: actions/checkout@v5
- name: Download release build
- uses: actions/download-artifact@v4
+ uses: actions/download-artifact@v5
with:
name: archive-release
+ - name: Set up Docker
+ uses: docker/setup-docker-action@v4
+ with:
+ daemon-config: |
+ {
+ "debug": true,
+ "features": {
+ "containerd-snapshotter": true
+ }
+ }
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v3
- name: Build Docker Image
run: ./build-docker.sh
- name: build scan target
@@ -165,14 +178,14 @@ jobs:
needs: build
steps:
- name: Checkout code
- uses: actions/checkout@v4
+ uses: actions/checkout@v5
- name: Get version
id: get-version
run: |
VERSION=$( mvn help:evaluate -Dexpression=project.version -q -DforceStdout )
echo "VERSION=$VERSION" >> $GITHUB_ENV
- name: Download release build
- uses: actions/download-artifact@v4
+ uses: actions/download-artifact@v5
with:
name: archive-release
- name: Create Release
@@ -245,9 +258,9 @@ jobs:
needs: build
steps:
- name: Checkout code
- uses: actions/checkout@v4
+ uses: actions/checkout@v5
- name: Download Site
- uses: actions/download-artifact@v4
+ uses: actions/download-artifact@v5
with:
name: archive-site
path: target/staging
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6fbdc8f6fea..6686cb21509 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,60 +1,140 @@
# Change Log
+## [Version 12.1.8](https://github.com/dependency-check/DependencyCheck/releases/tag/v12.1.8) (2025-10-13)
+
+- fix: improve VulnerableSoftware comparison ([#8031](https://github.com/dependency-check/DependencyCheck/pull/8031))
+- build: fix flaky central test ([#8039](https://github.com/dependency-check/DependencyCheck/pull/8039))
+- docs: Improve Gradle docs wrt experimental analyzers, use of Central and Proxy configuration ([#8036](https://github.com/dependency-check/DependencyCheck/pull/8036))
+- docs: add note about central analyzer for gradle ([#8038](https://github.com/dependency-check/DependencyCheck/pull/8038))
+
+See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/101?closed=1)
+
+## [Version 12.1.7](https://github.com/dependency-check/DependencyCheck/releases/tag/v12.1.7) (2025-10-12)
+
+- fix: disable central analyzer after failures ([#7993](https://github.com/dependency-check/DependencyCheck/pull/7993))
+- fix: Suppress JVM warnings from Lucene within CLI ([#8003](https://github.com/dependency-check/DependencyCheck/pull/8003))
+- fix: Clean up Apache Lucene logging via SLF4j redirect ([#7979](https://github.com/dependency-check/DependencyCheck/pull/7979))
+- fix: Correct Archive Analyzer behaviour on certain tgz archives ([#7986](https://github.com/dependency-check/DependencyCheck/pull/7986))
+- fix: Update NVD CPE search URLs in generated reports to match new search interface ([#7970](https://github.com/dependency-check/DependencyCheck/pull/7970))
+- fix: improve OSS Index Error Reporting ([#7977](https://github.com/dependency-check/DependencyCheck/pull/7977))
+- fix(fp): Consolidate false positive suppression for false positives on Redis client libs ([#8017](https://github.com/dependency-check/DependencyCheck/pull/8017))
+- fix(fp): Fix more common false positives for popular PHP/composer frameworks with generic names ([#7994](https://github.com/dependency-check/DependencyCheck/pull/7994))
+- docs: improve slack notification documentation ([#8026](https://github.com/dependency-check/DependencyCheck/pull/8026))
+- docs: Documentation artifactory settings fix ([#7999](https://github.com/dependency-check/DependencyCheck/pull/7999))
+- docs: Clarify Nexus Analyzer requirements and usage ([#8000](https://github.com/dependency-check/DependencyCheck/pull/8000))
+- build: Build amd64 and arm64 multi-platform Docker image ([#7952](https://github.com/dependency-check/DependencyCheck/pull/7952))
+
+See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/100?closed=1)
+
+## [Version 12.1.6](https://github.com/dependency-check/DependencyCheck/releases/tag/v12.1.6) (2025-09-24)
+
+- fix: Disable OSS Index if its credentials are missing ([#7963](https://github.com/dependency-check/DependencyCheck/pull/7963))
+- fix: Correct CVSSv4 parsing for low precision OSSIndex values ([#7935](https://github.com/dependency-check/DependencyCheck/pull/7935))
+- fix(fp): Fix false positives for Redis Server against NPM/JS client libs ([#7942](https://github.com/dependency-check/DependencyCheck/pull/7942))
+- docs: Fix legacy GitHub links within docs and CHANGELOG ([#7944](https://github.com/dependency-check/DependencyCheck/pull/7944))
+- chore: fix version typo in security policy ([#7936](https://github.com/dependency-check/DependencyCheck/pull/7936))
+
+See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/99?closed=1)
+
+## [Version 12.1.5](https://github.com/dependency-check/DependencyCheck/releases/tag/v12.1.5) (2025-09-20)
+
+- **fix**: Update to support OSS Index Authentication Requirements ([#7920](https://github.com/dependency-check/DependencyCheck/pull/7920))
+ - Note: OSS Index will require authentication starting 9/22/2025. Users must configure a free account to continue using the OSS Index Analyzer. See https://ossindex.sonatype.org/doc/auth-required.
+- fix: add CVSSv4 to suppressed entries in JSON report ([#7900](https://github.com/dependency-check/DependencyCheck/pull/7900))
+- fix: correctly utilize CVSSv4 from ossindex ([#7899](https://github.com/dependency-check/DependencyCheck/pull/7899))
+- fix: npe when processing cve with empty configuration ([#7888](https://github.com/dependency-check/DependencyCheck/pull/7888))
+- fix: Return unsorted vulnerabilities in new HashSet, avoiding CoMod ([#7848](https://github.com/dependency-check/DependencyCheck/pull/7848))
+- fix: Return unsorted vulnerabilities in new HashSet, avoiding CoMod
+- fix: class loading problem with fat jars ([#7786](https://github.com/dependency-check/DependencyCheck/pull/7786)) ([#7787](https://github.com/dependency-check/DependencyCheck/pull/7787))
+- fix: Improve Artifactory handler log message ([#7838](https://github.com/dependency-check/DependencyCheck/pull/7838))
+- fix: classloading problem with fat jars ([#7786](https://github.com/dependency-check/DependencyCheck/pull/7786))
+- fix: Add null checking when parsing the license json in AbstractNpmAnalyzer. ([#7784](https://github.com/dependency-check/DependencyCheck/pull/7784))
+- fix(fp): resolves several false positives related to CVE-2021-41033 ([#7736](https://github.com/dependency-check/DependencyCheck/pull/7736))
+- docs: Clarify format of exclude patterns ([#7879](https://github.com/dependency-check/DependencyCheck/pull/7879))
+- docs: Document poetry-based analysis behaviour in Python analyzer ([#7855](https://github.com/dependency-check/DependencyCheck/pull/7855))
+- docs: request FP reporters use the latest version of ODC. ([#7820](https://github.com/dependency-check/DependencyCheck/pull/7820))
+- docs: update development pre-reqs ([#7792](https://github.com/dependency-check/DependencyCheck/pull/7792))
+- docs: fix minor typos in false positive issue template ([#7763](https://github.com/dependency-check/DependencyCheck/pull/7763))
+
+See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/98?closed=1)
+
+## [Version 12.1.3](https://github.com/dependency-check/DependencyCheck/releases/tag/v12.1.3) (2025-06-10)
+
+- fix: correct regex matches introduced in 12.1.2 ([#7726](https://github.com/dependency-check/DependencyCheck/pull/7726))
+- build(deps): bump org.semver4j:semver4j from 5.7.0 to 5.7.1 ([#7718](https://github.com/dependency-check/DependencyCheck/pull/7718))
+- build(deps): bump junit.version from 5.13.0 to 5.13.1 ([#7719](https://github.com/dependency-check/DependencyCheck/pull/7719))
+
+See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/97?closed=1)
+
+## [Version 12.1.2](https://github.com/dependency-check/DependencyCheck/releases/tag/v12.1.2) (2025-06-07)
+
+- fix: Allow configuring OSS Index user/pw directly ([#7640](https://github.com/dependency-check/DependencyCheck/pull/7640))
+- fix: remove vulnerable transitive dependency - beanutils ([#7705](https://github.com/dependency-check/DependencyCheck/pull/7705))
+- fix: Simplify PHP framework suppression for Composer ([#7693](https://github.com/dependency-check/DependencyCheck/pull/7693))
+- fix: update CPE pattern to remove FP ([#7684](https://github.com/dependency-check/DependencyCheck/pull/7684))
+- fix(cli): Patch generated Windows shell script for JAVACMD installs with spaces ([#7653](https://github.com/dependency-check/DependencyCheck/pull/7653))
+- fix: Resolve various WCAG accessibility / css issues in the HTML report ([#7629](https://github.com/dependency-check/DependencyCheck/pull/7629))
+- fix: [#7510](https://github.com/dependency-check/DependencyCheck/pull/7510) Display a dedicated message when receiving an HTTP 403 ([#7575](https://github.com/dependency-check/DependencyCheck/pull/7575))
+- docs: Make `Vulnerability Sources` in `Related Work` clearer ([#7691](https://github.com/dependency-check/DependencyCheck/pull/7691))
+- docs: [#7610](https://github.com/dependency-check/DependencyCheck/pull/7610) add a reference to NVD mirroring in getting started documentation ([#7611](https://github.com/dependency-check/DependencyCheck/pull/7611))
+
+See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/96?closed=1)
+
## [Version 12.1.1](https://github.com/dependency-check/DependencyCheck/releases/tag/v12.1.1) (2025-04-05)
- fix: resolve NVD data Parse error `com.fasterxml.jackson.core.JsonParseException: Unexpected character (']' (code 93))`
- - bump open-vulnerability-client from 7.3.1 to 7.3.2 (#7577)
-- fix: update links for repository move from `jeremylong` to the `dependency-check` organization (#7373)
-- fix: resolve NPE when processing CVE-2025-2682 (#7558)
-- fix: prevent rogue base suppression files (#7544)
-- fix: #6819 handle invalid toml file (#7548)
-- fix: Use unscored severity only in absence of any CVSS baseScore (#7530)
-- fix: protect against exotic version number of yarn (#7525)
-- fix: Ignore require-bundle MANIFEST.MF entry for evidence (#7523)
-- fix: avoid error on yarn berry audit when no vulnerability found (#7501)
-- fix: improve null checks in Downloader (#7493)
+ - bump open-vulnerability-client from 7.3.1 to 7.3.2 ([#7577](https://github.com/dependency-check/DependencyCheck/pull/7577))
+- fix: update links for repository move from `jeremylong` to the `dependency-check` organization ([#7373](https://github.com/dependency-check/DependencyCheck/pull/7373))
+- fix: resolve NPE when processing CVE-2025-2682 ([#7558](https://github.com/dependency-check/DependencyCheck/pull/7558))
+- fix: prevent rogue base suppression files ([#7544](https://github.com/dependency-check/DependencyCheck/pull/7544))
+- fix: [#6819](https://github.com/dependency-check/DependencyCheck/pull/6819) handle invalid toml file ([#7548](https://github.com/dependency-check/DependencyCheck/pull/7548))
+- fix: Use unscored severity only in absence of any CVSS baseScore ([#7530](https://github.com/dependency-check/DependencyCheck/pull/7530))
+- fix: protect against exotic version number of yarn ([#7525](https://github.com/dependency-check/DependencyCheck/pull/7525))
+- fix: Ignore require-bundle MANIFEST.MF entry for evidence ([#7523](https://github.com/dependency-check/DependencyCheck/pull/7523))
+- fix: avoid error on yarn berry audit when no vulnerability found ([#7501](https://github.com/dependency-check/DependencyCheck/pull/7501))
+- fix: improve null checks in Downloader ([#7493](https://github.com/dependency-check/DependencyCheck/pull/7493))
- fix: improve null checks resolves https://github.com/dependency-check/dependency-check-gradle/issues/441
-- fix: Avoid FPs when Composer product name has php (#7486)
-- fix: cli not honoring window paths correctly (#7470)
-- fix: Also apply muteNoisyLoggers to UpdateMojo (#7469)
-- fix: Make HC5 Downloader honor the connection- and readTimeout settings that the old URLConnectionFactory based downloads observed (#7437)
-- docs: sync the supported Maven version with the one stated in the system requirement section (#7570)
-- docs: update proxy config documentation (#7550)
+- fix: Avoid FPs when Composer product name has php ([#7486](https://github.com/dependency-check/DependencyCheck/pull/7486))
+- fix: cli not honoring window paths correctly ([#7470](https://github.com/dependency-check/DependencyCheck/pull/7470))
+- fix: Also apply muteNoisyLoggers to UpdateMojo ([#7469](https://github.com/dependency-check/DependencyCheck/pull/7469))
+- fix: Make HC5 Downloader honor the connection- and readTimeout settings that the old URLConnectionFactory based downloads observed ([#7437](https://github.com/dependency-check/DependencyCheck/pull/7437))
+- docs: sync the supported Maven version with the one stated in the system requirement section ([#7570](https://github.com/dependency-check/DependencyCheck/pull/7570))
+- docs: update proxy config documentation ([#7550](https://github.com/dependency-check/DependencyCheck/pull/7550))
- docs: Remove copyright as requested by the Apache foundation
-- docs: drop redundant text in the Internet Access Required section (#7521)
-- docs: correct gradle documentation (#7511)
+- docs: drop redundant text in the Internet Access Required section ([#7521](https://github.com/dependency-check/DependencyCheck/pull/7521))
+- docs: correct gradle documentation ([#7511](https://github.com/dependency-check/DependencyCheck/pull/7511))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/95?closed=1)
## [Version 12.1.0](https://github.com/dependency-check/DependencyCheck/releases/tag/v12.1.0) (2025-02-16)
-- build(deps): bump open-vulnerability-client to 7.2.2 (#7407)
- - resolves issue with downloading data from the NVD (#7406)
-- fix: Improve thread safety issue #7338 alternative (#7367)
-- feat: Implement Yarn Berry Analyser (#7319)
+- build(deps): bump open-vulnerability-client to 7.2.2 ([#7407](https://github.com/dependency-check/DependencyCheck/pull/7407))
+ - resolves issue with downloading data from the NVD ([#7406](https://github.com/dependency-check/DependencyCheck/pull/7406))
+- fix: Improve thread safety issue [#7338](https://github.com/dependency-check/DependencyCheck/pull/7338) alternative ([#7367](https://github.com/dependency-check/DependencyCheck/pull/7367))
+- feat: Implement Yarn Berry Analyser ([#7319](https://github.com/dependency-check/DependencyCheck/pull/7319))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/94?closed=1)
## [Version 12.0.2](https://github.com/dependency-check/DependencyCheck/releases/tag/v12.0.2) (2025-01-29)
-- fix: correct JSON report error (#7350)
-- fix: some compatability issues in the gitlab report (#7349)
-- fix: ArtifactoryAnalyzer updated to use the HTTPClient5-based Downloader and skip unusable results (#7293)
-- chore: allow messages via EngineVersionCheck (#7353)
-- chore: switch from javax.json to jakarta.json (#7326)
+- fix: correct JSON report error ([#7350](https://github.com/dependency-check/DependencyCheck/pull/7350))
+- fix: some compatability issues in the gitlab report ([#7349](https://github.com/dependency-check/DependencyCheck/pull/7349))
+- fix: ArtifactoryAnalyzer updated to use the HTTPClient5-based Downloader and skip unusable results ([#7293](https://github.com/dependency-check/DependencyCheck/pull/7293))
+- chore: allow messages via EngineVersionCheck ([#7353](https://github.com/dependency-check/DependencyCheck/pull/7353))
+- chore: switch from javax.json to jakarta.json ([#7326](https://github.com/dependency-check/DependencyCheck/pull/7326))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/93?closed=1).
## [Version 12.0.1](https://github.com/dependency-check/DependencyCheck/releases/tag/v12.0.1) (2025-01-19)
-- docs: Fix OSS Index Maven config documentation (#7322)
+- docs: Fix OSS Index Maven config documentation ([#7322](https://github.com/dependency-check/DependencyCheck/pull/7322))
- Fix OSS Index Maven config documentation
-- chore(docs): Document Gradle plugin support for failBuildOnUnusedSuppressionRule (#7307)
-- chore(docs): Correct analyzers config example to use Gradle dot-syntax (#7305)
-- fix: improve error message on improperly configured serverId credentials in settings.xml (#7313)
+- chore(docs): Document Gradle plugin support for failBuildOnUnusedSuppressionRule ([#7307](https://github.com/dependency-check/DependencyCheck/pull/7307))
+- chore(docs): Correct analyzers config example to use Gradle dot-syntax ([#7305](https://github.com/dependency-check/DependencyCheck/pull/7305))
+- fix: improve error message on improperly configured serverId credentials in settings.xml ([#7313](https://github.com/dependency-check/DependencyCheck/pull/7313))
- fix: Lower Basic serverId when Bearer was expected to a warning
- fix: improve error message on improperly configured serverId credentials
-- fix: Correct nonProxyHosts support when no sys properties set (#7306)
+- fix: Correct nonProxyHosts support when no sys properties set ([#7306](https://github.com/dependency-check/DependencyCheck/pull/7306))
- core(docs): Group failBuildOnUnusedSuppressionRule flag next to suppression file configuration
- core(docs): Update Gradle plugin documentation for failBuildOnUnusedSuppressionRule support
- fix: Correct nonProxyHosts support when no sys properties set
@@ -64,100 +144,100 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
## [Version 12.0.0](https://github.com/dependency-check/DependencyCheck/releases/tag/v12.0.0) (2025-01-11)
-- BREAKING CHANGE: report on CVSS v4 (#7204)
+- BREAKING CHANGE: report on CVSS v4 ([#7204](https://github.com/dependency-check/DependencyCheck/pull/7204))
- the schema has been updated to include CVSS v4 for JSON and XML reports
-- feat: show from which dependency the CVE comes in failure report (#7224)
-- feat: Use Maven settings decryption API for decrypting secrets from settings.xml (#7284)
-- feat: Extend authentication to support Bearer token for many resources (#7277)
-- feat: Add a flag to fail when one or more suppression rules are not used (#7244)
-- fix: add product evidence as vendor to reduce FN (#7295)
-- fix: Make the HTTP-Client use pre-emptive authentication (#7255)
+- feat: show from which dependency the CVE comes in failure report ([#7224](https://github.com/dependency-check/DependencyCheck/pull/7224))
+- feat: Use Maven settings decryption API for decrypting secrets from settings.xml ([#7284](https://github.com/dependency-check/DependencyCheck/pull/7284))
+- feat: Extend authentication to support Bearer token for many resources ([#7277](https://github.com/dependency-check/DependencyCheck/pull/7277))
+- feat: Add a flag to fail when one or more suppression rules are not used ([#7244](https://github.com/dependency-check/DependencyCheck/pull/7244))
+- fix: add product evidence as vendor to reduce FN ([#7295](https://github.com/dependency-check/DependencyCheck/pull/7295))
+- fix: Make the HTTP-Client use pre-emptive authentication ([#7255](https://github.com/dependency-check/DependencyCheck/pull/7255))
- fix: Add the missing proxy credentials for suppressionFileUser/Password authentication scenario
-- fix: increase max retry count (#7252)
+- fix: increase max retry count ([#7252](https://github.com/dependency-check/DependencyCheck/pull/7252))
- fix: Make the HTTP-Client use pre-emptive authentication for configured server credentials and extend HTTPClient usage to Nexus search
-- fix: Tranform into UTC the last modified date from database (#7222)
+- fix: Tranform into UTC the last modified date from database ([#7222](https://github.com/dependency-check/DependencyCheck/pull/7222))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/91?closed=1).
## [Version 11.1.1](https://github.com/dependency-check/DependencyCheck/releases/tag/v11.1.1) (2024-12-04)
-- fix: re-enable issue locking (#7220)
-- fix: add username/password properties to be able to authenticate for central.content.url and analyzer.central.url again (#7169)
-- fix: rework replaceOrAddVulnerability (#7177)
-- fix: do not log loading of JDBC driver (#7155)
-- fix: expose flag to disable version check (#7147)
-- fix: Gracefully handle CVEs with bad configuration nodes missing CPE match expressions (#7125)
-- chore: cleanup base suppression (#7138)
-- docs: update gradle configuration documentation (#7176)
-- docs: update documentation for Gradle plugin (#7143)
-- docs: improve false positive issue templat (#7130)
+- fix: re-enable issue locking ([#7220](https://github.com/dependency-check/DependencyCheck/pull/7220))
+- fix: add username/password properties to be able to authenticate for central.content.url and analyzer.central.url again ([#7169](https://github.com/dependency-check/DependencyCheck/pull/7169))
+- fix: rework replaceOrAddVulnerability ([#7177](https://github.com/dependency-check/DependencyCheck/pull/7177))
+- fix: do not log loading of JDBC driver ([#7155](https://github.com/dependency-check/DependencyCheck/pull/7155))
+- fix: expose flag to disable version check ([#7147](https://github.com/dependency-check/DependencyCheck/pull/7147))
+- fix: Gracefully handle CVEs with bad configuration nodes missing CPE match expressions ([#7125](https://github.com/dependency-check/DependencyCheck/pull/7125))
+- chore: cleanup base suppression ([#7138](https://github.com/dependency-check/DependencyCheck/pull/7138))
+- docs: update gradle configuration documentation ([#7176](https://github.com/dependency-check/DependencyCheck/pull/7176))
+- docs: update documentation for Gradle plugin ([#7143](https://github.com/dependency-check/DependencyCheck/pull/7143))
+- docs: improve false positive issue templat ([#7130](https://github.com/dependency-check/DependencyCheck/pull/7130))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/90?closed=1).
