Skip to content

Bump dependency-check-maven from 7.4.4 to 8.0.0

Dependabot requested to merge dependabot-maven-org.owasp-dependency-check-maven-8.0.0 into master

Bumps dependency-check-maven from 7.4.4 to 8.0.0.

Release notes

Sourced from dependency-check-maven's releases.

Version 8.0.0

Added

  • Utilize the hosted suppression file to allow for faster remediation of reported False Positives (#4723).
  • Include the