## [Version 11.1.0](https://github.com/dependency-check/DependencyCheck/releases/tag/v11.1.0) (2024-10-30)
-- feat: PHP Composer Analyzer now scans packages-dev by default (#7114)
+- feat: PHP Composer Analyzer now scans packages-dev by default ([#7114](https://github.com/dependency-check/DependencyCheck/pull/7114))
- Users can configure if packages-dev should be skipped
-- fix(regression): re-add h2 database driver name (#7115)
-- fix(regression): Make the Downloader honour the proxy.nonproxyhosts ODC Setting (#7077)
-- fix: do not set legacy proxy from maven or env (#7072) (#7074)
-- docs: add missing documentation for the MS Build Analyzer (#7113)
-- docs: Document the breaking change for Maven plugin as reporting plugin (#7079)
+- fix(regression): re-add h2 database driver name ([#7115](https://github.com/dependency-check/DependencyCheck/pull/7115))
+- fix(regression): Make the Downloader honour the proxy.nonproxyhosts ODC Setting ([#7077](https://github.com/dependency-check/DependencyCheck/pull/7077))
+- fix: do not set legacy proxy from maven or env ([#7072](https://github.com/dependency-check/DependencyCheck/pull/7072)) ([#7074](https://github.com/dependency-check/DependencyCheck/pull/7074))
+- docs: add missing documentation for the MS Build Analyzer ([#7113](https://github.com/dependency-check/DependencyCheck/pull/7113))
+- docs: Document the breaking change for Maven plugin as reporting plugin ([#7079](https://github.com/dependency-check/DependencyCheck/pull/7079))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/89?closed=1).
## [Version 11.0.0](https://github.com/dependency-check/DependencyCheck/releases/tag/v11.0.0) (2024-10-21)
-- **breaking change**: Switch from JMockit to Mockito & build target to Java 11 (#6922)
+- **breaking change**: Switch from JMockit to Mockito & build target to Java 11 ([#6922](https://github.com/dependency-check/DependencyCheck/pull/6922))
- dependency-check now requires a minimum of Java 11.0 to run
-- **breaking change**: bump com.h2database:h2 from 2.1.214 to 2.3.232 (#6132)
+- **breaking change**: bump com.h2database:h2 from 2.1.214 to 2.3.232 ([#6132](https://github.com/dependency-check/DependencyCheck/pull/6132))
- H2 databases generated with an older version of ODC will not work with ODC 11.0.0; a new H2 db must be generated
- **breaking change**: Maven plugin updated to Doxia 2.x reporting stack
- - Users of the Maven plugin that configure it as a reporting plugin will need to use maven-site-plugin 3.20.0 or later (#6959)
+ - Users of the Maven plugin that configure it as a reporting plugin will need to use maven-site-plugin 3.20.0 or later ([#6959](https://github.com/dependency-check/DependencyCheck/pull/6959))
- feat: Replace old Downloader by an Apache HTTPClient based downloader
-- feat: Use Apache HTTPClient for downloads of public resources (#6949)
+- feat: Use Apache HTTPClient for downloads of public resources ([#6949](https://github.com/dependency-check/DependencyCheck/pull/6949))
- feat: Also make NodeAuditSearch usr our HTTPClient based connections
- feat: Also make OSSIndexAnalyzer use our HTTPClient based connections
- feat: Migrate CentralSearch to use Apache HTTP-client via Downloader
- feat: Extend apache HTTP-client usage to EngineVersionCheck
-- feat: Remove the need to specify dbDriver for external databases using JDBCv4 ServiceLoader supporting JDBC drivers (#6938)
-- fix: use latest generated suppressions (#7064)
-- fix: Fixup parameter sequence for Dowloader credentials (#7033)
+- feat: Remove the need to specify dbDriver for external databases using JDBCv4 ServiceLoader supporting JDBC drivers ([#6938](https://github.com/dependency-check/DependencyCheck/pull/6938))
+- fix: use latest generated suppressions ([#7064](https://github.com/dependency-check/DependencyCheck/pull/7064))
+- fix: Fixup parameter sequence for Dowloader credentials ([#7033](https://github.com/dependency-check/DependencyCheck/pull/7033))
- fix: Fixup the missing addition of NVD API Datafeed credentials (if configured)
- fix: Fixup broken proxy authentication in first attempt; extend to include KEV downloads
-- fix: store timestamps locally for local resources (#6936)
-- build: Remove the animal-sniffer, propagate java version to plugin-archetype (#6950)
-- build: Update Checkstyle configuration and Suppression DTD references (#6951)
-- chore: Update test db schema (#7036)
+- fix: store timestamps locally for local resources ([#6936](https://github.com/dependency-check/DependencyCheck/pull/6936))
+- build: Remove the animal-sniffer, propagate java version to plugin-archetype ([#6950](https://github.com/dependency-check/DependencyCheck/pull/6950))
+- build: Update Checkstyle configuration and Suppression DTD references ([#6951](https://github.com/dependency-check/DependencyCheck/pull/6951))
+- chore: Update test db schema ([#7036](https://github.com/dependency-check/DependencyCheck/pull/7036))
- chore: remove old, unneeded database upgrade script
-- docs: reformat javadoc (#7009)
-- docs: Fixup javadoc warnings (#6995)
-- chore: Replace use of several deprecated methods/classes by their successors (#6933)
+- docs: reformat javadoc ([#7009](https://github.com/dependency-check/DependencyCheck/pull/7009))
+- docs: Fixup javadoc warnings ([#6995](https://github.com/dependency-check/DependencyCheck/pull/6995))
+- chore: Replace use of several deprecated methods/classes by their successors ([#6933](https://github.com/dependency-check/DependencyCheck/pull/6933))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/87?closed=1).
## [Version 10.0.4](https://github.com/dependency-check/DependencyCheck/releases/tag/v10.0.4) (2024-09-01)
- - build(deps): exclude unused dependency (#6916)
- - fix: improve regex (#6917)
- - fix: correctly handle null values in cpeMatch (#6915)
- - fix(site): Update Fluido skin to resolve broken fork-me-on-github image (#6914)
- - fix: do not report over 100% download complete (#6899)
- - fix: Correct spelling of occurring in NvdApiDataSource.java (#6883)
- - fix: skip blank lines in requirements.txt (#6867)
- - fix: correct percentage calculation (#6868)
- - docs: remove old recommendation (#6860)
+ - build(deps): exclude unused dependency ([#6916](https://github.com/dependency-check/DependencyCheck/pull/6916))
+ - fix: improve regex ([#6917](https://github.com/dependency-check/DependencyCheck/pull/6917))
+ - fix: correctly handle null values in cpeMatch ([#6915](https://github.com/dependency-check/DependencyCheck/pull/6915))
+ - fix(site): Update Fluido skin to resolve broken fork-me-on-github image ([#6914](https://github.com/dependency-check/DependencyCheck/pull/6914))
+ - fix: do not report over 100% download complete ([#6899](https://github.com/dependency-check/DependencyCheck/pull/6899))
+ - fix: Correct spelling of occurring in NvdApiDataSource.java ([#6883](https://github.com/dependency-check/DependencyCheck/pull/6883))
+ - fix: skip blank lines in requirements.txt ([#6867](https://github.com/dependency-check/DependencyCheck/pull/6867))
+ - fix: correct percentage calculation ([#6868](https://github.com/dependency-check/DependencyCheck/pull/6868))
+ - docs: remove old recommendation ([#6860](https://github.com/dependency-check/DependencyCheck/pull/6860))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/88?closed=1).
## [Version 10.0.3](https://github.com/dependency-check/DependencyCheck/releases/tag/v10.0.3) (2024-07-16)
-- feat: Enable configuration of a lower resultsPerPage on NVD API (#6843)
-- build(deps): bump open-vulnerability-clients from 6.1.6 to 6.1.7 (#6848)
-- build(deps): bump JamesIves/github-pages-deploy-action from 4.6.1 to 4.6.3 (#6814)
-- build(deps): bump org.codehaus.mojo:versions-maven-plugin from 2.16.2 to 2.17.0 (#6762)
-- build(deps): bump org.apache.maven.plugins:maven-checkstyle-plugin from 3.3.1 to 3.4.0 (#6815)
-- build(deps): bump golang from 1.22.4-alpine to 1.22.5-alpine (#6805)
+- feat: Enable configuration of a lower resultsPerPage on NVD API ([#6843](https://github.com/dependency-check/DependencyCheck/pull/6843))
+- build(deps): bump open-vulnerability-clients from 6.1.6 to 6.1.7 ([#6848](https://github.com/dependency-check/DependencyCheck/pull/6848))
+- build(deps): bump JamesIves/github-pages-deploy-action from 4.6.1 to 4.6.3 ([#6814](https://github.com/dependency-check/DependencyCheck/pull/6814))
+- build(deps): bump org.codehaus.mojo:versions-maven-plugin from 2.16.2 to 2.17.0 ([#6762](https://github.com/dependency-check/DependencyCheck/pull/6762))
+- build(deps): bump org.apache.maven.plugins:maven-checkstyle-plugin from 3.3.1 to 3.4.0 ([#6815](https://github.com/dependency-check/DependencyCheck/pull/6815))
+- build(deps): bump golang from 1.22.4-alpine to 1.22.5-alpine ([#6805](https://github.com/dependency-check/DependencyCheck/pull/6805))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/84?closed=1).
@@ -165,164 +245,164 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
**Mandatory Upgrade** - due to older versions of dependency-check causing numerous, spurious requests that end in processing failures, this upgrade is mandatory so that the NVD can differentiate valid requests and block the old clients.
-- build(deps): bump open-vulnerability-clients (#6810)
-- fix(db): #6788 removing redundant db index "idxVulnerability" on "vulnerability.cve" (#6807)
-- docs: Further improve formatting and docs of H2 database caching strats (#6804)
-- fix: update_vulnerability in dbStatements_oracle.properties (#6803)
-- fix: fix NPE (#6778)
-- fix: add hint to resolve false negative (#6802)
-- chore: update configure (#6794)
+- build(deps): bump open-vulnerability-clients ([#6810](https://github.com/dependency-check/DependencyCheck/pull/6810))
+- fix(db): [#6788](https://github.com/dependency-check/DependencyCheck/pull/6788) removing redundant db index "idxVulnerability" on "vulnerability.cve" ([#6807](https://github.com/dependency-check/DependencyCheck/pull/6807))
+- docs: Further improve formatting and docs of H2 database caching strats ([#6804](https://github.com/dependency-check/DependencyCheck/pull/6804))
+- fix: update_vulnerability in dbStatements_oracle.properties ([#6803](https://github.com/dependency-check/DependencyCheck/pull/6803))
+- fix: fix NPE ([#6778](https://github.com/dependency-check/DependencyCheck/pull/6778))
+- fix: add hint to resolve false negative ([#6802](https://github.com/dependency-check/DependencyCheck/pull/6802))
+- chore: update configure ([#6794](https://github.com/dependency-check/DependencyCheck/pull/6794))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/86?closed=1).
## [Version 10.0.1](https://github.com/dependency-check/DependencyCheck/releases/tag/v10.0.1) (2024-07-02)
-- build(deps): bump open-vulnerability-client (#6772)
-- fix: remove debug logging (#6770)
-- fix: postgresql column count error (#6773)
-- fix: mssql column name and version (#6761)
-- docs: update supported versions (#6771)
+- build(deps): bump open-vulnerability-client ([#6772](https://github.com/dependency-check/DependencyCheck/pull/6772))
+- fix: remove debug logging ([#6770](https://github.com/dependency-check/DependencyCheck/pull/6770))
+- fix: postgresql column count error ([#6773](https://github.com/dependency-check/DependencyCheck/pull/6773))
+- fix: mssql column name and version ([#6761](https://github.com/dependency-check/DependencyCheck/pull/6761))
+- docs: update supported versions ([#6771](https://github.com/dependency-check/DependencyCheck/pull/6771))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/85?closed=1).
## [Version 10.0.0](https://github.com/dependency-check/DependencyCheck/releases/tag/v10.0.0) (2024-07-01)
-- **breaking change**: upgrade to dotnet 8.0 (#6580)
+- **breaking change**: upgrade to dotnet 8.0 ([#6580](https://github.com/dependency-check/DependencyCheck/pull/6580))
- Users of the AssemblyAnalyzer must upgrade/utilize dotnet 8 to analyze assemblies
-- feat: fix the NVD API related errors by adding cvssV4 support (#6756)
+- feat: fix the NVD API related errors by adding cvssV4 support ([#6756](https://github.com/dependency-check/DependencyCheck/pull/6756))
- **breaking changes**: anyone utilizing a centralized database will need to upgrade the schema; see changes in [PR #6756](https://github.com/dependency-check/DependencyCheck/pull/6756/files#diff-ca432c4b41d39caa84d140e06694b09c7e6394c8a2db72ba27516dc77ee3bd67)
-- fix: avoid escaping unnecessary chars in HTML report suppression regexes (#6749)
-- fix: #6688 Trim version number when parsin POM (#6705)
-- fix: change request if lockfile is file v3 (#6690)
-- fix: skip pyproject.toml unless it contains `tool.poetry` before ensuring lockfiles (#6681)
+- fix: avoid escaping unnecessary chars in HTML report suppression regexes ([#6749](https://github.com/dependency-check/DependencyCheck/pull/6749))
+- fix: [#6688](https://github.com/dependency-check/DependencyCheck/pull/6688) Trim version number when parsing POM ([#6705](https://github.com/dependency-check/DependencyCheck/pull/6705))
+- fix: change request if lockfile is file v3 ([#6690](https://github.com/dependency-check/DependencyCheck/pull/6690))
+- fix: skip pyproject.toml unless it contains `tool.poetry` before ensuring lockfiles ([#6681](https://github.com/dependency-check/DependencyCheck/pull/6681))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/83?closed=1).
## [Version 9.2.0](https://github.com/dependency-check/DependencyCheck/releases/tag/v9.2.0) (2024-05-15)
- - docs: update logo per intellj (#6660)
- - feat: Carthage analyzer (#6614)
- - fix: Ensure valid JSON output for gitlab report (#6630)
- - feat: Support Package.swift version 3 Specification (#6578)
- - chore: Update the packaged suppressions to include new hosted suppressions (#6567)
+ - docs: update logo per intellj ([#6660](https://github.com/dependency-check/DependencyCheck/pull/6660))
+ - feat: Carthage analyzer ([#6614](https://github.com/dependency-check/DependencyCheck/pull/6614))
+ - fix: Ensure valid JSON output for gitlab report ([#6630](https://github.com/dependency-check/DependencyCheck/pull/6630))
+ - feat: Support Package.swift version 3 Specification ([#6578](https://github.com/dependency-check/DependencyCheck/pull/6578))
+ - chore: Update the packaged suppressions to include new hosted suppressions ([#6567](https://github.com/dependency-check/DependencyCheck/pull/6567))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/82?closed=1).
## [Version 9.1.0](https://github.com/dependency-check/DependencyCheck/releases/tag/v9.1.0) (2024-03-31)
-- feat: Add v2 support for maven_install.json (#6528)
-- build(deps): bump open-vulnerability-client (#6554)
+- feat: Add v2 support for maven_install.json ([#6528](https://github.com/dependency-check/DependencyCheck/pull/6528))
+- build(deps): bump open-vulnerability-client ([#6554](https://github.com/dependency-check/DependencyCheck/pull/6554))
- resolves update issues due to CVSS Metrics 4.0
-- build(deps): bump jackson.version from 2.16.0 to 2.16.1 (#6353)
-- build(deps): bump org.jsoup:jsoup from 1.16.2 to 1.17.2 (#6362)
-- build(deps): bump golang from 1.21.5-alpine to 1.22.1-alpine (#6506)
+- build(deps): bump jackson.version from 2.16.0 to 2.16.1 ([#6353](https://github.com/dependency-check/DependencyCheck/pull/6353))
+- build(deps): bump org.jsoup:jsoup from 1.16.2 to 1.17.2 ([#6362](https://github.com/dependency-check/DependencyCheck/pull/6362))
+- build(deps): bump golang from 1.21.5-alpine to 1.22.1-alpine ([#6506](https://github.com/dependency-check/DependencyCheck/pull/6506))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/81?closed=1).
## [Version 9.0.10](https://github.com/dependency-check/DependencyCheck/releases/tag/v9.0.10) (2024-03-15)
-- fix: #4321 Suppress redis server CVEs for client libraries (#4321) (#6489)
-- fix: bump commons-compress from 1.25.0 to 1.26.0 to fix CVE-2024-25710 and CVE-2024-26308 (#6492)
-- feat: Allow to pass NVD API key via environment variable (#6454)
-- fix: issue 5452 - ConcurrentModificationException in NodePackageAnalyzer.processDependencies - adding synchronized block (#6501)
-- docs: document the default data directory (#6484)
-- fix: prevent NPE in bundler audit (#6462)
-- fix: #6441 Improve suppression rule to not restrict to a single version (#6442)
+- fix: [#4321](https://github.com/dependency-check/DependencyCheck/pull/4321) Suppress redis server CVEs for client libraries ([#4321](https://github.com/dependency-check/DependencyCheck/pull/4321)) ([#6489](https://github.com/dependency-check/DependencyCheck/pull/6489))
+- fix: bump commons-compress from 1.25.0 to 1.26.0 to fix CVE-2024-25710 and CVE-2024-26308 ([#6492](https://github.com/dependency-check/DependencyCheck/pull/6492))
+- feat: Allow to pass NVD API key via environment variable ([#6454](https://github.com/dependency-check/DependencyCheck/pull/6454))
+- fix: issue 5452 - ConcurrentModificationException in NodePackageAnalyzer.processDependencies - adding synchronized block ([#6501](https://github.com/dependency-check/DependencyCheck/pull/6501))
+- docs: document the default data directory ([#6484](https://github.com/dependency-check/DependencyCheck/pull/6484))
+- fix: prevent NPE in bundler audit ([#6462](https://github.com/dependency-check/DependencyCheck/pull/6462))
+- fix: [#6441](https://github.com/dependency-check/DependencyCheck/pull/6441) Improve suppression rule to not restrict to a single version ([#6442](https://github.com/dependency-check/DependencyCheck/pull/6442))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/80?closed=1).
## [Version 9.0.9](https://github.com/dependency-check/DependencyCheck/releases/tag/v9.0.9) (2024-01-17)
-- fix: for #6374 to delete non-empty directories (#6375)
-- fix: NoSuchMethodError closeQuietly(java.io.Closeable[]) (#6377)
-- chore: close stream to prevent possible resource leak (#6382)
-- docs: Document default for CLI --data (#6359)
-- docs: document gradle build (#6371)
+- fix: for [#6374](https://github.com/dependency-check/DependencyCheck/pull/6374) to delete non-empty directories ([#6375](https://github.com/dependency-check/DependencyCheck/pull/6375))
+- fix: NoSuchMethodError closeQuietly(java.io.Closeable[]) ([#6377](https://github.com/dependency-check/DependencyCheck/pull/6377))
+- chore: close stream to prevent possible resource leak ([#6382](https://github.com/dependency-check/DependencyCheck/pull/6382))
+- docs: Document default for CLI --data ([#6359](https://github.com/dependency-check/DependencyCheck/pull/6359))
+- docs: document gradle build ([#6371](https://github.com/dependency-check/DependencyCheck/pull/6371))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/79?closed=1).
## [Version 9.0.8](https://github.com/dependency-check/DependencyCheck/releases/tag/v9.0.8) (2024-01-06)
-- fix: favor stability over performance (#6349)
-- chore: replace commons-io with core java calls (#6343)
-- fix: improve error reporting for invalid H2 database (#6339)
-- fix: rework fix for closing input streams on errors correctly (#6338)
-- fix: reduce chance NVD API block updates due to rate limit (#6333)
-- fix: ensure open handles will not leak on errors (#6326)
-- fix: improve error reporting (#6324)
+- fix: favor stability over performance ([#6349](https://github.com/dependency-check/DependencyCheck/pull/6349))
+- chore: replace commons-io with core java calls ([#6343](https://github.com/dependency-check/DependencyCheck/pull/6343))
+- fix: improve error reporting for invalid H2 database ([#6339](https://github.com/dependency-check/DependencyCheck/pull/6339))
+- fix: rework fix for closing input streams on errors correctly ([#6338](https://github.com/dependency-check/DependencyCheck/pull/6338))
+- fix: reduce chance NVD API block updates due to rate limit ([#6333](https://github.com/dependency-check/DependencyCheck/pull/6333))
+- fix: ensure open handles will not leak on errors ([#6326](https://github.com/dependency-check/DependencyCheck/pull/6326))
+- fix: improve error reporting ([#6324](https://github.com/dependency-check/DependencyCheck/pull/6324))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/78?closed=1).
## [Version 9.0.7](https://github.com/dependency-check/DependencyCheck/releases/tag/v9.0.7) (2023-12-18)
-- docs: document insecure configuration for GHSA-qqhq-8r2c-c3f5 (#6315)
-- fix: improve memory usage on NVD update (#6321)
-- fix: skip pyproject.toml unless it contains `tool.poetry` (#6316)
-- fix: resolve build error that may cause an issue on some JDK versions (#6312)
+- docs: document insecure configuration for GHSA-qqhq-8r2c-c3f5 ([#6315](https://github.com/dependency-check/DependencyCheck/pull/6315))
+- fix: improve memory usage on NVD update ([#6321](https://github.com/dependency-check/DependencyCheck/pull/6321))
+- fix: skip pyproject.toml unless it contains `tool.poetry` ([#6316](https://github.com/dependency-check/DependencyCheck/pull/6316))
+- fix: resolve build error that may cause an issue on some JDK versions ([#6312](https://github.com/dependency-check/DependencyCheck/pull/6312))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/77?closed=1).
## [Version 9.0.6](https://github.com/dependency-check/DependencyCheck/releases/tag/v9.0.6) (2023-12-15)
-- build: bump open-vulnerability-clients@5.1.1 (#6308)
-- fix: mask nvd.api.key in logs; see GHSA-qqhq-8r2c-c3f5 (#6307)
-- fix: update java version check (#6297)
-- fix: more efficient memory usage (#6299)
-- fix: stream NVD data via Jackson to reduce memory footprint (#6275)
-- docs: document github action caching (#6301)
+- build: bump open-vulnerability-clients@5.1.1 ([#6308](https://github.com/dependency-check/DependencyCheck/pull/6308))
+- fix: mask nvd.api.key in logs; see GHSA-qqhq-8r2c-c3f5 ([#6307](https://github.com/dependency-check/DependencyCheck/pull/6307))
+- fix: update java version check ([#6297](https://github.com/dependency-check/DependencyCheck/pull/6297))
+- fix: more efficient memory usage ([#6299](https://github.com/dependency-check/DependencyCheck/pull/6299))
+- fix: stream NVD data via Jackson to reduce memory footprint ([#6275](https://github.com/dependency-check/DependencyCheck/pull/6275))
+- docs: document github action caching ([#6301](https://github.com/dependency-check/DependencyCheck/pull/6301))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/76?closed=1).
## [Version 9.0.5](https://github.com/dependency-check/DependencyCheck/releases/tag/v9.0.5) (2023-12-13)
-- fix: make NVD API endpoint configurable (#6287)
-- fix: synch last modified timestamp for NVD API (#6281)
-- fix: read NVD cache meta files if cache.properties does not exist (#6282)
-- fix: correct property for nonProxyHosts (#6285)
-- fix: reduce apache http logging (#6280)
-- fix: store last modified timestamp for RetireJS and the Hosted Suppression File in db (#6271)
-- build: bump golang in the docker image (#6274)
-- fix: use temporary files to reduce memory usage during the NVD Update (#6270)
-- fix: use BIT for Oracle DB instead of Boolean when calling prepared statements (#6264)
-- fix: showing all reference tags in reports (#6259)
+- fix: make NVD API endpoint configurable ([#6287](https://github.com/dependency-check/DependencyCheck/pull/6287))
+- fix: synch last modified timestamp for NVD API ([#6281](https://github.com/dependency-check/DependencyCheck/pull/6281))
+- fix: read NVD cache meta files if cache.properties does not exist ([#6282](https://github.com/dependency-check/DependencyCheck/pull/6282))
+- fix: correct property for nonProxyHosts ([#6285](https://github.com/dependency-check/DependencyCheck/pull/6285))
+- fix: reduce apache http logging ([#6280](https://github.com/dependency-check/DependencyCheck/pull/6280))
+- fix: store last modified timestamp for RetireJS and the Hosted Suppression File in db ([#6271](https://github.com/dependency-check/DependencyCheck/pull/6271))
+- build: bump golang in the docker image ([#6274](https://github.com/dependency-check/DependencyCheck/pull/6274))
+- fix: use temporary files to reduce memory usage during the NVD Update ([#6270](https://github.com/dependency-check/DependencyCheck/pull/6270))
+- fix: use BIT for Oracle DB instead of Boolean when calling prepared statements ([#6264](https://github.com/dependency-check/DependencyCheck/pull/6264))
+- fix: showing all reference tags in reports ([#6259](https://github.com/dependency-check/DependencyCheck/pull/6259))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/75?closed=1).
## [Version 9.0.4](https://github.com/dependency-check/DependencyCheck/releases/tag/v9.0.4) (2023-12-08)
-- fix: utilize maven proxy if present (#6255)
-- fix: allow api key in cli to be quoted (#6253)
-- fix: use correct maven plugin reporting plugin (#6244)
-- fix: correct trailing comma in JSON report (#6245)
+- fix: utilize maven proxy if present ([#6255](https://github.com/dependency-check/DependencyCheck/pull/6255))
+- fix: allow api key in cli to be quoted ([#6253](https://github.com/dependency-check/DependencyCheck/pull/6253))
+- fix: use correct maven plugin reporting plugin ([#6244](https://github.com/dependency-check/DependencyCheck/pull/6244))
+- fix: correct trailing comma in JSON report ([#6245](https://github.com/dependency-check/DependencyCheck/pull/6245))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/74?closed=1).
## [Version 9.0.3](https://github.com/dependency-check/DependencyCheck/releases/tag/v9.0.3) (2023-12-06)
-- fix: use Java properties for proxy configuration (#6238)
-- docs: update proxy configuration documentation (#6237)
-- docs: add documentation on caching (#6204)
-- docs: Clarify H2 database caching strategy (#6220)
-- docs: Update list of supported report formats (#6224)
-- docs: example 5 with new nvdDatafeedUrl parameter (#6215)
-- fix: prevent NPEs (#6232 and #6206)
-- fix: check valid for hours for NVD API (#6225)
-- fix: correct NVD cache last checked logic (#6218)
-- fix: nvd datafeed should process current year (#6213)
-- fix: correct references to cvssv2 and cvssv3 fields in json and xml reports (#6212)
-- fix: correct name on reference links in report (#6205)
-- fix: flaws int the gitlab report (#6193)
+- fix: use Java properties for proxy configuration ([#6238](https://github.com/dependency-check/DependencyCheck/pull/6238))
+- docs: update proxy configuration documentation ([#6237](https://github.com/dependency-check/DependencyCheck/pull/6237))
+- docs: add documentation on caching ([#6204](https://github.com/dependency-check/DependencyCheck/pull/6204))
+- docs: Clarify H2 database caching strategy ([#6220](https://github.com/dependency-check/DependencyCheck/pull/6220))
+- docs: Update list of supported report formats ([#6224](https://github.com/dependency-check/DependencyCheck/pull/6224))
+- docs: example 5 with new nvdDatafeedUrl parameter ([#6215](https://github.com/dependency-check/DependencyCheck/pull/6215))
+- fix: prevent NPEs ([#6232](https://github.com/dependency-check/DependencyCheck/pull/6232) and [#6206](https://github.com/dependency-check/DependencyCheck/pull/6206))
+- fix: check valid for hours for NVD API ([#6225](https://github.com/dependency-check/DependencyCheck/pull/6225))
+- fix: correct NVD cache last checked logic ([#6218](https://github.com/dependency-check/DependencyCheck/pull/6218))
+- fix: nvd datafeed should process current year ([#6213](https://github.com/dependency-check/DependencyCheck/pull/6213))
+- fix: correct references to cvssv2 and cvssv3 fields in json and xml reports ([#6212](https://github.com/dependency-check/DependencyCheck/pull/6212))
+- fix: correct name on reference links in report ([#6205](https://github.com/dependency-check/DependencyCheck/pull/6205))
+- fix: flaws int the gitlab report ([#6193](https://github.com/dependency-check/DependencyCheck/pull/6193))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/73?closed=1).
## [Version 9.0.2](https://github.com/dependency-check/DependencyCheck/releases/tag/v9.0.2) (2023-12-01)
-- fix: remove virtual match string on NVD API Request (#6177)
-- fix: correct meta data in report after switching the NVD API (#6154)
-- fix: retry HTTP connections to NVD on 502 and 504 errors (#6151)
-- fix: Gitlab report format needs severity capitalized (#6182)
-- fix: improve JDK update version parsing (#6163)
-- fix: mute JCS logging (again) (#6153)
+- fix: remove virtual match string on NVD API Request ([#6177](https://github.com/dependency-check/DependencyCheck/pull/6177))
+- fix: correct meta data in report after switching the NVD API ([#6154](https://github.com/dependency-check/DependencyCheck/pull/6154))
+- fix: retry HTTP connections to NVD on 502 and 504 errors ([#6151](https://github.com/dependency-check/DependencyCheck/pull/6151))
+- fix: Gitlab report format needs severity capitalized ([#6182](https://github.com/dependency-check/DependencyCheck/pull/6182))
+- fix: improve JDK update version parsing ([#6163](https://github.com/dependency-check/DependencyCheck/pull/6163))
+- fix: mute JCS logging (again) ([#6153](https://github.com/dependency-check/DependencyCheck/pull/6153))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/72?closed=1).
@@ -330,14 +410,14 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
**breaking changes**: See the [upgrade notice](https://github.com/dependency-check/DependencyCheck#900-upgrade-notice)
-- fix: check java 8 update version; minimum JRE is 8 update 251 (#6118)
-- fix: add retry for failed NVD API requests (#6136)
-- docs: add default values to documentation for the NVD API Delay (#6135)
-- chore: Revert "build(deps): bump com.h2database:h2 from 2.1.214 to 2.2.224" (#6131)
+- fix: check java 8 update version; minimum JRE is 8 update 251 ([#6118](https://github.com/dependency-check/DependencyCheck/pull/6118))
+- fix: add retry for failed NVD API requests ([#6136](https://github.com/dependency-check/DependencyCheck/pull/6136))
+- docs: add default values to documentation for the NVD API Delay ([#6135](https://github.com/dependency-check/DependencyCheck/pull/6135))
+- chore: Revert "build(deps): bump com.h2database:h2 from 2.1.214 to 2.2.224" ([#6131](https://github.com/dependency-check/DependencyCheck/pull/6131))
- this is a **breaking change** for anyone that successfully created the H2 database with 9.0.0.
-- fix: mute jcs logging (#6130)
-- docs: update NVD notice (#6110)
-- fix: Use the correct key for NVD API-Key from Maven Settings serverId (#6109)
+- fix: mute jcs logging ([#6130](https://github.com/dependency-check/DependencyCheck/pull/6130))
+- docs: update NVD notice ([#6110](https://github.com/dependency-check/DependencyCheck/pull/6110))
+- fix: Use the correct key for NVD API-Key from Maven Settings serverId ([#6109](https://github.com/dependency-check/DependencyCheck/pull/6109))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/71?closed=1).
@@ -345,22 +425,22 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
**breaking changes**: See the [upgrade notice](https://github.com/dependency-check/DependencyCheck#900-upgrade-notice)
-- feat: Utilize NVD API (#5978)
-- feat: gitlab dependency scanner report format #5919 (#5920)
-- fix: Use ASCII apostrophe for console message (#6076)
+- feat: Utilize NVD API ([#5978](https://github.com/dependency-check/DependencyCheck/pull/5978))
+- feat: gitlab dependency scanner report format [#5919](https://github.com/dependency-check/DependencyCheck/pull/5919) ([#5920](https://github.com/dependency-check/DependencyCheck/pull/5920))
+- fix: Use ASCII apostrophe for console message ([#6076](https://github.com/dependency-check/DependencyCheck/pull/6076))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/68?closed=1).
## [Version 8.4.3](https://github.com/dependency-check/DependencyCheck/releases/tag/v8.4.3) (2023-11-15)
-- fix: bump jcs3 (#6047)
-- docs: Corrected docs on hostedSuppressions (#6035)
+- fix: bump jcs3 ([#6047](https://github.com/dependency-check/DependencyCheck/pull/6047))
+- docs: Corrected docs on hostedSuppressions ([#6035](https://github.com/dependency-check/DependencyCheck/pull/6035))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/70?closed=1).
## [Version 8.4.2](https://github.com/dependency-check/DependencyCheck/releases/tag/v8.4.2) (2023-10-22)
-- fix: correct log configuration in cli (#6002)
+- fix: correct log configuration in cli ([#6002](https://github.com/dependency-check/DependencyCheck/pull/6002))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/69?closed=1).
@@ -368,11 +448,11 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Fixed
-- fix: upgrade to JCS3 (#5114)
-- fix: Support ~= version specifier in requirements.txt and pipfile (#5902)
-- fix: Version of dependency no longer ignored when CPE product has a 'java' suffix in a product name (#5901)
-- fix: Do not filter out evidences added by hints (#5900)
-- fix: fixes FP #5925 (#5927)
+- fix: upgrade to JCS3 ([#5114](https://github.com/dependency-check/DependencyCheck/pull/5114))
+- fix: Support ~= version specifier in requirements.txt and pipfile ([#5902](https://github.com/dependency-check/DependencyCheck/pull/5902))
+- fix: Version of dependency no longer ignored when CPE product has a 'java' suffix in a product name ([#5901](https://github.com/dependency-check/DependencyCheck/pull/5901))
+- fix: Do not filter out evidences added by hints ([#5900](https://github.com/dependency-check/DependencyCheck/pull/5900))
+- fix: fixes FP [#5925](https://github.com/dependency-check/DependencyCheck/pull/5925) ([#5927](https://github.com/dependency-check/DependencyCheck/pull/5927))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/67?closed=1).
@@ -380,17 +460,17 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Added
-- feat: Add support for Nexus v3 to NexusAnalyzer (#5849)
+- feat: Add support for Nexus v3 to NexusAnalyzer ([#5849](https://github.com/dependency-check/DependencyCheck/pull/5849))
### Fixed
-- fix: Hint Analyzer should run before VersionFilter Analyzer (#5818)
+- fix: Hint Analyzer should run before VersionFilter Analyzer ([#5818](https://github.com/dependency-check/DependencyCheck/pull/5818))
- chore: switch to sha1-pinning as suggested by Semgrep
-- fix: OSS Index Analyzer SocketTimeoutException exception handling based on warn only parameter (#5845)
-- fix: use curl with -L to follow github redirect (#5808)
+- fix: OSS Index Analyzer SocketTimeoutException exception handling based on warn only parameter ([#5845](https://github.com/dependency-check/DependencyCheck/pull/5845))
+- fix: use curl with -L to follow github redirect ([#5808](https://github.com/dependency-check/DependencyCheck/pull/5808))
- fix: use curl with -L to follow github redirect
-- fix: #5671 out of memory error (#5789)
-- fix: #5671 Exit method as soon as we detect a loop to prevent an infinite loop leading to an OutOfMemoryError
+- fix: [#5671](https://github.com/dependency-check/DependencyCheck/pull/5671) out of memory error ([#5789](https://github.com/dependency-check/DependencyCheck/pull/5789))
+- fix: [#5671](https://github.com/dependency-check/DependencyCheck/pull/5671) Exit method as soon as we detect a loop to prevent an infinite loop leading to an OutOfMemoryError
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/66?closed=1).
@@ -402,16 +482,16 @@ Re-release of 8.3.0 as 8.3.1.
### Added
- - Add LibmanAnalyzer (#5652)
- - Update HTML report Dependencies header based on display settings (#5619)
- - Add link to suppressed vulnerabilities header in HTML report (#5620)
- - Enable local proxy configuration in maven plugin configuration (#5696)
+ - Add LibmanAnalyzer ([#5652](https://github.com/dependency-check/DependencyCheck/pull/5652))
+ - Update HTML report Dependencies header based on display settings ([#5619](https://github.com/dependency-check/DependencyCheck/pull/5619))
+ - Add link to suppressed vulnerabilities header in HTML report ([#5620](https://github.com/dependency-check/DependencyCheck/pull/5620))
+ - Enable local proxy configuration in maven plugin configuration ([#5696](https://github.com/dependency-check/DependencyCheck/pull/5696))
### Fixed
- - Fix npm alias present in requires of dependencies (#5703)
- - Make Central URL configurable via CLI (#5667)
- - Ensure support of CVSSv3.1 (#5602)
+ - Fix npm alias present in requires of dependencies ([#5703](https://github.com/dependency-check/DependencyCheck/pull/5703))
+ - Make Central URL configurable via CLI ([#5667](https://github.com/dependency-check/DependencyCheck/pull/5667))
+ - Ensure support of CVSSv3.1 ([#5602](https://github.com/dependency-check/DependencyCheck/pull/5602))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/65?closed=1).
@@ -419,9 +499,9 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Fixed
- - NullPointerException in MSBuildAnalyzer (#5589)
- - SQL Syntax for Oracle (#5590)
- - Use `https://` URLs in report templates (#5582)
+ - NullPointerException in MSBuildAnalyzer ([#5589](https://github.com/dependency-check/DependencyCheck/pull/5589))
+ - SQL Syntax for Oracle ([#5590](https://github.com/dependency-check/DependencyCheck/pull/5590))
+ - Use `https://` URLs in report templates ([#5582](https://github.com/dependency-check/DependencyCheck/pull/5582))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/64?closed=1).
@@ -429,14 +509,14 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Added
- - Support msbuild Directory.build.props (#5475)
+ - Support msbuild Directory.build.props ([#5475](https://github.com/dependency-check/DependencyCheck/pull/5475))
- better display of NPM audit references
- Add CVSS V3 results from NPM Audit results
### Fixed
- - Fix several issues on NPM Audit reporting (#5546)
- - Case issue in SQL (#5557)
+ - Fix several issues on NPM Audit reporting ([#5546](https://github.com/dependency-check/DependencyCheck/pull/5546))
+ - Case issue in SQL ([#5557](https://github.com/dependency-check/DependencyCheck/pull/5557))
- Fix CWE(s) extraction for NPM Audit advisories
- Use the stable github_advisory_id instead of the now unstable id in NPM audit results
@@ -446,7 +526,7 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Fixed
- - Fix `NullPointerException` in the Jar Analyzer introduced in 8.1.1 (#5512)
+ - Fix `NullPointerException` in the Jar Analyzer introduced in 8.1.1 ([#5512](https://github.com/dependency-check/DependencyCheck/pull/5512))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/62?closed=1).
@@ -454,13 +534,13 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Fixed
- - allow hosted suppressions file to be disabled (#5509)
- - Several FPs not suitable for our automation (#5504)
- - Fix incorrect defaults for nexus and central-analyzer in gradle plugin documentation (#5503)
- - Erroneous error-log for deprecated CLI flag usage when using properyfile based disablement of Node Audit Analyzer (#5487)
- - Prefer pom.properties G/A/V over pom.xml G/A/V to resolve GAV interpolation issues (#5473)
- - Node package dependencies ending up as related dependency of the wrong version of the package (#5479)
- - do not throw error if pyproject.toml is in node_modules (#5470)
+ - allow hosted suppressions file to be disabled ([#5509](https://github.com/dependency-check/DependencyCheck/pull/5509))
+ - Several FPs not suitable for our automation ([#5504](https://github.com/dependency-check/DependencyCheck/pull/5504))
+ - Fix incorrect defaults for nexus and central-analyzer in gradle plugin documentation ([#5503](https://github.com/dependency-check/DependencyCheck/pull/5503))
+ - Erroneous error-log for deprecated CLI flag usage when using properyfile based disablement of Node Audit Analyzer ([#5487](https://github.com/dependency-check/DependencyCheck/pull/5487))
+ - Prefer pom.properties G/A/V over pom.xml G/A/V to resolve GAV interpolation issues ([#5473](https://github.com/dependency-check/DependencyCheck/pull/5473))
+ - Node package dependencies ending up as related dependency of the wrong version of the package ([#5479](https://github.com/dependency-check/DependencyCheck/pull/5479))
+ - do not throw error if pyproject.toml is in node_modules ([#5470](https://github.com/dependency-check/DependencyCheck/pull/5470))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/61?closed=1).
@@ -542,7 +622,7 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Fixed
-- Resolved issue processing NVD CVE data due to column width (#5229)
+- Resolved issue processing NVD CVE data due to column width ([#5229](https://github.com/dependency-check/DependencyCheck/pull/5229))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/56?closed=1).
@@ -550,8 +630,8 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Fixed
-- Fixed NPE when analyzing version ranges in NPM (#5158 & #5190)
-- Resolved several FP (#5191)
+- Fixed NPE when analyzing version ranges in NPM ([#5158](https://github.com/dependency-check/DependencyCheck/pull/5158) & [#5190](https://github.com/dependency-check/DependencyCheck/pull/5190))
+- Resolved several FP ([#5191](https://github.com/dependency-check/DependencyCheck/pull/5191))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/55?closed=1).
@@ -559,11 +639,11 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Fixed
-- Fixes maven 3.1 compatibility issue (#5152)
-- Fixed issue with invalid `node_module` paths in some scans (#5135)
-- Fixed missing option to disable the Poetry Analyzer in the CLI (#5160)
-- Fixed missing option to configure the OSS Index URL in the CLI (#5180)
-- Fixed NPE when analyzing version ranges in NPM (#5158)
+- Fixes maven 3.1 compatibility issue ([#5152](https://github.com/dependency-check/DependencyCheck/pull/5152))
+- Fixed issue with invalid `node_module` paths in some scans ([#5135](https://github.com/dependency-check/DependencyCheck/pull/5135))
+- Fixed missing option to disable the Poetry Analyzer in the CLI ([#5160](https://github.com/dependency-check/DependencyCheck/pull/5160))
+- Fixed missing option to configure the OSS Index URL in the CLI ([#5180](https://github.com/dependency-check/DependencyCheck/pull/5180))
+- Fixed NPE when analyzing version ranges in NPM ([#5158](https://github.com/dependency-check/DependencyCheck/pull/5158))
- Fixed issue with non-proxy host in the gradle plugin (https://github.com/dependency-check/dependency-check-gradle/pull/298)
- Resolved several FP
@@ -573,8 +653,8 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Fixed
-- Fixed bug when setting the proxy port in gradle (#5123)
-- Fixed issue with invalid `node_module` paths in some scans (#5127)
+- Fixed bug when setting the proxy port in gradle ([#5123](https://github.com/dependency-check/DependencyCheck/pull/5123))
+- Fixed issue with invalid `node_module` paths in some scans ([#5127](https://github.com/dependency-check/DependencyCheck/pull/5127))
- Resolved several FP
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/53?closed=1).
@@ -583,20 +663,20 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Added
-- Add support for npm package lock v2 and v3 (#5078)
-- Added experimental support for Python Poetry (#5025)
-- Added a vanilla HTML report for use in Jenkins (#5053)
+- Add support for npm package lock v2 and v3 ([#5078](https://github.com/dependency-check/DependencyCheck/pull/5078))
+- Added experimental support for Python Poetry ([#5025](https://github.com/dependency-check/DependencyCheck/pull/5025))
+- Added a vanilla HTML report for use in Jenkins ([#5053](https://github.com/dependency-check/DependencyCheck/pull/5053))
### Changed
- Renamed `RELEASE_NOTES.md` to `CHANGELOG.md` to be more conventional
-- Optimized checksum calculation to improve performance (#5112)
-- Added support for scanning .NET assemblies when only the dotnet runtime is installed (#5087)
+- Optimized checksum calculation to improve performance ([#5112](https://github.com/dependency-check/DependencyCheck/pull/5112))
+- Added support for scanning .NET assemblies when only the dotnet runtime is installed ([#5087](https://github.com/dependency-check/DependencyCheck/pull/5087))
- Bumped several dependencies
### Fixed
-- Fixed bug when setting the proxy port (#5076)
+- Fixed bug when setting the proxy port ([#5076](https://github.com/dependency-check/DependencyCheck/pull/5076))
- Resolved several FP and FN
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/52?closed=1).
@@ -607,8 +687,8 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
- Automated release of 7.3.1 failed and only published to Central; 7.3.2 is a re-release of 7.3.1.
- Resolved several false positives and false negatives.
-- Use Jackson Afterburner if still on Java 8 (#4966).
-- Exclude `node_modules` from the Maven plugin's scan path (#4974).
+- Use Jackson Afterburner if still on Java 8 ([#4966](https://github.com/dependency-check/DependencyCheck/pull/4966)).
+- Exclude `node_modules` from the Maven plugin's scan path ([#4974](https://github.com/dependency-check/DependencyCheck/pull/4974)).
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/51?closed=1).
@@ -617,8 +697,8 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Changed
- Resolved several false positives and false negatives.
-- Use Jackson Afterburner if still on Java 8 (#4966).
-- Exclude `node_modules` from the Maven plugin's scan path (#4974).
+- Use Jackson Afterburner if still on Java 8 ([#4966](https://github.com/dependency-check/DependencyCheck/pull/4966)).
+- Exclude `node_modules` from the Maven plugin's scan path ([#4974](https://github.com/dependency-check/DependencyCheck/pull/4974)).
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/51?closed=1).
@@ -626,15 +706,15 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Added
-- Added an experimental Dart analyzer (#4869).
+- Added an experimental Dart analyzer ([#4869](https://github.com/dependency-check/DependencyCheck/pull/4869)).
### Changed
-- Migrated from Jackson Afterburner to Blackbird (#4905).
+- Migrated from Jackson Afterburner to Blackbird ([#4905](https://github.com/dependency-check/DependencyCheck/pull/4905)).
### Fixed
-- Fixed issue with the Maven plugin that caused concurrent modification exceptions (#4935).
+- Fixed issue with the Maven plugin that caused concurrent modification exceptions ([#4935](https://github.com/dependency-check/DependencyCheck/pull/4935)).
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/50?closed=1).
@@ -642,7 +722,7 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Fixed
-- Fixed logging issue (#4846).
+- Fixed logging issue ([#4846](https://github.com/dependency-check/DependencyCheck/pull/4846)).
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/49?closed=1).
@@ -650,8 +730,8 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Changed
-- Add support for Bazel's pinned `maven_install.json` (#4772).
-- Fixed bug preventing the use of custom report templates (#4800).
+- Add support for Bazel's pinned `maven_install.json` ([#4772](https://github.com/dependency-check/DependencyCheck/pull/4772)).
+- Fixed bug preventing the use of custom report templates ([#4800](https://github.com/dependency-check/DependencyCheck/pull/4800)).
- Updated several dependencies including upgrades for dependencies with CVEs.
- Several bug fixes made and suppression rules were added.
@@ -661,8 +741,8 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Changed
-- The maven plugin now includes pnpm and yarn lock files in the scan by default (#4753).
-- If a suppression rule is no longer used a log entry will be written (#4685).
+- The maven plugin now includes pnpm and yarn lock files in the scan by default ([#4753](https://github.com/dependency-check/DependencyCheck/pull/4753)).
+- If a suppression rule is no longer used a log entry will be written ([#4685](https://github.com/dependency-check/DependencyCheck/pull/4685)).
- Several bug fixes made and suppression rules added.
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/47?closed=1).
@@ -690,7 +770,7 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Changed
-- Update to `jackson-databind` (see #4285).
+- Update to `jackson-databind` (see [#4285](https://github.com/dependency-check/DependencyCheck/pull/4285)).
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/43?closed=1).
@@ -698,7 +778,7 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Changed
-- Update to `jackson-databind` (see #4285).
+- Update to `jackson-databind` (see [#4285](https://github.com/dependency-check/DependencyCheck/pull/4285)).
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/42?closed=1).
@@ -725,7 +805,7 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
- **Breaking:** The H2 database version has been upgraded.
- if you use the `dataDirectory` option you will need to run a purge after upgrading.
- **Breaking:** Upgraded to dotnet core 6.0. If analyzing dotnet assemblies the system will need to have the dotnet core 6.0.x runtime available.
-- The Sarif report format has been fixed and can now be imported into GitHub if desired (See #3993).
+- The Sarif report format has been fixed and can now be imported into GitHub if desired (See [#3993](https://github.com/dependency-check/DependencyCheck/pull/3993)).
- Introduced IssueOps for False Positive reports to assist the team in evaluating FP reports.
- [Create New FP Report Issue](https://github.com/dependency-check/DependencyCheck/issues/new?assignees=&labels=FP+Report&template=false-positive-report.yml&title=%5BFP%5D%3A+).
- When analyzing Java projects ODC now includes data from the developers section.
@@ -738,9 +818,9 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Changed
-- Performance improvements for some Maven projects (see #3923 and #3931).
-- Fixed bug in npm version handling introduced in 6.5.2 (see #3956).
-- Improved the node package analyzer to correctly report the origin of a dependency (see #3970).
+- Performance improvements for some Maven projects (see [#3923](https://github.com/dependency-check/DependencyCheck/pull/3923) and [#3931](https://github.com/dependency-check/DependencyCheck/pull/3931)).
+- Fixed bug in npm version handling introduced in 6.5.2 (see [#3956](https://github.com/dependency-check/DependencyCheck/pull/3956)).
+- Improved the node package analyzer to correctly report the origin of a dependency (see [#3970](https://github.com/dependency-check/DependencyCheck/pull/3970)).
- General code maintenance and false positive reductions.
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/39?closed=1).
@@ -749,9 +829,9 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Changed
-- Fixed false positives around log4j-api and Log4j-web (#3910 & #3937).
-- Bug fix when processing NPM lock files (#3893).
-- Added missing `pnpm` argmument to the CLI (#3916).
+- Fixed false positives around log4j-api and Log4j-web ([#3910](https://github.com/dependency-check/DependencyCheck/pull/3910) & [#3937](https://github.com/dependency-check/DependencyCheck/pull/3937)).
+- Bug fix when processing NPM lock files ([#3893](https://github.com/dependency-check/DependencyCheck/pull/3893)).
+- Added missing `pnpm` argmument to the CLI ([#3916](https://github.com/dependency-check/DependencyCheck/pull/3916)).
- General code maintenance and false positive reductions.
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/38?closed=1).
@@ -760,8 +840,8 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Changed
-- Updated the dependency-check-maven plugin to correctly support SNAPSHOT version when a classifier is specified (#3787).
-- Improved the analysis of Swift package manager (package.resolved - see #3813).
+- Updated the dependency-check-maven plugin to correctly support SNAPSHOT version when a classifier is specified ([#3787](https://github.com/dependency-check/DependencyCheck/pull/3787)).
+- Improved the analysis of Swift package manager (package.resolved - see [#3813](https://github.com/dependency-check/DependencyCheck/pull/3813)).
- General code maintenance and false positive reductions.
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/37?closed=1).
@@ -773,8 +853,8 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
- Updated build configuration to create [reproducible builds](https://reproducible-builds.org/).
- Updated automated release process to work with branch protection.
- Resolved several false positives in the Java ecosystem.
-- Enabled the Swift Resolved analyzer per #3735
-- Improved iOS support per #3168 and #3765
+- Enabled the Swift Resolved analyzer per [#3735](https://github.com/dependency-check/DependencyCheck/pull/3735)
+- Improved iOS support per [#3168](https://github.com/dependency-check/DependencyCheck/pull/3168) and [#3765](https://github.com/dependency-check/DependencyCheck/pull/3765)
- Added the a new pnpm Analyzer
- Fixed issue with some npm and yarn analysis failing due to large audit output
@@ -859,8 +939,8 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Fixed
-- Resolved issue with Sarif report (#3243)
-- Resolved issue with Ruby Bundle Audit (#3256)
+- Resolved issue with Sarif report ([#3243](https://github.com/dependency-check/DependencyCheck/pull/3243))
+- Resolved issue with Ruby Bundle Audit ([#3256](https://github.com/dependency-check/DependencyCheck/pull/3256))
- Several minor bug fixes and updates to reduce false positives
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/26?closed=1).
@@ -869,7 +949,7 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Fixed
-- Fixed a second NPE introduced in 6.1.3 (see #3246)
+- Fixed a second NPE introduced in 6.1.3 (see [#3246](https://github.com/dependency-check/DependencyCheck/pull/3246))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/25?closed=1).
@@ -877,7 +957,7 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Changed
-- Fixed an NPE introduced in 6.1.3 (see #3212)
+- Fixed an NPE introduced in 6.1.3 (see [#3212](https://github.com/dependency-check/DependencyCheck/pull/3212))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/24?closed=1).
@@ -885,8 +965,8 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Changed
-- Modified the new CPE matching strategy to be more performant (#3207)
-- Upgraded a vulnerable dependency (velocity-engine-core/CVE-2020-13936) (#3205)
+- Modified the new CPE matching strategy to be more performant ([#3207](https://github.com/dependency-check/DependencyCheck/pull/3207))
+- Upgraded a vulnerable dependency (velocity-engine-core/CVE-2020-13936) ([#3205](https://github.com/dependency-check/DependencyCheck/pull/3205))
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/23?closed=1).
@@ -925,7 +1005,7 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Changed
-- Added missing command line arguments per #3028 and #3035.
+- Added missing command line arguments per [#3028](https://github.com/dependency-check/DependencyCheck/pull/3028) and [#3035](https://github.com/dependency-check/DependencyCheck/pull/3035).
- False positive reduction and minor bug fixes.
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/19?closed=1).
@@ -942,20 +1022,20 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Changed
-- Added a bash command completion script (see #2916); to add completion to your shell
+- Added a bash command completion script (see [#2916](https://github.com/dependency-check/DependencyCheck/pull/2916)); to add completion to your shell
`completion-for-dependency-check.sh` can be found in the bin directory of the CLI:
```bash
$ source completion-for-dependency-check.sh
```
-- An experimental PIP File Analyzer was added (see #2877).
-- Analysis of Node JS produced several false positives (see #2796); the analysis has
+- An experimental PIP File Analyzer was added (see [#2877](https://github.com/dependency-check/DependencyCheck/pull/2877)).
+- Analysis of Node JS produced several false positives (see [#2796](https://github.com/dependency-check/DependencyCheck/pull/2796)); the analysis has
been updated to reduce the number of false positives.
- If analyzing Node JS projects it is highly recommended to disable the Node JS Analyzer
and solely rely on the Node Audit Analyzer. There are plans to rework Node JS analysis
in a future release.
-- Support for external Oracle databases has been add for the 6.x releases (see #2899)
+- Support for external Oracle databases has been add for the 6.x releases (see [#2899](https://github.com/dependency-check/DependencyCheck/pull/2899))
- Resolved several reported false positives.
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/17?closed=1).
@@ -966,8 +1046,8 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
- The project is migrating from hosting the release archives on Bintray and moving them to Github under the assets for each [release](https://github.com/dependency-check/DependencyCheck/releases)
- **Please update any automation you have to point to the new location.**
-- Npm Audit Analyzer now correctly skips dev dependencies (`--nodeAuditSkipDevDependencies`); see #2482.
-- GoLang Analyzer now scans transitive dependencies; see #2680.
+- Npm Audit Analyzer now correctly skips dev dependencies (`--nodeAuditSkipDevDependencies`); see [#2482](https://github.com/dependency-check/DependencyCheck/pull/2482).
+- GoLang Analyzer now scans transitive dependencies; see [#2680](https://github.com/dependency-check/DependencyCheck/pull/2680).
- Several bug fixes found in 6.0.1.
See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/16?closed=1).
@@ -990,7 +1070,7 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
- Updated database schema; this is a *breaking change* and anyone using an external database or those whom
specify the data directory will need recreate the database (including users of the docker image). The schema
changes were made to:
- - Improve the CVSS data, when available, per #2547
+ - Improve the CVSS data, when available, per [#2547](https://github.com/dependency-check/DependencyCheck/pull/2547)
- Improve the way that ecosystems are determined
- Improve the update performance of external databases
- Users with an **external Oracle** database will not be able to upgrade as https://github.com/dependency-check/DependencyCheck/issues/2755
@@ -1011,55 +1091,55 @@ See the full listing of [changes](https://github.com/dependency-check/Dependency
### Changed
-- Added an experimental PE Analyzer that reads the PE headers of DLL and EXE files; see [#2448](https://github.com/jeremylong/DependencyCheck/pull/2448) and [#2446](https://github.com/jeremylong/DependencyCheck/pull/2446).
+- Added an experimental PE Analyzer that reads the PE headers of DLL and EXE files; see [#2448](https://github.com/dependency-check/DependencyCheck/pull/2448) and [#2446](https://github.com/dependency-check/DependencyCheck/pull/2446).
- Lots of bug fixes and updates to false positives and false negatives
- You may see a large one time performance hit when updating the database after updating to 5.3.1
-See the full listing of [changes](https://github.com/jeremylong/DependencyCheck/milestone/12?closed=1).
+See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/12?closed=1).
-## [Version 5.3.0](https://github.com/jeremylong/DependencyCheck/releases/tag/v5.3.0) (2020-01-15)
+## [Version 5.3.0](https://github.com/dependency-check/DependencyCheck/releases/tag/v5.3.0) (2020-01-15)
### Changed
-- Updated the JSON report to include a new field for unscored vulnerabilities (see #2392).
-- Updated the XML report to include a new attribute to flag unscored vulnerabilities (see #2392)
- - see https://github.com/jeremylong/DependencyCheck/blob/main/core/src/main/resources/schema/dependency-check.2.3.xsd
-- Added an experimental analyzer that will lookup Node libraries in the NVD data feeds (see #1249)
+- Updated the JSON report to include a new field for unscored vulnerabilities (see [#2392](https://github.com/dependency-check/DependencyCheck/pull/2392)).
+- Updated the XML report to include a new attribute to flag unscored vulnerabilities (see [#2392](https://github.com/dependency-check/DependencyCheck/pull/2392))
+ - see https://github.com/dependency-check//DependencyCheck/blob/main/core/src/main/resources/schema/dependency-check.2.3.xsd
+- Added an experimental analyzer that will lookup Node libraries in the NVD data feeds (see [#1249](https://github.com/dependency-check/DependencyCheck/pull/1249))
- `NpmCPEAnalyzer`, experimental analyzers must be enabled, controlled via property `analyzer.npm.cpe.enabled` which will be exposed as a configuration option in the next release.
-See the full listing of [changes](https://github.com/jeremylong/DependencyCheck/milestone/11?closed=1).
+See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/11?closed=1).
-## [Version 5.2.4](https://github.com/jeremylong/DependencyCheck/releases/tag/v5.2.4) (2019-11-12)
+## [Version 5.2.4](https://github.com/dependency-check/DependencyCheck/releases/tag/v5.2.4) (2019-11-12)
### Changed
- Reverted a in 5.2.3 that caused the dependency-check.sh script to fail on some systems (including the docker image).
- Fixed issue with pretty printing the XML report.
-See the full listing of [resolved issues](https://github.com/jeremylong/DependencyCheck/issues?utf8=%E2%9C%93&q=is%3Aissue++is%3Aclosed+milestone%3A5.2.4).
+See the full listing of [resolved issues](https://github.com/dependency-check/DependencyCheck/issues?utf8=%E2%9C%93&q=is%3Aissue++is%3Aclosed+milestone%3A5.2.4).
-## [Version 5.2.3](https://github.com/jeremylong/DependencyCheck/releases/tag/v5.2.3) (2019-11-11)
+## [Version 5.2.3](https://github.com/dependency-check/DependencyCheck/releases/tag/v5.2.3) (2019-11-11)
### Changed
-- Updated to use the NVD JSON 1.1 schema (see [#2273](https://github.com/jeremylong/DependencyCheck/issues/2273)).
+- Updated to use the NVD JSON 1.1 schema (see [#2273](https://github.com/dependency-check/DependencyCheck/issues/2273)).
- This update is 100% backward compatible with the 1.0 schema if you are mirroring the 1.0 JSON files.
- Added `nonProxyHosts` to the CLI and gradle plugin.
- False positive corrections.
- General code cleanup/bug fix.
-See the full listing of [resolved issues](https://github.com/jeremylong/DependencyCheck/issues?utf8=%E2%9C%93&q=is%3Aissue++is%3Aclosed+milestone%3A5.2.3) and [pull requests](https://github.com/jeremylong/DependencyCheck/pulls?utf8=%E2%9C%93&q=is%3Apr+milestone%3A5.2.3+is%3Aclosed+).
+See the full listing of [resolved issues](https://github.com/dependency-check/DependencyCheck/issues?utf8=%E2%9C%93&q=is%3Aissue++is%3Aclosed+milestone%3A5.2.3) and [pull requests](https://github.com/dependency-check/DependencyCheck/pulls?utf8=%E2%9C%93&q=is%3Apr+milestone%3A5.2.3+is%3Aclosed+).
-## [Version 5.2.2](https://github.com/jeremylong/DependencyCheck/releases/tag/v5.2.2) (2019-09-22)
+## [Version 5.2.2](https://github.com/dependency-check/DependencyCheck/releases/tag/v5.2.2) (2019-09-22)
### Changed
- False positive corrections
- General code cleanup/bug fix
-See the full listing of [resolved issues](https://github.com/jeremylong/DependencyCheck/issues?utf8=%E2%9C%93&q=is%3Aissue++is%3Aclosed+milestone%3A5.2.2).
+See the full listing of [resolved issues](https://github.com/dependency-check/DependencyCheck/issues?utf8=%E2%9C%93&q=is%3Aissue++is%3Aclosed+milestone%3A5.2.2).
-## [Version 5.2.1](https://github.com/jeremylong/DependencyCheck/releases/tag/v5.2.1) (2019-08-04)
+## [Version 5.2.1](https://github.com/dependency-check/DependencyCheck/releases/tag/v5.2.1) (2019-08-04)
### Changed
@@ -1068,29 +1148,29 @@ See the full listing of [resolved issues](https://github.com/jeremylong/Dependen
- False positive corrections
- General code cleanup/bug fix
-See the full listing of [resolved issues](https://github.com/jeremylong/DependencyCheck/issues?utf8=%E2%9C%93&q=is%3Aissue++is%3Aclosed+milestone%3A5.2.1).
+See the full listing of [resolved issues](https://github.com/dependency-check/DependencyCheck/issues?utf8=%E2%9C%93&q=is%3Aissue++is%3Aclosed+milestone%3A5.2.1).
-## [Version 5.2.0](https://github.com/jeremylong/DependencyCheck/releases/tag/v5.2.0) (2019-07-21)
+## [Version 5.2.0](https://github.com/dependency-check/DependencyCheck/releases/tag/v5.2.0) (2019-07-21)
### Changed
- Resolved formatting issues within the CSV report
- False positive corrections
- Renamed three properties within the `dependencycheck.properties`; there is no impact unless you are using a properties file in your build to control the CLI.
-- Added support for rbenv for Bundle Audit Analysis (see https://github.com/jeremylong/DependencyCheck/issues/2060).
+- Added support for rbenv for Bundle Audit Analysis (see https://github.com/dependency-check/DependencyCheck/issues/2060).
-See the full listing of [resolved issues](https://github.com/jeremylong/DependencyCheck/issues?utf8=%E2%9C%93&q=is%3Aissue++is%3Aclosed+milestone%3A5.2.0).
+See the full listing of [resolved issues](https://github.com/dependency-check/DependencyCheck/issues?utf8=%E2%9C%93&q=is%3Aissue++is%3Aclosed+milestone%3A5.2.0).
-## [Version 5.1.1](https://github.com/jeremylong/DependencyCheck/releases/tag/v5.1.1) (2019-07-15)
+## [Version 5.1.1](https://github.com/dependency-check/DependencyCheck/releases/tag/v5.1.1) (2019-07-15)
### Changed
- False positive corrections
- General code cleanup
-See the full listing of [resolved issues](https://github.com/jeremylong/DependencyCheck/issues?q=is%3Aissue+milestone%3A5.1.1+is%3Aclosed).
+See the full listing of [resolved issues](https://github.com/dependency-check/DependencyCheck/issues?q=is%3Aissue+milestone%3A5.1.1+is%3Aclosed).
-## [Version 5.1.0](https://github.com/jeremylong/DependencyCheck/releases/tag/v5.1.0) (2019-06-28)
+## [Version 5.1.0](https://github.com/dependency-check/DependencyCheck/releases/tag/v5.1.0) (2019-06-28)
### Changed
@@ -1101,16 +1181,16 @@ See the full listing of [resolved issues](https://github.com/jeremylong/Dependen
- Added optional configuration to add credentials to the OSS Index analysis.
- Resolved issues when Oracle or MySQL were used as a centralized database in 5.0.0.
-See the full listing of [resolved issues](https://github.com/jeremylong/DependencyCheck/issues?utf8=%E2%9C%93&q=is%3Aissue+is%3Aopen+milestone%3A5.1.0) and [pull requests](https://github.com/jeremylong/DependencyCheck/pulls?utf8=%E2%9C%93&q=is%3Apr+milestone%3A5.1.0).
+See the full listing of [resolved issues](https://github.com/dependency-check/DependencyCheck/issues?utf8=%E2%9C%93&q=is%3Aissue+is%3Aopen+milestone%3A5.1.0) and [pull requests](https://github.com/dependency-check/DependencyCheck/pulls?utf8=%E2%9C%93&q=is%3Apr+milestone%3A5.1.0).
-## [Version 5.0.0](https://github.com/jeremylong/DependencyCheck/releases/tag/v5.0.0) (2019-06-09)
+## [Version 5.0.0](https://github.com/dependency-check/DependencyCheck/releases/tag/v5.0.0) (2019-06-09)
### Changed
- Add caching of OSS-Index, Central Analyzer, and Node Audit analysis results.
-- General bug fixes identified in the previous milestone releases; see [5.0.0 resolved issues](https://github.com/jeremylong/DependencyCheck/issues?utf8=%E2%9C%93&q=is%3Aissue+is%3Aopen+milestone%3A5.0.0+) and [pull requests](https://github.com/jeremylong/DependencyCheck/pulls?utf8=%E2%9C%93&q=is%3Apr+milestone%3A5.0.0).
+- General bug fixes identified in the previous milestone releases; see [5.0.0 resolved issues](https://github.com/dependency-check/DependencyCheck/issues?utf8=%E2%9C%93&q=is%3Aissue+is%3Aopen+milestone%3A5.0.0+) and [pull requests](https://github.com/dependency-check/DependencyCheck/pulls?utf8=%E2%9C%93&q=is%3Apr+milestone%3A5.0.0).
-## [Version 5.0.0-M3](https://github.com/jeremylong/DependencyCheck/releases/tag/v5.0.0-M3) (2019-05-06)
+## [Version 5.0.0-M3](https://github.com/dependency-check/DependencyCheck/releases/tag/v5.0.0-M3) (2019-05-06)
### Changed
@@ -1118,7 +1198,7 @@ See the full listing of [resolved issues](https://github.com/jeremylong/Dependen
### Changed
-- Several bug fixes and minor enhancements have been made; see the related [issues](https://github.com/jeremylong/DependencyCheck/issues?utf8=%E2%9C%93&q=+milestone%3A5.0.0-M3+) and [pull requests](https://github.com/jeremylong/DependencyCheck/pulls?utf8=%E2%9C%93&q=+milestone%3A5.0.0-M3+).
+- Several bug fixes and minor enhancements have been made; see the related [issues](https://github.com/dependency-check/DependencyCheck/issues?utf8=%E2%9C%93&q=+milestone%3A5.0.0-M3+) and [pull requests](https://github.com/dependency-check/DependencyCheck/pulls?utf8=%E2%9C%93&q=+milestone%3A5.0.0-M3+).
- Multiple report formats can be specified; if you wanted just two of the reports you no longer need to use ALL.
- A new JUNIT formatted report has been added; this provides a different way to integrate with Jenkins builds; the following example creates a JUNIT report with failures for any CVE with a CVSS score greater than or equal to 7.0 the Jenkins pipeline script shows how to publish the report:
@@ -1161,14 +1241,14 @@ See the full listing of [resolved issues](https://github.com/jeremylong/Dependen
}
```
-## [Version 5.0.0-M2](https://github.com/jeremylong/DependencyCheck/releases/tag/v5.0.0-M2) (2019-03-11)
+## [Version 5.0.0-M2](https://github.com/dependency-check/DependencyCheck/releases/tag/v5.0.0-M2) (2019-03-11)
### Changed
- **Breaking:** [dotnet core](https://dotnet.microsoft.com/download/dotnet-core/2.2) must be installed to analyze .NET assemblies.
- **Breaking:** The retire.js analyzer is no longer considered experimental and is enabled by default.
-## [Version 5.0.0-M1](https://github.com/jeremylong/DependencyCheck/releases/tag/v5.0.0-M1) (2019-02-17)
+## [Version 5.0.0-M1](https://github.com/dependency-check/DependencyCheck/releases/tag/v5.0.0-M1) (2019-02-17)
### Changed
@@ -1185,7 +1265,7 @@ See the full listing of [resolved issues](https://github.com/jeremylong/Dependen
from one technology stack do not appear on a dependency built using a completely different stack (e.g.
NodeJS vulnerabilities should not show up on a .NET DLL).
-## [Version 4.0.2](https://github.com/jeremylong/DependencyCheck/releases/tag/v4.0.2) (2019-01-01)
+## [Version 4.0.2](https://github.com/dependency-check/DependencyCheck/releases/tag/v4.0.2) (2019-01-01)
### Added
@@ -1194,91 +1274,91 @@ See the full listing of [resolved issues](https://github.com/jeremylong/Dependen
To enable this feature set `false`.
- If using a local Nexus server (v2 or v3 pro) it is now possible to provide authentication credentials.
- Previous versions only worked with anonymous/unauthenticated access.
- - See [issue #977](https://github.com/jeremylong/DependencyCheck/issues/977)
+ - See [issue #977](https://github.com/dependency-check/DependencyCheck/issues/977)
### Fixed
- Updated fix for transitive dependencies with known vulnerabilities (guava and commons-collections)
so that the upgrade occurs correctly in other integrations that utilize core; see
- [issue #1562](https://github.com/jeremylong/DependencyCheck/issues/1561#issuecomment-450112110).
+ [issue #1562](https://github.com/dependency-check/DependencyCheck/issues/1561#issuecomment-450112110).
- Resolved several false positives
-## [Version 4.0.1](https://github.com/jeremylong/DependencyCheck/releases/tag/v4.0.1) (2018-12-17)
+## [Version 4.0.1](https://github.com/dependency-check/DependencyCheck/releases/tag/v4.0.1) (2018-12-17)
### Fixed
-- Fixed issue with false positives due to Lucene upgrade. See [#1531](https://github.com/jeremylong/DependencyCheck/issues/1580).
+- Fixed issue with false positives due to Lucene upgrade. See [#1531](https://github.com/dependency-check/DependencyCheck/issues/1580).
- Resolved several false positives.
- Resolved typo in documentation.
-## [Version 4.0.0](https://github.com/jeremylong/DependencyCheck/releases/tag/v4.0.0) (2018-11-21)
+## [Version 4.0.0](https://github.com/dependency-check/DependencyCheck/releases/tag/v4.0.0) (2018-11-21)
### Changed
-- OWASP dependency-check no longer supports running in JRE/JDK 7; JRE/JDK 8 or higher is required run dependency-check. See [#1531](https://github.com/jeremylong/DependencyCheck/issues/1531).
+- OWASP dependency-check no longer supports running in JRE/JDK 7; JRE/JDK 8 or higher is required run dependency-check. See [#1531](https://github.com/dependency-check/DependencyCheck/issues/1531).
### Fixed
-- Upgraded dependencies to resolve published vulnerabilities (Guava and Lucene); See [#1561](https://github.com/jeremylong/DependencyCheck/issues/1561).
+- Upgraded dependencies to resolve published vulnerabilities (Guava and Lucene); See [#1561](https://github.com/dependency-check/DependencyCheck/issues/1561).
-## [Version 3.3.4](https://github.com/jeremylong/DependencyCheck/releases/tag/v3.3.4) (2018-10-28)
+## [Version 3.3.4](https://github.com/dependency-check/DependencyCheck/releases/tag/v3.3.4) (2018-10-28)
### Fixed
- Resolved bug with parsing license information during analysis of Node.js modules.
-## [Version 3.3.3](https://github.com/jeremylong/DependencyCheck/releases/tag/v3.3.3) (2018-10-27)
+## [Version 3.3.3](https://github.com/dependency-check/DependencyCheck/releases/tag/v3.3.3) (2018-10-27)
### Changed
-- Migrated the NSP Analyzer to use the Node Audit APIs instead; see [#1366](https://github.com/jeremylong/DependencyCheck/issues/1366).
+- Migrated the NSP Analyzer to use the Node Audit APIs instead; see [#1366](https://github.com/dependency-check/DependencyCheck/issues/1366).
- Note that the analyzer and configuration was changed to NodeAuditAnalyzer.
- Configurations for the NSP analyzer have been deprecated and will control the NodeAuditAnalyzer if used; note that the NSP configuration options will be removed in a future release.
-- The [dependency-check-gradle](https://github.com/jeremylong/dependency-check-gradle) plugin was updated to include a default scan set
+- The [dependency-check-gradle](https://github.com/dependency-check/Dependency-check-gradle) plugin was updated to include a default scan set
of ['src/main/resources','src/main/webapp'] and any dependencies contained in these directories will be analyzed. The purpose of this
enhancement is to enable the RetireJS Analyzer to scan JavaScript files that may be included.
### Fixed
-- Resolved **false negative** on Bouncy Castle JAR files; see [#1500](https://github.com/jeremylong/DependencyCheck/issues/1500).
-- Resolved **false negatives** that may occur when using the Maven plugin if transitive dependencies of a library in use and is also declared as a primary dependency in a scope that is not used; see [#1512](https://github.com/jeremylong/DependencyCheck/issues/1512).
-- Resolved **false negatives** on libraries that contain an update version or timestamp tacked onto the end of the version number; see [#1537](https://github.com/jeremylong/DependencyCheck/issues/1537).
+- Resolved **false negative** on Bouncy Castle JAR files; see [#1500](https://github.com/dependency-check/DependencyCheck/issues/1500).
+- Resolved **false negatives** that may occur when using the Maven plugin if transitive dependencies of a library in use and is also declared as a primary dependency in a scope that is not used; see [#1512](https://github.com/dependency-check/DependencyCheck/issues/1512).
+- Resolved **false negatives** on libraries that contain an update version or timestamp tacked onto the end of the version number; see [#1537](https://github.com/dependency-check/DependencyCheck/issues/1537).
- The resolution for these false negatives may generate some false positives, please continue to report false positives and the engine can continue to be tuned.
-- Fixed bug preventing multiple proxies from being defined for Maven; see [#831](https://github.com/jeremylong/DependencyCheck/issues/831).
-- Updated the suppress buttons in the HTML report to generate the XML using the latest suppression schema; see [#489](https://github.com/jeremylong/DependencyCheck/issues/1489).
-- Added the `--artifactoryUrl` argument to the CLI - this was missed when the Artifactory Analyzer was previously added; see [#1492](https://github.com/jeremylong/DependencyCheck/issues/1492).
-- Updated test cases so that they no longer fail behind a proxy; see [#1493](https://github.com/jeremylong/DependencyCheck/issues/1493).
-- Resolved several reported false positives; see [#1504](https://github.com/jeremylong/DependencyCheck/issues/1504), [#1513](https://github.com/jeremylong/DependencyCheck/issues/1513),
- [#1515](https://github.com/jeremylong/DependencyCheck/issues/1515), [#1529](https://github.com/jeremylong/DependencyCheck/issues/1529), [#1535](https://github.com/jeremylong/DependencyCheck/issues/1535),
- and [#1437](https://github.com/jeremylong/DependencyCheck/issues/1437).
-- Fixed copy/paste error in JavaDoc; see [#1509](https://github.com/jeremylong/DependencyCheck/issues/1509).
+- Fixed bug preventing multiple proxies from being defined for Maven; see [#831](https://github.com/dependency-check/DependencyCheck/issues/831).
+- Updated the suppress buttons in the HTML report to generate the XML using the latest suppression schema; see [#489](https://github.com/dependency-check/DependencyCheck/issues/1489).
+- Added the `--artifactoryUrl` argument to the CLI - this was missed when the Artifactory Analyzer was previously added; see [#1492](https://github.com/dependency-check/DependencyCheck/issues/1492).
+- Updated test cases so that they no longer fail behind a proxy; see [#1493](https://github.com/dependency-check/DependencyCheck/issues/1493).
+- Resolved several reported false positives; see [#1504](https://github.com/dependency-check/DependencyCheck/issues/1504), [#1513](https://github.com/dependency-check/DependencyCheck/issues/1513),
+ [#1515](https://github.com/dependency-check/DependencyCheck/issues/1515), [#1529](https://github.com/dependency-check/DependencyCheck/issues/1529), [#1535](https://github.com/dependency-check/DependencyCheck/issues/1535),
+ and [#1437](https://github.com/dependency-check/DependencyCheck/issues/1437).
+- Fixed copy/paste error in JavaDoc; see [#1509](https://github.com/dependency-check/DependencyCheck/issues/1509).
-## [Version 3.3.2](https://github.com/jeremylong/DependencyCheck/releases/tag/v3.3.2) (2018-09-14)
+## [Version 3.3.2](https://github.com/dependency-check/DependencyCheck/releases/tag/v3.3.2) (2018-09-14)
### Fixed
-- Gradle plugin was updated to include backward compatibility with gradle < v4.0; see [#95](https://github.com/jeremylong/dependency-check-gradle/issues/95).
-- Gradle plugin improved handling of Android project; see [#94](https://github.com/jeremylong/dependency-check-gradle/issues/94)
-- CLI used an incorrect key for RetireJS causing the analyzer to not be loaded in some cases; see [#1440](https://github.com/jeremylong/DependencyCheck/issues/1440).
-- Resolved failure in the `CentralAnalyzer` when the pom.xml is not available in Central; see [#1439](https://github.com/jeremylong/DependencyCheck/issues/1439).
-- Resolved exception when JAR files contain invalid pom.xml files outside of META-INF; see [#1438](https://github.com/jeremylong/DependencyCheck/issues/1438).
+- Gradle plugin was updated to include backward compatibility with gradle < v4.0; see [#95](https://github.com/dependency-check/Dependency-check-gradle/issues/95).
+- Gradle plugin improved handling of Android project; see [#94](https://github.com/dependency-check/Dependency-check-gradle/issues/94)
+- CLI used an incorrect key for RetireJS causing the analyzer to not be loaded in some cases; see [#1440](https://github.com/dependency-check/DependencyCheck/issues/1440).
+- Resolved failure in the `CentralAnalyzer` when the pom.xml is not available in Central; see [#1439](https://github.com/dependency-check/DependencyCheck/issues/1439).
+- Resolved exception when JAR files contain invalid pom.xml files outside of META-INF; see [#1438](https://github.com/dependency-check/DependencyCheck/issues/1438).
- Resolved several reported false positives.
-## [Version 3.3.1](https://github.com/jeremylong/DependencyCheck/releases/tag/v3.3.1) (2018-08-06)
+## [Version 3.3.1](https://github.com/dependency-check/DependencyCheck/releases/tag/v3.3.1) (2018-08-06)
### Changed
-- An Nuget Packages.config Analyzer was added; see [#1412](https://github.com/jeremylong/DependencyCheck/issues/1412).
+- An Nuget Packages.config Analyzer was added; see [#1412](https://github.com/dependency-check/DependencyCheck/issues/1412).
### Fixed
-- Fixed error handling with regard to invalid manifest files contained within JAR files; see [#1024](https://github.com/jeremylong/DependencyCheck/issues/1024).
-- Fixed parsing of pom.xml files, in some cases a SAX Exception would be thrown; see [#1400](https://github.com/jeremylong/DependencyCheck/issues/1400).
-- Fixed bug that caused dependency-check to crash if the temporary directory and data directory were on different drives; see [#1394](https://github.com/jeremylong/DependencyCheck/issues/1394).
-- Fixed bug in dependency-check-maven where an aggregate analysis did not scan all files defined in the ScanSet; see [#1421](https://github.com/jeremylong/DependencyCheck/issues/1421).
-- Fixed NPE in dependency-check-gradle that occurred when artifacts where included using `implementation files("./lib/some.jar")`; see [#91](https://github.com/jeremylong/dependency-check-gradle/issues/91).
+- Fixed error handling with regard to invalid manifest files contained within JAR files; see [#1024](https://github.com/dependency-check/DependencyCheck/issues/1024).
+- Fixed parsing of pom.xml files, in some cases a SAX Exception would be thrown; see [#1400](https://github.com/dependency-check/DependencyCheck/issues/1400).
+- Fixed bug that caused dependency-check to crash if the temporary directory and data directory were on different drives; see [#1394](https://github.com/dependency-check/DependencyCheck/issues/1394).
+- Fixed bug in dependency-check-maven where an aggregate analysis did not scan all files defined in the ScanSet; see [#1421](https://github.com/dependency-check/DependencyCheck/issues/1421).
+- Fixed NPE in dependency-check-gradle that occurred when artifacts where included using `implementation files("./lib/some.jar")`; see [#91](https://github.com/dependency-check/Dependency-check-gradle/issues/91).
-## [Version 3.3.0](https://github.com/jeremylong/DependencyCheck/releases/tag/v3.3.0) (2018-07-22)
+## [Version 3.3.0](https://github.com/dependency-check/DependencyCheck/releases/tag/v3.3.0) (2018-07-22)
### Changed
@@ -1287,52 +1367,52 @@ See the full listing of [resolved issues](https://github.com/jeremylong/Dependen
- An experimental Retire JS analyzer has been added to analyze client side JavaScript.
- This utilizes information from the RetireJS repo on github. If you have a proxy that prevents access you will either need to have access granted to https://raw.githubusercontent.com/Retirejs/retire.js/main/repository/jsrepository.json or host the file internally, update the environment variable `analyzer.retirejs.repo.js.ur`, and periodically update the file.
- This analyzer is considered experimental, but the team expects this to be promoted quickly.
-- NuGet dependencies contained in MSBuild files are now included in the scan. See [Issue #1131](https://github.com/jeremylong/DependencyCheck/issues/1131) for more details.
-- Cocoapod's Podfile.lock is now analyzed when present. See [PR #1324](https://github.com/jeremylong/DependencyCheck/pull/1324) for more information.
+- NuGet dependencies contained in MSBuild files are now included in the scan. See [Issue #1131](https://github.com/dependency-check/DependencyCheck/issues/1131) for more details.
+- Cocoapod's Podfile.lock is now analyzed when present. See [PR #1324](https://github.com/dependency-check/DependencyCheck/pull/1324) for more information.
### Fixed
-- The dependency-check-gradle plugin can now analyze multi-project android builds. See [PR #09](https://github.com/jeremylong/dependency-check-gradle/pull/90) for more information.
-- In some cases extremely large project may cause dependency-check to fail due to the analysis time. Previously, the analysis was capped at 10 minutes; the timeout was increased to 20 minutes and made configurable if this continues to be an issue for some users. See [issue #936](https://github.com/jeremylong/DependencyCheck/issues/936) for more information.
+- The dependency-check-gradle plugin can now analyze multi-project android builds. See [PR #09](https://github.com/dependency-check/Dependency-check-gradle/pull/90) for more information.
+- In some cases extremely large project may cause dependency-check to fail due to the analysis time. Previously, the analysis was capped at 10 minutes; the timeout was increased to 20 minutes and made configurable if this continues to be an issue for some users. See [issue #936](https://github.com/dependency-check/DependencyCheck/issues/936) for more information.
- Some pom.xml files could not be analyzed because they contained a doctype definition. The parser has been enhanced to strip the doctype definitions.
- Fixed issue where, in some cases, temporary files were not correctly cleaned up in Jenkins and gradle builds.
-- Fixed issue where, in some cases, files were retrieved from Maven Central using HTTP instead of HTTPS. See [issue #1325](https://github.com/jeremylong/DependencyCheck/issues/1325) for more information.
+- Fixed issue where, in some cases, files were retrieved from Maven Central using HTTP instead of HTTPS. See [issue #1325](https://github.com/dependency-check/DependencyCheck/issues/1325) for more information.
- Additionally, a retry count was added when attempting to download pom.xml files during analysis.
-- Fixed issue where nodejs dependencies were not correctly analyzed. See [issue #1355](https://github.com/jeremylong/DependencyCheck/issues/1355) for more information.
+- Fixed issue where nodejs dependencies were not correctly analyzed. See [issue #1355](https://github.com/dependency-check/DependencyCheck/issues/1355) for more information.
- Fixed issue where the CWE was not written to the CSV report.
- In addition, general bug fixes, code cleanup, and false positive/negatives updates were made.
-## [Version 3.2.1](https://github.com/jeremylong/DependencyCheck/releases/tag/v3.2.1) (2018-05-28)
+## [Version 3.2.1](https://github.com/dependency-check/DependencyCheck/releases/tag/v3.2.1) (2018-05-28)
### Fixed
-- In some cases when using the Maven or Gradle plugins the GAV coordinates were not being added as an Identifier causing suppression rules to fail; this has been resolved (#1298)
-- Documentation Update (SCM links in the maven site were broken) (#1297)
-- False positive reduction (#1290)
-- Enhanced logging output for TLS failures to better assist with debugging (#1269)
-- Resolved a Null Pointer Exception (#1296)
+- In some cases when using the Maven or Gradle plugins the GAV coordinates were not being added as an Identifier causing suppression rules to fail; this has been resolved ([#1298](https://github.com/dependency-check/DependencyCheck/pull/1298))
+- Documentation Update (SCM links in the maven site were broken) ([#1297](https://github.com/dependency-check/DependencyCheck/pull/1297))
+- False positive reduction ([#1290](https://github.com/dependency-check/DependencyCheck/pull/1290))
+- Enhanced logging output for TLS failures to better assist with debugging ([#1269](https://github.com/dependency-check/DependencyCheck/pull/1269))
+- Resolved a Null Pointer Exception ([#1296](https://github.com/dependency-check/DependencyCheck/pull/1296))
-## [Version 3.2.0](https://github.com/jeremylong/DependencyCheck/releases/tag/v3.2.0) (2018-05-21)
+## [Version 3.2.0](https://github.com/dependency-check/DependencyCheck/releases/tag/v3.2.0) (2018-05-21)
### Changed
- Excess white space has been removed from the XML and HTML reports; the JSON report is still pretty printed (a future release will convert this to a configurable option)
- Better error reporting
- Changed to use commons-text instead of commons-lang3 as a portion of commons-lang3 was moved to commonts-text
-- Added more flexible suppression rules with the introduction of the `until` attribute (see [#1145](https://github.com/jeremylong/DependencyCheck/issues/1145) and [dependency-suppression.1.2.xsd](https://dependency-check.github.io/DependencyCheck/dependency-suppression.1.2.xsd)
+- Added more flexible suppression rules with the introduction of the `until` attribute (see [#1145](https://github.com/dependency-check/DependencyCheck/issues/1145) and [dependency-suppression.1.2.xsd](https://dependency-check.github.io/DependencyCheck/dependency-suppression.1.2.xsd)
### Fixed
- Unsafe unzip operations ([zip slip](https://github.com/snyk/zip-slip-vulnerability)), as reported by the Snyk Security Research Team, have been corrected. CVE-2018-12036 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames.
- The dependency-check-maven plugin no longer uses the [Central Analyzer](https://dependency-check.github.io/DependencyCheck/analyzers/central-analyzer.html) by default
-- Updated dependency-check-maven so that it will not fail when your multi-module build has dependencies that have not yet been built in the reactor (See [#740](https://github.com/jeremylong/DependencyCheck/issues/740))
+- Updated dependency-check-maven so that it will not fail when your multi-module build has dependencies that have not yet been built in the reactor (See [#740](https://github.com/dependency-check/DependencyCheck/issues/740))
- Note if the required dependency has not yet been built in the reactor and the dependency is available in a configured repository dependency-check-maven, as expected, would pull the dependency from the repository for analysis.
- Minor documentation updates
- False positive reduction
- Fixed the Gradle Plugin and Ant Task so that the temp directory is properly cleaned up after execution
-- Removed TLSv1 from the list of protocols used by default (See [#1237](https://github.com/jeremylong/DependencyCheck/pull/1237))
+- Removed TLSv1 from the list of protocols used by default (See [#1237](https://github.com/dependency-check/DependencyCheck/pull/1237))
-## [Version 3.1.2](https://github.com/jeremylong/DependencyCheck/releases/tag/v3.1.2) (2018-04-02)
+## [Version 3.1.2](https://github.com/dependency-check/DependencyCheck/releases/tag/v3.1.2) (2018-04-02)
### Fixed
@@ -1342,11 +1422,11 @@ See the full listing of [resolved issues](https://github.com/jeremylong/Dependen
will include a reference to the project/module where they were found
- The configuration option `versionCheckEnabled` was added to Maven to allow users to disable the check for
new versions of dependency-check; this will be added to gradle plugin, Ant Task, and the CLI in a future release
-- The XML and JSON reports were fixed so that the correct version number is displayed see [issue #1109](https://github.com/jeremylong/DependencyCheck/issues/1109)
+- The XML and JSON reports were fixed so that the correct version number is displayed see [issue #1109](https://github.com/dependency-check/DependencyCheck/issues/1109)
- The initial database creation time for H2 databases was improved
- Changes made to decrease false positive and false negatives
-## [Version 3.1.1](https://github.com/jeremylong/DependencyCheck/releases/tag/v3.1.1) (2018-01-29)
+## [Version 3.1.1](https://github.com/dependency-check/DependencyCheck/releases/tag/v3.1.1) (2018-01-29)
### Fixed
@@ -1355,7 +1435,7 @@ See the full listing of [resolved issues](https://github.com/jeremylong/Dependen
- False positive reduction.
- Minor documentation cleanup.
-## [Version 3.1.0](https://github.com/jeremylong/DependencyCheck/releases/tag/v3.1.0) (2018-01-02)
+## [Version 3.1.0](https://github.com/dependency-check/DependencyCheck/releases/tag/v3.1.0) (2018-01-02)
### Changed
@@ -1375,19 +1455,19 @@ See the full listing of [resolved issues](https://github.com/jeremylong/Dependen
the query to break.
- General cleanup, false positive, and false negative reduction.
-## [Version 3.0.2](https://github.com/jeremylong/DependencyCheck/releases/tag/v3.0.2) (2017-11-13)
+## [Version 3.0.2](https://github.com/dependency-check/DependencyCheck/releases/tag/v3.0.2) (2017-11-13)
### Fixed
- Updated the query format for the CentralAnalyzer; the old format caused the CentralAnalyzer to fail
-## [Version 3.0.1](https://github.com/jeremylong/DependencyCheck/releases/tag/v3.0.1) (2017-10-20)
+## [Version 3.0.1](https://github.com/dependency-check/DependencyCheck/releases/tag/v3.0.1) (2017-10-20)
### Fixed
- Fixed a database connection issue that affected some usages.
-## [Version 3.0.0](https://github.com/jeremylong/DependencyCheck/releases/tag/v3.0.0) (2017-10-16)
+## [Version 3.0.0](https://github.com/dependency-check/DependencyCheck/releases/tag/v3.0.0) (2017-10-16)
- Several bug fixes and false positive reduction
- The 2.x branch introduced several new false positives – but also reduced the false negatives
diff --git a/Dockerfile b/Dockerfile
index 936f976331c..d45176bc3d9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,10 +1,10 @@
-FROM golang:1.24.2-alpine AS go
+FROM golang:1.25.2-alpine AS go
-FROM azul/zulu-openjdk-alpine:21 AS jlink
+FROM azul/zulu-openjdk-alpine:25 AS jlink
-RUN "$JAVA_HOME/bin/jlink" --compress=2 --module-path /opt/java/openjdk/jmods --add-modules java.base,java.compiler,java.datatransfer,jdk.crypto.ec,java.desktop,java.instrument,java.logging,java.management,java.naming,java.rmi,java.scripting,java.security.sasl,java.sql,java.transaction.xa,java.xml,jdk.unsupported --output /jlinked
+RUN "$JAVA_HOME/bin/jlink" --compress=zip-6 --module-path /opt/java/openjdk/jmods --add-modules java.base,java.compiler,java.datatransfer,jdk.crypto.ec,java.desktop,java.instrument,java.logging,java.management,java.naming,java.rmi,java.scripting,java.security.sasl,java.sql,java.transaction.xa,java.xml,jdk.unsupported --output /jlinked
-FROM mcr.microsoft.com/dotnet/runtime:8.0-alpine3.18
+FROM mcr.microsoft.com/dotnet/runtime:8.0-alpine3.22
ARG VERSION
ARG POSTGRES_DRIVER_VERSION=42.7.5
@@ -47,7 +47,7 @@ RUN apk update
apk del .build-deps
### remove any suid sgid - we don't need them
-RUN find / -perm +6000 -type f -exec chmod a-s {} \;
+RUN find / -path /proc -prune -perm +6000 -type f -exec chmod a-s {} \;
USER ${UID}
VOLUME ["/src", "/report"]
diff --git a/README.md b/README.md
index 7f8bf13bc48..50a2edfec1a 100644
--- a/README.md
+++ b/README.md
@@ -175,7 +175,7 @@ For instructions on the use of the Ant Task, please see the [dependency-check-an
For installation to pass, you must have the following components installed:
* Java: `java -version` 11.0
-* Maven: `mvn -version` 3.5.0 and higher
+* Maven: `mvn -version` 3.6.3 and higher
Tests cases require:
* dotnet core version 8.0
@@ -341,7 +341,7 @@ Building the documentation
The documentation on the [github pages](https://dependency-check.github.io/DependencyCheck/) is generated from this repository:
- mvn -s settings.xml site site:staging
+ mvn -s settings.xml site site:stage
Once done, point your browser to `./target/staging/index.html`.
@@ -363,7 +363,9 @@ Dependency-Check makes use of several other open source libraries. Please see th
This product uses the NVD API but is not endorsed or certified by the NVD.
-Copyright (c) 2012-2024 Jeremy Long. All Rights Reserved.
+Copyright (c) 2012-2025 Jeremy Long. All Rights Reserved.
[wiki]: https://github.com/dependency-check/DependencyCheck/wiki
[notices]: https://github.com/dependency-check/DependencyCheck/blob/main/NOTICE.txt
+
+
diff --git a/SECURITY.md b/SECURITY.md
index ec0093618a1..08e36f7633f 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -3,9 +3,9 @@
## Supported Versions
| Version | Supported |
-| ----------|--------------------|
-| 10.0.2+ | :white_check_mark: |
-| <= 10.0.1 | :x: |
+|-----------|--------------------|
+| 12.1.3+ | :white_check_mark: |
+| <= 12.1.2 | :x: |
## Reporting a Vulnerability
diff --git a/ant/README.md b/ant/README.md
index 6d7f2fe67f7..3338cd1f12d 100644
--- a/ant/README.md
+++ b/ant/README.md
@@ -17,3 +17,5 @@ Dependency-Check is Copyright (c) 2012-2014 Jeremy Long. All Rights Reserved.
Permission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the [LICENSE.txt](https://github.com/dependency-check/DependencyCheck/blob/main/LICENSE.txt) file for the full license.
Dependency-Check-Ant makes use of other open source libraries. Please see the [NOTICE.txt](https://github.com/dependency-check/DependencyCheck/blob/main/ant/NOTICE.txt) file for more information.
+
+
\ No newline at end of file
diff --git a/ant/pom.xml b/ant/pom.xml
index 87ee99d07b2..46436bd8888 100644
--- a/ant/pom.xml
+++ b/ant/pom.xml
@@ -20,7 +20,7 @@ Copyright (c) 2013 - Jeremy Long. All Rights Reserved.
org.owasp
dependency-check-parent
- 12.1.1
+ 12.1.8
dependency-check-ant
@@ -32,7 +32,7 @@ Copyright (c) 2013 - Jeremy Long. All Rights Reserved.
scm:git:https://github.com/dependency-check/DependencyCheck.git
https://github.com/dependency-check/DependencyCheck/tree/main/ant
scm:git:git@github.com/dependency-check/DependencyCheck.git
- v12.1.1
+ v12.1.8
diff --git a/ant/src/site/markdown/config-purge.md b/ant/src/site/markdown/config-purge.md
index 728fe248d54..e048190e5bb 100644
--- a/ant/src/site/markdown/config-purge.md
+++ b/ant/src/site/markdown/config-purge.md
@@ -14,8 +14,8 @@ Configuration: dependency-check-purge Task
--------------------
The following properties can be set on the dependency-check-purge task.
- Property | Description | Default Value
----------------|----------------------------------------------------------------------------|--------------------------------------------------
- dataDirectory | Data directory that is used to store the local caches and NVD CVE database | `/data/11.0`
- failOnError | Whether the build should fail if there is an error executing the purge | true
+| Property | Description | Default Value |
+|---------------|----------------------------------------------------------------------------|--------------------------------------------------|
+| dataDirectory | Data directory that is used to store the local caches and NVD CVE database | `/data/11.0` |
+| failOnError | Whether the build should fail if there is an error executing the purge | true |
diff --git a/ant/src/site/markdown/config-update.md b/ant/src/site/markdown/config-update.md
index 08a67f39761..9d86a179987 100644
--- a/ant/src/site/markdown/config-update.md
+++ b/ant/src/site/markdown/config-update.md
@@ -17,54 +17,54 @@ Configuration: dependency-check-update Task
--------------------
The following properties can be set on the dependency-check-update task.
- Property | Description | Default Value
--------------------------|------------------------------------------------------------------------------------------------|--------------------------------------------------
- dataDirectory | Data directory that is used to store the local caches and NVD CVE database | `/data/11.0`
- failOnError | Whether the build should fail if there is an error executing the update | true
- proxyServer | The Proxy Server; see the [proxy configuration](../data/proxy.html) page for more information. |
- proxyPort | The Proxy Port. |
- proxyUsername | Defines the proxy user name. |
- proxyPassword | Defines the proxy password. |
- nonProxyHosts | Defines the hosts that will not be proxied. |
- connectionTimeout | The URL Connection Timeout (in milliseconds). | 10000
- readtimeout | The URL Read Timeout (in milliseconds). | 60000
- retireJsAnalyzerEnabled | Sets whether the RetireJS Analyzer update and analyzer are enabled. | true
+| Property | Description | Default Value |
+|-------------------------|------------------------------------------------------------------------------------------------|--------------------------------------------------|
+| dataDirectory | Data directory that is used to store the local caches and NVD CVE database | `/data/11.0` |
+| failOnError | Whether the build should fail if there is an error executing the update | true |
+| proxyServer | The Proxy Server; see the [proxy configuration](../data/proxy.html) page for more information. | |
+| proxyPort | The Proxy Port. | |
+| proxyUsername | Defines the proxy user name. | |
+| proxyPassword | Defines the proxy password. | |
+| nonProxyHosts | Defines the hosts that will not be proxied. | |
+| connectionTimeout | The URL Connection Timeout (in milliseconds). | 10000 |
+| readtimeout | The URL Read Timeout (in milliseconds). | 60000 |
+| retireJsAnalyzerEnabled | Sets whether the RetireJS Analyzer update and analyzer are enabled. | true |
Advanced Configuration
====================
The following properties can be configured in the plugin. However, they are less frequently changed.
- Property | Description | Default Value
----------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------
- nvdApiKey | The API Key to access the NVD API; obtained from https://nvd.nist.gov/developers/request-an-api-key |
- nvdApiEndpoint | The NVD API endpoint URL; setting this is uncommon. | https://services.nvd.nist.gov/rest/json/cves/2.0
- nvdMaxRetryCount | The maximum number of retry requests for a single call to the NVD API. | 10
- nvdApiDelay | The number of milliseconds to wait between calls to the NVD API. | 3500 with an NVD API Key or 8000 without an API Key
- nvdApiResultsPerPage | The number records for a single page from NVD API (must be <=2000). | 2000
- nvdDatafeedUrl | The URL for the NVD API Data feed that can be generated using https://github.com/jeremylong/Open-Vulnerability-Project/tree/main/vulnz#caching-the-nvd-cve-data - example value `https://internal.server/cache/nvdcve-{0}.json.gz` |
- nvdUser | Credentials used for basic authentication for the NVD API Data feed. |
- nvdPassword | Credentials used for basic authentication for the NVD API Data feed. |
- nvdValidForHours | The number of hours to wait before checking for new updates from the NVD. The default is 4 hours. | 4
- databaseDriverName | The database driver full classname; note, only needs to be set if the driver is not JDBC4 compliant or the JAR is outside of the class path. |
- databaseDriverPath | The path to the database driver JAR file; only needs to be set if the driver is not in the class path. |
- connectionString | The connection string used to connect to the database. See using a [database server](../data/database.html). |
- databaseUser | The username used when connecting to the database. |
- databasePassword | The password used when connecting to the database. |
- hostedSuppressionsEnabled | Whether the hosted suppression file will be used. | true
- hostedSuppressionsUrl | The URL to a mirrored copy of the hosted suppressions file for internet-constrained environments | https://dependency-check.github.io/DependencyCheck/suppressions/publishedSuppressions.xml
- hostedSuppressionsUser | The user for a Basic-auth-protected mirrored copy of the hosted suppressions file for internet-constrained environments |
- hostedSuppressionsPassword | The password/token for a Basic-auth-protected mirrored copy of the hosted suppressions file for internet-constrained environments |
- hostedSuppressionsBearerToken | The bearer token for a Bearer-auth-protected mirrored copy of the hosted suppressions file for internet-constrained environments |
- hostedSuppressionsValidForHours | Sets the number of hours to wait before checking for new updates of the hosted suppressions file | 2
- hostedSuppressionsForceUpdate | Sets whether the hosted suppressions file should update regardless of the `autoupdate` and validForHours settings | false
- retireJsForceUpdate | Sets whether the RetireJS repository should update regardless of the `autoupdate` setting. | false
- retireJsUrl | The URL to a mirrored copy of the RetireJS repository for internet-constrained environments | https://raw.githubusercontent.com/Retirejs/retire.js/main/repository/jsrepository.json
- retireJsUrlUser | The user for a Basic-auth-protected mirrored copy of the RetireJS repository for internet-constrained environments |
- retireJsUrlPassword | The password/token for a Basic-auth-protected mirrored copy of the RetireJS repository for internet-constrained environments |
- retireJsUrlBearerToken | The bearer token for a Bearer-auth-protected mirrored copy of the RetireJS repository for internet-constrained environments |
- knownExploitedEnabled | Sets whether the Known Exploited Vulnerability update and analyzer are enabled. | true
- knownExploitedUrl | Sets URL to the CISA Known Exploited Vulnerabilities JSON data feed. | https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
- knownExploitedUser | The user for a Basic-auth-protected mirrored copy of the CISA Known Exploited Vulnerabilities JSON data feed for internet-constrained environments |
- knownExploitedPassword | The password/token for a Basic-auth-protected mirrored copy of the CISA Known Exploited Vulnerabilities JSON data feed for internet-constrained environments |
- knownExploitedBearerToken | The bearer token for a Bearer-auth-protected mirrored copy of the CISA Known Exploited Vulnerabilities JSON data feed for internet-constrained environments |
- knownExploitedValidForHours | Sets the number of hours to wait before checking for new updates of the CISA Known Exploited Vulnerabilities JSON data feed | 24
+| Property | Description | Default Value |
+|---------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------|
+| nvdApiKey | The API Key to access the NVD API; obtained from https://nvd.nist.gov/developers/request-an-api-key | |
+| nvdApiEndpoint | The NVD API endpoint URL; setting this is uncommon. | https://services.nvd.nist.gov/rest/json/cves/2.0 |
+| nvdMaxRetryCount | The maximum number of retry requests for a single call to the NVD API. | 10 |
+| nvdApiDelay | The number of milliseconds to wait between calls to the NVD API. | 3500 with an NVD API Key or 8000 without an API Key |
+| nvdApiResultsPerPage | The number records for a single page from NVD API (must be <=2000). | 2000 |
+| nvdDatafeedUrl | The URL for the NVD API Data feed that can be generated using https://github.com/jeremylong/open-vulnerability-cli/blob/main/README.md#mirroring-the-nvd-cve-data - example value `https://internal.server/cache/nvdcve-{0}.json.gz` | |
+| nvdUser | Credentials used for basic authentication for the NVD API Data feed. | |
+| nvdPassword | Credentials used for basic authentication for the NVD API Data feed. | |
+| nvdValidForHours | The number of hours to wait before checking for new updates from the NVD. The default is 4 hours. | 4 |
+| databaseDriverName | The database driver full classname; note, only needs to be set if the driver is not JDBC4 compliant or the JAR is outside of the class path. | |
+| databaseDriverPath | The path to the database driver JAR file; only needs to be set if the driver is not in the class path. | |
+| connectionString | The connection string used to connect to the database. See using a [database server](../data/database.html). | |
+| databaseUser | The username used when connecting to the database. | |
+| databasePassword | The password used when connecting to the database. | |
+| hostedSuppressionsEnabled | Whether the hosted suppression file will be used. | true |
+| hostedSuppressionsUrl | The URL to a mirrored copy of the hosted suppressions file for internet-constrained environments | https://dependency-check.github.io/DependencyCheck/suppressions/publishedSuppressions.xml |
+| hostedSuppressionsUser | The user for a Basic-auth-protected mirrored copy of the hosted suppressions file for internet-constrained environments | |
+| hostedSuppressionsPassword | The password/token for a Basic-auth-protected mirrored copy of the hosted suppressions file for internet-constrained environments | |
+| hostedSuppressionsBearerToken | The bearer token for a Bearer-auth-protected mirrored copy of the hosted suppressions file for internet-constrained environments | |
+| hostedSuppressionsValidForHours | Sets the number of hours to wait before checking for new updates of the hosted suppressions file | 2 |
+| hostedSuppressionsForceUpdate | Sets whether the hosted suppressions file should update regardless of the `autoupdate` and validForHours settings | false |
+| retireJsForceUpdate | Sets whether the RetireJS repository should update regardless of the `autoupdate` setting. | false |
+| retireJsUrl | The URL to a mirrored copy of the RetireJS repository for internet-constrained environments | https://raw.githubusercontent.com/Retirejs/retire.js/main/repository/jsrepository.json |
+| retireJsUrlUser | The user for a Basic-auth-protected mirrored copy of the RetireJS repository for internet-constrained environments | |
+| retireJsUrlPassword | The password/token for a Basic-auth-protected mirrored copy of the RetireJS repository for internet-constrained environments | |
+| retireJsUrlBearerToken | The bearer token for a Bearer-auth-protected mirrored copy of the RetireJS repository for internet-constrained environments | |
+| knownExploitedEnabled | Sets whether the Known Exploited Vulnerability update and analyzer are enabled. | true |
+| knownExploitedUrl | Sets URL to the CISA Known Exploited Vulnerabilities JSON data feed. | https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json |
+| knownExploitedUser | The user for a Basic-auth-protected mirrored copy of the CISA Known Exploited Vulnerabilities JSON data feed for internet-constrained environments | |
+| knownExploitedPassword | The password/token for a Basic-auth-protected mirrored copy of the CISA Known Exploited Vulnerabilities JSON data feed for internet-constrained environments | |
+| knownExploitedBearerToken | The bearer token for a Bearer-auth-protected mirrored copy of the CISA Known Exploited Vulnerabilities JSON data feed for internet-constrained environments | |
+| knownExploitedValidForHours | Sets the number of hours to wait before checking for new updates of the CISA Known Exploited Vulnerabilities JSON data feed | 24 |
diff --git a/ant/src/site/markdown/configuration.md b/ant/src/site/markdown/configuration.md
index 7907177320c..2eeb1a5b566 100644
--- a/ant/src/site/markdown/configuration.md
+++ b/ant/src/site/markdown/configuration.md
@@ -34,37 +34,37 @@ Configuration: dependency-check Task
--------------------
The following properties can be set on the dependency-check task.
- Property | Description | Default Value
-----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------
- autoUpdate | Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to false. | true
- failBuildOnCVSS | Specifies if the build should be failed if a CVSS score equal to or above a specified level is identified. The default is 11 which means since the CVSS scores are 0-10, by default the build will never fail. More information on CVSS scores can be found at the [NVD](https://nvd.nist.gov/vuln-metrics/cvss) | 11
- junitFailOnCVSS | If using the JUNIT report format the junitFailOnCVSS sets the CVSS score threshold that is considered a failure. | 0
- prettyPrint | Whether the XML and JSON formatted reports should be pretty printed. | false
- projectName | The name of the project being scanned. | Dependency-Check
- reportFormat | The report format to be generated (HTML, XML, CSV, JSON, JUNIT, SARIF, JENKINS, GITLAB, ALL). | HTML
- reportOutputDirectory | The location to write the report(s). Note, this is not used if generating the report as part of a `mvn site` build | 'target'
- hintsFile | The file path to the XML hints file \- used to resolve [false negatives](../general/hints.html) |
- dataDirectory | Data directory that is used to store the local caches and NVD CVE database | `/data/11.0`
- failOnError | Whether the build should fail if there is an error executing the dependency-check analysis | true
- proxyServer | The Proxy Server; see the [proxy configuration](../data/proxy.html) page for more information. |
- proxyPort | The Proxy Port. |
- proxyUsername | Defines the proxy user name. |
- proxyPassword | Defines the proxy password. |
- nonProxyHosts | Defines the hosts that will not be proxied. |
- connectionTimeout | The URL Connection Timeout (in milliseconds). | 10000
- readtimeout | The URL Read Timeout (in milliseconds). | 60000
- enableExperimental | Enable the [experimental analyzers](../analyzers/index.html). If not enabled the experimental analyzers (see below) will not be loaded or used. | false
- enableRetired | Enable the [retired analyzers](../analyzers/index.html). If not enabled the retired analyzers (see below) will not be loaded or used. | false
- suppressionFile | The file path to the XML suppression file \- used to suppress [false positives](../general/suppression.html). The parameter value can be a local file path, a URL to a suppression file, or even a reference to a file on the class path (see https://github.com/dependency-check/DependencyCheck/issues/1878#issuecomment-487533799) |
- failBuildOnUnusedSuppressionRule | Specifies that if any unused suppression rule is found, the build will fail. | false
- junitFailOnCVSS | If using the JUNIT report format the junitFailOnCVSS sets the CVSS score threshold that is considered a failure. | 0
+| Property | Description | Default Value |
+|----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|
+| autoUpdate | Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to false. | true |
+| failBuildOnCVSS | Specifies if the build should be failed if a CVSS score equal to or above a specified level is identified. The default is 11 which means since the CVSS scores are 0-10, by default the build will never fail. More information on CVSS scores can be found at the [NVD](https://nvd.nist.gov/vuln-metrics/cvss) | 11 |
+| junitFailOnCVSS | If using the JUNIT report format the junitFailOnCVSS sets the CVSS score threshold that is considered a failure. | 0 |
+| prettyPrint | Whether the XML and JSON formatted reports should be pretty printed. | false |
+| projectName | The name of the project being scanned. | Dependency-Check |
+| reportFormat | The report format to be generated (HTML, XML, CSV, JSON, JUNIT, SARIF, JENKINS, GITLAB, ALL). | HTML |
+| reportOutputDirectory | The location to write the report(s). Note, this is not used if generating the report as part of a `mvn site` build | 'target' |
+| hintsFile | The file path to the XML hints file \- used to resolve [false negatives](../general/hints.html) | |
+| dataDirectory | Data directory that is used to store the local caches and NVD CVE database | `/data/11.0` |
+| failOnError | Whether the build should fail if there is an error executing the dependency-check analysis | true |
+| proxyServer | The Proxy Server; see the [proxy configuration](../data/proxy.html) page for more information. | |
+| proxyPort | The Proxy Port. | |
+| proxyUsername | Defines the proxy user name. | |
+| proxyPassword | Defines the proxy password. | |
+| nonProxyHosts | Defines the hosts that will not be proxied. | |
+| connectionTimeout | The URL Connection Timeout (in milliseconds). | 10000 |
+| readtimeout | The URL Read Timeout (in milliseconds). | 60000 |
+| enableExperimental | Enable the [experimental analyzers](../analyzers/index.html). If not enabled the experimental analyzers (see below) will not be loaded or used. | false |
+| enableRetired | Enable the [retired analyzers](../analyzers/index.html). If not enabled the retired analyzers (see below) will not be loaded or used. | false |
+| suppressionFile | The file path to the XML suppression file \- used to suppress [false positives](../general/suppression.html). The parameter value can be a local file path, a URL to a suppression file, or even a reference to a file on the class path (see https://github.com/dependency-check/DependencyCheck/issues/1878#issuecomment-487533799) | |
+| failBuildOnUnusedSuppressionRule | Specifies that if any unused suppression rule is found, the build will fail. | false |
+| junitFailOnCVSS | If using the JUNIT report format the junitFailOnCVSS sets the CVSS score threshold that is considered a failure. | 0 |
The following nested elements can be set on the dependency-check task.
- Element | Property | Description | Default Value
------------------|----------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------
- suppressionFile | path | The file path to the XML suppression file \- used to suppress [false positives](../general/suppression.html). Element can be specified multiple times. The parameter value can be a local file path, a URL to a suppression file, or even a reference to a file on the class path (see https://github.com/dependency-check/DependencyCheck/issues/1878#issuecomment-487533799) | |
- reportFormat | format | The report format to be generated (HTML, XML, CSV, JSON, JUNIT, SARIF, JENKINS, GITLAB, ALL). Element can be specified multiple times. |
+| Element | Property | Description | Default Value |
+|-----------------|----------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
+| suppressionFile | path | The file path to the XML suppression file \- used to suppress [false positives](../general/suppression.html). Element can be specified multiple times. The parameter value can be a local file path, a URL to a suppression file, or even a reference to a file on the class path (see https://github.com/dependency-check/DependencyCheck/issues/1878#issuecomment-487533799) | |
+| reportFormat | format | The report format to be generated (HTML, XML, CSV, JSON, JUNIT, SARIF, JENKINS, GITLAB, ALL). Element can be specified multiple times. | |
Analyzer Configuration
====================
@@ -74,115 +74,115 @@ Note, that specific analyzers will automatically disable themselves if no file
types that they support are detected - so specifically disabling them may not
be needed.
- Property | Description | Default Value
-----------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------
- archiveAnalyzerEnabled | Sets whether the Archive Analyzer will be used. | true
- zipExtensions | A comma-separated list of additional file extensions to be treated like a ZIP file, the contents will be extracted and analyzed. |
- jarAnalyzer | Sets whether the Jar Analyzer will be used. | true
- centralAnalyzerEnabled | Sets whether the Central Analyzer will be used. **Disabling this analyzer for Ant builds is not recommended as it could lead to false negatives (e.g. libraries that have vulnerabilities may not be reported correctly).** If this analyzer is being disabled there is a good chance you also want to disable the Nexus Analyzer (see below). | true
- centralAnalyzerUseCache | Sets whether the Central Analyer will cache results. Cached results expire after 30 days. | true
- dartAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Dart Analyzer will be used. | true
- knownExploitedEnabled | Sets whether the Known Exploited Vulnerability update and analyzer are enabled. | true
- knownExploitedUrl | Sets URL to the CISA Known Exploited Vulnerabilities JSON data feed. | https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
- ossIndexAnalyzerEnabled | Sets whether the [OSS Index Analyzer](../analyzers/oss-index-analyzer.html) will be enabled. This analyzer requires an internet connection. | true
- ossindexAnalyzerUseCache | Sets whether the OSS Index Analyzer will cache results. Cached results expire after 24 hours. | true
- ossindexAnalyzerUsername | Sets the username for OSS Index - note an account with OSS Index is not required. |
- ossindexAnalyzerPassword | Sets the password for OSS Index. |
- ossIndexAnalyzerWarnOnlyOnRemoteErrors | Whether we should only warn about Sonatype OSS Index remote errors instead of failing completely. |
- nexusAnalyzerEnabled | Sets whether Nexus Analyzer will be used (requires Nexus Pro). This analyzer is superceded by the Central Analyzer; however, you can configure this to run against a Nexus Pro installation. | true
- nexusUrl | Defines the Nexus web service endpoint (example http://domain.enterprise/nexus/service/local/). If not set the Nexus Analyzer will be disabled. |
- nexusUser | The username to authenticate to the Nexus Server's web service end point. If not set the Nexus Analyzer will use an unauthenticated connection. |
- nexusPassword | The password to authenticate to the Nexus Server's web service end point. If not set the Nexus Analyzer will use an unauthenticated connection. |
- nexusUsesProxy | Whether the defined proxy should be used when connecting to Nexus. | true
- artifactoryAnalyzerEnabled | Sets whether Artifactory analyzer will be used | false
- artifactoryAnalyzerUrl | The Artifactory server URL. | Â
- artifactoryAnalyzerUseProxy | Whether Artifactory should be accessed through a proxy or not. | false
- artifactoryAnalyzerParallelAnalysis | Whether the Artifactory analyzer should be run in parallel or not | Â true
- artifactoryAnalyzerUsername | The user name (only used with API token) to connect to Artifactory instance |
- artifactoryAnalyzerApiToken | The API token to connect to Artifactory instance, only used if the username or the API key are not defined by artifactoryAnalyzerServerId,artifactoryAnalyzerUsername or artifactoryAnalyzerApiToken |
- artifactoryAnalyzerBearerToken | The bearer token to connect to Artifactory instance |
- pyDistributionAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Python Distribution Analyzer will be used. `enableExperimental` must be set to true. | true
- pyPackageAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Python Package Analyzer will be used. `enableExperimental` must be set to true. | true
- rubygemsAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Ruby Gemspec Analyzer will be used. `enableExperimental` must be set to true. | true
- opensslAnalyzerEnabled | Sets whether the openssl Analyzer should be used. | true
- cmakeAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) CMake Analyzer should be used. `enableExperimental` must be set to true. | true
- autoconfAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) autoconf Analyzer should be used. `enableExperimental` must be set to true. | true
- pipAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) pip Analyzer should be used. `enableExperimental` must be set to true. | true
- pipfileAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Pipfile Analyzer should be used. `enableExperimental` must be set to true. | true
- poetryAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Poetry Analyzer should be used. `enableExperimental` must be set to true. | true
- composerAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) PHP Composer Lock File Analyzer should be used. `enableExperimental` must be set to true. | true
- composerAnalyzerSkipDev | Sets whether the [experimental](../analyzers/index.html) PHP Composer Lock File Analyzer should skip "packages-dev" | false
- cpanfileAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Perl CPAN File Analyzer should be used. `enableExperimental` must be set to true. | true
- nodeAnalyzerEnabled | Sets whether the [retired](../analyzers/index.html) Node.js Analyzer should be used. | true
- nodeAuditAnalyzerEnabled | Sets whether the Node Audit Analyzer should be used. This analyzer requires an internet connection. | true
- nodeAuditAnalyzerUseCache | Sets whether the Node Audit Analyzer will cache results. Cached results expire after 24 hours. | true
- nodeAuditSkipDevDependencies | Sets whether the Node Audit Analyzer will skip devDependencies. | false
- nodePackageSkipDevDependencies | Sets whether the Node Package Analyzer will skip devDependencies. | false
- yarnAuditAnalyzerEnabled | Sets whether the Yarn Audit Analyzer should be used. This analyzer requires yarn and an internet connection. Use `nodeAuditSkipDevDependencies` to skip dev dependencies. | true
- pnpmAuditAnalyzerEnabled | Sets whether the Pnpm Audit Analyzer should be used. This analyzer requires pnpm and an internet connection. Use `nodeAuditSkipDevDependencies` to skip dev dependencies. | true
- pathToYarn | The path to `yarn`. |
- pathToPnpm | The path to `pnpm`. |
- retireJsAnalyzerEnabled | Sets whether the RetireJS Analyzer update and analyzer are enabled. | true
- retirejsFilterNonVulnerable | Configures the RetireJS Analyzer to remove non-vulnerable JS dependencies from the report. | false
- retirejsFilter | A nested configuration that can be specified multple times; The regex defined is used to filter JS files based on content. |
- nuspecAnalyzerEnabled | Sets whether the .NET Nuget Nuspec Analyzer will be used. | true
- nugetconfAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) .NET Nuget packages.config Analyzer will be used. `enableExperimental` must be set to true. | true
- libmanAnalyzerEnabled | Sets whether the Libman Analyzer will be used. | true
- cocoapodsAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Cocoapods Analyzer should be used. `enableExperimental` must be set to true. | true
- carthageAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Carthage Analyzer should be used. `enableExperimental` must be set to true. | true
- mixAuditAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Mix Audit Analyzer should be used. `enableExperimental` must be set to true. | true
- mixAuditPath | Sets the path to the mix_audit executable; only used if mix audit analyzer is enabled and experimental analyzers are enabled. |
- bundleAuditAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Bundle Audit Analyzer should be used. `enableExperimental` must be set to true. | true
- bundleAuditPath | Sets the path to the bundle audit executable; only used if bundle audit analyzer is enabled and experimental analyzers are enabled. |
- swiftPackageManagerAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Swift Package Analyzer should be used. `enableExperimental` must be set to true. | true
- swiftPackageResolvedAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Swift Package Resolved should be used. `enableExperimental` must be set to true. | true
- assemblyAnalyzerEnabled | Sets whether the .NET Assembly Analyzer should be used. | true
- msbuildAnalyzerEnabled | Sets whether the MSBuild Analyzer should be used. | true
- pathToCore | The path to dotnet core .NET assembly analysis on non-windows systems. |
- golangDepEnabled | Sets whether the [experimental](../analyzers/index.html) Golang Dependency Analyzer should be used. `enableExperimental` must be set to true. | true
- golangModEnabled | Sets whether the [experimental](../analyzers/index.html) Goland Module Analyzer should be used; requires `go` to be installed. `enableExperimental` must be set to true. | true
- pathToGo | The path to `go`. |
- versionCheckEnabled | Whether dependency-check should check if a new version of dependency-check-maven exists. | true
+| Property | Description | Default Value |
+|----------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------|
+| archiveAnalyzerEnabled | Sets whether the Archive Analyzer will be used. | true |
+| zipExtensions | A comma-separated list of additional file extensions to be treated like a ZIP file, the contents will be extracted and analyzed. | |
+| jarAnalyzer | Sets whether the Jar Analyzer will be used. | true |
+| centralAnalyzerEnabled | Sets whether the Central Analyzer will be used. **Disabling this analyzer for Ant builds is not recommended as it could lead to false negatives (e.g. libraries that have vulnerabilities may not be reported correctly).** If this analyzer is being disabled there is a good chance you also want to disable the Nexus Analyzer (see below). | true |
+| centralAnalyzerUseCache | Sets whether the Central Analyer will cache results. Cached results expire after 30 days. | true |
+| dartAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Dart Analyzer will be used. | true |
+| knownExploitedEnabled | Sets whether the Known Exploited Vulnerability update and analyzer are enabled. | true |
+| knownExploitedUrl | Sets URL to the CISA Known Exploited Vulnerabilities JSON data feed. | https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json |
+| ossIndexAnalyzerEnabled | Sets whether the [OSS Index Analyzer](../analyzers/oss-index-analyzer.html) will be enabled. This analyzer requires an internet connection. | true |
+| ossindexAnalyzerUseCache | Sets whether the OSS Index Analyzer will cache results. Cached results expire after 24 hours. | true |
+| ossindexAnalyzerUsername | Sets the username for OSS Index - note an account with OSS Index is not required. | |
+| ossindexAnalyzerPassword | Sets the password for OSS Index. | |
+| ossIndexAnalyzerWarnOnlyOnRemoteErrors | Whether we should only warn about Sonatype OSS Index remote errors instead of failing completely. | |
+| nexusAnalyzerEnabled | Sets whether Nexus Analyzer will be used. This analyzer is an alternative to the Central or Artifactory Analyzers, allowing retrieval from Sonatype Nexus installations. | true |
+| nexusUrl | Defines the Nexus web service endpoint (example http://domain.enterprise/nexus/service/local/). If not set the Nexus Analyzer will be disabled. | |
+| nexusUser | The username to authenticate to the Nexus Server's web service end point. If not set the Nexus Analyzer will use an unauthenticated connection. | |
+| nexusPassword | The password to authenticate to the Nexus Server's web service end point. If not set the Nexus Analyzer will use an unauthenticated connection. | |
+| nexusUsesProxy | Whether the defined proxy should be used when connecting to Nexus. | true |
+| artifactoryAnalyzerEnabled | Sets whether Artifactory analyzer will be used | false |
+| artifactoryAnalyzerUrl | The Artifactory server URL. | |
+| artifactoryAnalyzerUseProxy | Whether Artifactory should be accessed through a proxy or not. | false |
+| artifactoryAnalyzerParallelAnalysis | Whether the Artifactory analyzer should be run in parallel or not | true |
+| artifactoryAnalyzerUsername | The user name (only used with API token) to connect to Artifactory instance | |
+| artifactoryAnalyzerApiToken | The API token to connect to Artifactory instance, only used if the username or the API key are not defined by artifactoryAnalyzerServerId,artifactoryAnalyzerUsername or artifactoryAnalyzerApiToken | |
+| artifactoryAnalyzerBearerToken | The bearer token to connect to Artifactory instance | |
+| pyDistributionAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Python Distribution Analyzer will be used. `enableExperimental` must be set to true. | true |
+| pyPackageAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Python Package Analyzer will be used. `enableExperimental` must be set to true. | true |
+| rubygemsAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Ruby Gemspec Analyzer will be used. `enableExperimental` must be set to true. | true |
+| opensslAnalyzerEnabled | Sets whether the openssl Analyzer should be used. | true |
+| cmakeAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) CMake Analyzer should be used. `enableExperimental` must be set to true. | true |
+| autoconfAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) autoconf Analyzer should be used. `enableExperimental` must be set to true. | true |
+| pipAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) pip Analyzer should be used. `enableExperimental` must be set to true. | true |
+| pipfileAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Pipfile Analyzer should be used. `enableExperimental` must be set to true. | true |
+| poetryAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Poetry Analyzer should be used. `enableExperimental` must be set to true. | true |
+| composerAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) PHP Composer Lock File Analyzer should be used. `enableExperimental` must be set to true. | true |
+| composerAnalyzerSkipDev | Sets whether the [experimental](../analyzers/index.html) PHP Composer Lock File Analyzer should skip "packages-dev" | false |
+| cpanfileAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Perl CPAN File Analyzer should be used. `enableExperimental` must be set to true. | true |
+| nodeAnalyzerEnabled | Sets whether the [retired](../analyzers/index.html) Node.js Analyzer should be used. | true |
+| nodeAuditAnalyzerEnabled | Sets whether the Node Audit Analyzer should be used. This analyzer requires an internet connection. | true |
+| nodeAuditAnalyzerUseCache | Sets whether the Node Audit Analyzer will cache results. Cached results expire after 24 hours. | true |
+| nodeAuditSkipDevDependencies | Sets whether the Node Audit Analyzer will skip devDependencies. | false |
+| nodePackageSkipDevDependencies | Sets whether the Node Package Analyzer will skip devDependencies. | false |
+| yarnAuditAnalyzerEnabled | Sets whether the Yarn Audit Analyzer should be used. This analyzer requires yarn and an internet connection. Use `nodeAuditSkipDevDependencies` to skip dev dependencies. | true |
+| pnpmAuditAnalyzerEnabled | Sets whether the Pnpm Audit Analyzer should be used. This analyzer requires pnpm and an internet connection. Use `nodeAuditSkipDevDependencies` to skip dev dependencies. | true |
+| pathToYarn | The path to `yarn`. | |
+| pathToPnpm | The path to `pnpm`. | |
+| retireJsAnalyzerEnabled | Sets whether the RetireJS Analyzer update and analyzer are enabled. | true |
+| retirejsFilterNonVulnerable | Configures the RetireJS Analyzer to remove non-vulnerable JS dependencies from the report. | false |
+| retirejsFilter | A nested configuration that can be specified multple times; The regex defined is used to filter JS files based on content. | |
+| nuspecAnalyzerEnabled | Sets whether the .NET Nuget Nuspec Analyzer will be used. | true |
+| nugetconfAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) .NET Nuget packages.config Analyzer will be used. `enableExperimental` must be set to true. | true |
+| libmanAnalyzerEnabled | Sets whether the Libman Analyzer will be used. | true |
+| cocoapodsAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Cocoapods Analyzer should be used. `enableExperimental` must be set to true. | true |
+| carthageAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Carthage Analyzer should be used. `enableExperimental` must be set to true. | true |
+| mixAuditAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Mix Audit Analyzer should be used. `enableExperimental` must be set to true. | true |
+| mixAuditPath | Sets the path to the mix_audit executable; only used if mix audit analyzer is enabled and experimental analyzers are enabled. | |
+| bundleAuditAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Bundle Audit Analyzer should be used. `enableExperimental` must be set to true. | true |
+| bundleAuditPath | Sets the path to the bundle audit executable; only used if bundle audit analyzer is enabled and experimental analyzers are enabled. | |
+| swiftPackageManagerAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Swift Package Analyzer should be used. `enableExperimental` must be set to true. | true |
+| swiftPackageResolvedAnalyzerEnabled | Sets whether the [experimental](../analyzers/index.html) Swift Package Resolved should be used. `enableExperimental` must be set to true. | true |
+| assemblyAnalyzerEnabled | Sets whether the .NET Assembly Analyzer should be used. | true |
+| msbuildAnalyzerEnabled | Sets whether the MSBuild Analyzer should be used. | true |
+| pathToCore | The path to dotnet core .NET assembly analysis on non-windows systems. | |
+| golangDepEnabled | Sets whether the [experimental](../analyzers/index.html) Golang Dependency Analyzer should be used. `enableExperimental` must be set to true. | true |
+| golangModEnabled | Sets whether the [experimental](../analyzers/index.html) Goland Module Analyzer should be used; requires `go` to be installed. `enableExperimental` must be set to true. | true |
+| pathToGo | The path to `go`. | |
+| versionCheckEnabled | Whether dependency-check should check if a new version of dependency-check-maven exists. | true |
Advanced Configuration
====================
The following properties can be configured in the plugin. However, they are less frequently changed.
- Property | Description | Default Value
----------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------
- nvdApiKey | The API Key to access the NVD API; obtained from https://nvd.nist.gov/developers/request-an-api-key |
- nvdApiEndpoint | The NVD API endpoint URL; setting this is uncommon. | https://services.nvd.nist.gov/rest/json/cves/2.0
- nvdMaxRetryCount | The maximum number of retry requests for a single call to the NVD API. | 10
- nvdApiDelay | The number of milliseconds to wait between calls to the NVD API. | 3500 with an NVD API Key or 8000 without an API Key
- nvdApiResultsPerPage | The number records for a single page from NVD API (must be <=2000). | 2000
- nvdDatafeedUrl | The URL for the NVD API Data feed that can be generated using https://github.com/jeremylong/Open-Vulnerability-Project/tree/main/vulnz#caching-the-nvd-cve-data - example value `https://internal.server/cache/nvdcve-{0}.json.gz` |
- nvdUser | Credentials used for basic authentication for the NVD API Data feed. |
- nvdPassword | Credentials used for basic authentication for the NVD API Data feed. |
- nvdValidForHours | The number of hours to wait before checking for new updates from the NVD. The default is 4 hours. | 4
- databaseDriverName | The database driver full classname; note, only needs to be set if the driver is not JDBC4 compliant or the JAR is outside of the class path. |
- databaseDriverPath | The path to the database driver JAR file; only needs to be set if the driver is not in the class path. |
- connectionString | The connection string used to connect to the database. See using a [database server](../data/database.html). |
- databaseUser | The username used when connecting to the database. |
- databasePassword | The password used when connecting to the database. |
- hostedSuppressionsEnabled | Whether the hosted suppression file will be used. | true
- hostedSuppressionsUrl | The URL to a mirrored copy of the hosted suppressions file for internet-constrained environments | https://dependency-check.github.io/DependencyCheck/suppressions/publishedSuppressions.xml
- hostedSuppressionsUser | The user for a Basic-auth-protected mirrored copy of the hosted suppressions file for internet-constrained environments |
- hostedSuppressionsPassword | The password/token for a Basic-auth-protected mirrored copy of the hosted suppressions file for internet-constrained environments |
- hostedSuppressionsBearerToken | The bearer token for a Bearer-auth-protected mirrored copy of the hosted suppressions file for internet-constrained environments |
- hostedSuppressionsValidForHours | Sets the number of hours to wait before checking for new updates of the hosted suppressions file | 2
- hostedSuppressionsForceUpdate | Sets whether the hosted suppressions file should update regardless of the `autoupdate` and validForHours settings | false
- retireJsForceUpdate | Sets whether the RetireJS repository should update regardless of the `autoupdate` setting. | false
- retireJsUrl | The URL to a mirrored copy of the RetireJS repository for internet-constrained environments | https://raw.githubusercontent.com/Retirejs/retire.js/main/repository/jsrepository.json
- retireJsUrlUser | The user for a Basic-auth-protected mirrored copy of the RetireJS repository for internet-constrained environments |
- retireJsUrlPassword | The password/token for a Basic-auth-protected mirrored copy of the RetireJS repository for internet-constrained environments |
- retireJsUrlBearerToken | The bearer token for a Bearer-auth-protected mirrored copy of the RetireJS repository for internet-constrained environments |
- suppressionFileUser | The user for Basic-auth-protected suppression files hosted on a webserver |
- suppressionFilePassword | The password/token for Basic-auth-protected suppression files hosted on a webserver |
- suppressionFileBearerToken | The bearer token for Bearer-auth-protected suppression files hosted on a webserver |
- knownExploitedEnabled | Sets whether the Known Exploited Vulnerability update and analyzer are enabled. | true
- knownExploitedUrl | Sets URL to the CISA Known Exploited Vulnerabilities JSON data feed. | https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
- knownExploitedUser | The user for a Basic-auth-protected mirrored copy of the CISA Known Exploited Vulnerabilities JSON data feed for internet-constrained environments |
- knownExploitedPassword | The password/token for a Basic-auth-protected mirrored copy of the CISA Known Exploited Vulnerabilities JSON data feed for internet-constrained environments |
- knownExploitedBearerToken | The bearer token for a Bearer-auth-protected mirrored copy of the CISA Known Exploited Vulnerabilities JSON data feed for internet-constrained environments |
- knownExploitedValidForHours | Sets the number of hours to wait before checking for new updates of the CISA Known Exploited Vulnerabilities JSON data feed | 24
+| Property | Description | Default Value |
+|---------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------|
+| nvdApiKey | The API Key to access the NVD API; obtained from https://nvd.nist.gov/developers/request-an-api-key | |
+| nvdApiEndpoint | The NVD API endpoint URL; setting this is uncommon. | https://services.nvd.nist.gov/rest/json/cves/2.0 |
+| nvdMaxRetryCount | The maximum number of retry requests for a single call to the NVD API. | 10 |
+| nvdApiDelay | The number of milliseconds to wait between calls to the NVD API. | 3500 with an NVD API Key or 8000 without an API Key |
+| nvdApiResultsPerPage | The number records for a single page from NVD API (must be <=2000). | 2000 |
+| nvdDatafeedUrl | The URL for the NVD API Data feed that can be generated using https://github.com/jeremylong/open-vulnerability-cli/blob/main/README.md#mirroring-the-nvd-cve-data - example value `https://internal.server/cache/nvdcve-{0}.json.gz` | |
+| nvdUser | Credentials used for basic authentication for the NVD API Data feed. | |
+| nvdPassword | Credentials used for basic authentication for the NVD API Data feed. | |
+| nvdValidForHours | The number of hours to wait before checking for new updates from the NVD. The default is 4 hours. | 4 |
+| databaseDriverName | The database driver full classname; note, only needs to be set if the driver is not JDBC4 compliant or the JAR is outside of the class path. | |
+| databaseDriverPath | The path to the database driver JAR file; only needs to be set if the driver is not in the class path. | |
+| connectionString | The connection string used to connect to the database. See using a [database server](../data/database.html). | |
+| databaseUser | The username used when connecting to the database. | |
+| databasePassword | The password used when connecting to the database. | |
+| hostedSuppressionsEnabled | Whether the hosted suppression file will be used. | true |
+| hostedSuppressionsUrl | The URL to a mirrored copy of the hosted suppressions file for internet-constrained environments | https://dependency-check.github.io/DependencyCheck/suppressions/publishedSuppressions.xml |
+| hostedSuppressionsUser | The user for a Basic-auth-protected mirrored copy of the hosted suppressions file for internet-constrained environments | |
+| hostedSuppressionsPassword | The password/token for a Basic-auth-protected mirrored copy of the hosted suppressions file for internet-constrained environments | |
+| hostedSuppressionsBearerToken | The bearer token for a Bearer-auth-protected mirrored copy of the hosted suppressions file for internet-constrained environments | |
+| hostedSuppressionsValidForHours | Sets the number of hours to wait before checking for new updates of the hosted suppressions file | 2 |
+| hostedSuppressionsForceUpdate | Sets whether the hosted suppressions file should update regardless of the `autoupdate` and validForHours settings | false |
+| retireJsForceUpdate | Sets whether the RetireJS repository should update regardless of the `autoupdate` setting. | false |
+| retireJsUrl | The URL to a mirrored copy of the RetireJS repository for internet-constrained environments | https://raw.githubusercontent.com/Retirejs/retire.js/main/repository/jsrepository.json |
+| retireJsUrlUser | The user for a Basic-auth-protected mirrored copy of the RetireJS repository for internet-constrained environments | |
+| retireJsUrlPassword | The password/token for a Basic-auth-protected mirrored copy of the RetireJS repository for internet-constrained environments | |
+| retireJsUrlBearerToken | The bearer token for a Bearer-auth-protected mirrored copy of the RetireJS repository for internet-constrained environments | |
+| suppressionFileUser | The user for Basic-auth-protected suppression files hosted on a webserver | |
+| suppressionFilePassword | The password/token for Basic-auth-protected suppression files hosted on a webserver | |
+| suppressionFileBearerToken | The bearer token for Bearer-auth-protected suppression files hosted on a webserver | |
+| knownExploitedEnabled | Sets whether the Known Exploited Vulnerability update and analyzer are enabled. | true |
+| knownExploitedUrl | Sets URL to the CISA Known Exploited Vulnerabilities JSON data feed. | https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json |
+| knownExploitedUser | The user for a Basic-auth-protected mirrored copy of the CISA Known Exploited Vulnerabilities JSON data feed for internet-constrained environments | |
+| knownExploitedPassword | The password/token for a Basic-auth-protected mirrored copy of the CISA Known Exploited Vulnerabilities JSON data feed for internet-constrained environments | |
+| knownExploitedBearerToken | The bearer token for a Bearer-auth-protected mirrored copy of the CISA Known Exploited Vulnerabilities JSON data feed for internet-constrained environments | |
+| knownExploitedValidForHours | Sets the number of hours to wait before checking for new updates of the CISA Known Exploited Vulnerabilities JSON data feed | 24 |
\ No newline at end of file
diff --git a/ant/src/site/markdown/index.md.vm b/ant/src/site/markdown/index.md.vm
index 5a7f9a44526..77f85c1bd90 100644
--- a/ant/src/site/markdown/index.md.vm
+++ b/ant/src/site/markdown/index.md.vm
@@ -35,7 +35,10 @@ Installation
It is important to understand that the first time this task is executed it may
take 10 minutes or more as it downloads and processes the data from the National
-Vulnerability Database (NVD) hosted by NIST: https://nvd.nist.gov
+Vulnerability Database (NVD) hosted by NIST: https://nvd.nist.gov.
After the first batch download, as long as the task is executed at least once every
seven days the update will only take a few seconds.
+
+The Dependency-Check team strongly recommends to [mirror the NVD database](../data/mirrornvd.html) for any operational
+integration. If not done, any service disruption of the NVD database will make the usage of Dependency-Check difficult.
diff --git a/ant/src/site/site.xml b/ant/src/site/site.xml
index b0ac38e0f38..797f326f273 100644
--- a/ant/src/site/site.xml
+++ b/ant/src/site/site.xml
@@ -31,5 +31,6 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved.
\ No newline at end of file
diff --git a/ant/src/test/java/org/owasp/dependencycheck/taskdefs/DependencyCheckTaskIT.java b/ant/src/test/java/org/owasp/dependencycheck/taskdefs/DependencyCheckTaskIT.java
index a020d72092e..67b23f4819f 100644
--- a/ant/src/test/java/org/owasp/dependencycheck/taskdefs/DependencyCheckTaskIT.java
+++ b/ant/src/test/java/org/owasp/dependencycheck/taskdefs/DependencyCheckTaskIT.java
@@ -17,29 +17,28 @@
*/
package org.owasp.dependencycheck.taskdefs;
-import java.io.File;
-
import org.apache.tools.ant.BuildException;
import org.apache.tools.ant.BuildFileRule;
import org.apache.tools.ant.types.LogLevel;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Rule;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
import org.owasp.dependencycheck.BaseDBTestCase;
-import static org.junit.Assert.assertTrue;
+import java.io.File;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
/**
*
* @author Jeremy Long
*/
-public class DependencyCheckTaskIT extends BaseDBTestCase {
+class DependencyCheckTaskIT extends BaseDBTestCase {
- @Rule
- public final BuildFileRule buildFileRule = new BuildFileRule();
+ private final BuildFileRule buildFileRule = new BuildFileRule();
- @Before
+ @BeforeEach
@Override
public void setUp() throws Exception {
super.setUp();
@@ -47,17 +46,28 @@ public void setUp() throws Exception {
buildFileRule.configureProject(buildFile, LogLevel.VERBOSE.getLevel());
}
+ @AfterEach
+ @Override
+ public void tearDown() throws Exception {
+ if (buildFileRule.getProject() != null) {
+ if (this.buildFileRule.getProject().getTargets().containsKey("tearDown")) {
+ this.buildFileRule.getProject().executeTarget("tearDown");
+ }
+ }
+ super.tearDown();
+ }
+
/**
* Test of addFileSet method, of class DependencyCheckTask.
*/
@Test
- public void testAddFileSet() throws Exception {
+ void testAddFileSet() throws Exception {
File report = new File("target/dependency-check-report.html");
if (report.exists() && !report.delete()) {
throw new Exception("Unable to delete 'target/dependency-check-report.html' prior to test.");
}
buildFileRule.executeTarget("test.fileset");
- assertTrue("DependencyCheck report was not generated", report.exists());
+ assertTrue(report.exists(), "DependencyCheck report was not generated");
}
/**
@@ -66,7 +76,7 @@ public void testAddFileSet() throws Exception {
* @throws Exception
*/
@Test
- public void testAddFileList() throws Exception {
+ void testAddFileList() throws Exception {
File report = new File("target/dependency-check-report.xml");
if (report.exists()) {
if (!report.delete()) {
@@ -75,7 +85,7 @@ public void testAddFileList() throws Exception {
}
buildFileRule.executeTarget("test.filelist");
- assertTrue("DependencyCheck report was not generated", report.exists());
+ assertTrue(report.exists(), "DependencyCheck report was not generated");
}
/**
@@ -84,7 +94,7 @@ public void testAddFileList() throws Exception {
* @throws Exception
*/
@Test
- public void testAddDirSet() throws Exception {
+ void testAddDirSet() throws Exception {
File report = new File("target/dependency-check-report.csv");
if (report.exists()) {
if (!report.delete()) {
@@ -92,11 +102,11 @@ public void testAddDirSet() throws Exception {
}
}
buildFileRule.executeTarget("test.dirset");
- assertTrue("DependencyCheck report was not generated", report.exists());
+ assertTrue(report.exists(), "DependencyCheck report was not generated");
}
@Test
- public void testNestedReportFormat() throws Exception {
+ void testNestedReportFormat() throws Exception {
File reportHTML = new File("target/dependency-check-report.html");
File reportCSV = new File("target/dependency-check-report.csv");
if (reportCSV.exists()) {
@@ -110,38 +120,37 @@ public void testNestedReportFormat() throws Exception {
}
}
buildFileRule.executeTarget("test.formatNested");
- assertTrue("DependencyCheck CSV report was not generated", reportCSV.exists());
- assertTrue("DependencyCheck HTML report was not generated", reportHTML.exists());
+ assertTrue(reportCSV.exists(), "DependencyCheck CSV report was not generated");
+ assertTrue(reportHTML.exists(), "DependencyCheck HTML report was not generated");
}
@Test
- public void testNestedBADReportFormat() throws Exception {
- try {
- buildFileRule.executeTarget("test.formatBADNested");
- Assert.fail("Should have had a buildExceotion for a bad format attribute");
- } catch (BuildException e) {
- assertTrue("Message did not have BAD, unexpected exception: " + e.getMessage(), e.getMessage().contains("BAD is not a legal value for this attribute"));
- }
+ void testNestedBADReportFormat() {
+ BuildException e = assertThrows(BuildException.class,
+ () -> buildFileRule.executeTarget("test.formatBADNested"),
+ "Should have had a buildException for a bad format attribute");
+ assertTrue(e.getMessage().contains("BAD is not a legal value for this attribute"),
+ "Message did not have BAD, unexpected exception: " + e.getMessage());
}
/**
* Test of getFailBuildOnCVSS method, of class DependencyCheckTask.
*/
@Test
- public void testGetFailBuildOnCVSS() {
- Exception exception = Assert.assertThrows(BuildException.class, () -> buildFileRule.executeTarget("failCVSS"));
+ void testGetFailBuildOnCVSS() {
+ Exception exception = assertThrows(BuildException.class, () -> buildFileRule.executeTarget("failCVSS"));
String expectedMessage = String.format("One or more dependencies were identified with vulnerabilities that "
+ "have a CVSS score greater than or equal to '%.1f':", 3.0f);
- Assert.assertTrue(exception.getMessage().contains(expectedMessage));
+ assertTrue(exception.getMessage().contains(expectedMessage));
}
/**
* Test the DependencyCheckTask where a CVE is suppressed.
*/
@Test
- public void testSuppressingCVE() {
+ void testSuppressingCVE() {
// GIVEN an ant task with a vulnerability
final String antTaskName = "suppression";
@@ -157,7 +166,7 @@ public void testSuppressingCVE() {
// THEN the ant task executed without error
final File report = new File("target/suppression-report.html");
- assertTrue("Expected the DependencyCheck report to be generated", report.exists());
+ assertTrue(report.exists(), "Expected the DependencyCheck report to be generated");
}
/**
@@ -165,7 +174,7 @@ public void testSuppressingCVE() {
* exception with a warning.
*/
@Test
- public void testSuppressingSingle() {
+ void testSuppressingSingle() {
// GIVEN an ant task with a vulnerability using the legacy property
final String antTaskName = "suppression-single";
// WHEN executing the ant task
@@ -173,7 +182,7 @@ public void testSuppressingSingle() {
// THEN the ant task executed without error
final File report = new File("target/suppression-single-report.html");
- assertTrue("Expected the DependencyCheck report to be generated", report.exists());
+ assertTrue(report.exists(), "Expected the DependencyCheck report to be generated");
}
/**
@@ -181,7 +190,7 @@ public void testSuppressingSingle() {
* exception with a warning.
*/
@Test
- public void testSuppressingMultiple() {
+ void testSuppressingMultiple() {
// GIVEN an ant task with a vulnerability using multiple was to configure the suppression file
final String antTaskName = "suppression-multiple";
// WHEN executing the ant task
@@ -189,14 +198,14 @@ public void testSuppressingMultiple() {
// THEN the ant task executed without error
final File report = new File("target/suppression-multiple-report.html");
- assertTrue("Expected the DependencyCheck report to be generated", report.exists());
+ assertTrue(report.exists(), "Expected the DependencyCheck report to be generated");
}
/**
* Test the DependencyCheckTask retireJS configuration.
*/
@Test
- public void testRetireJsConfiguration() {
+ void testRetireJsConfiguration() {
// GIVEN an ant task with a vulnerability using multiple was to configure the suppression file
final String antTaskName = "retireJS";
@@ -205,6 +214,6 @@ public void testRetireJsConfiguration() {
// THEN the ant task executed without error
final File report = new File("target/retirejs-report.html");
- assertTrue("Expected the DependencyCheck report to be generated", report.exists());
+ assertTrue(report.exists(), "Expected the DependencyCheck report to be generated");
}
}
diff --git a/archetype/pom.xml b/archetype/pom.xml
index ceffb22eb4c..6b9a55ed673 100644
--- a/archetype/pom.xml
+++ b/archetype/pom.xml
@@ -20,20 +20,20 @@ Copyright (c) 2017 Jeremy Long. All Rights Reserved.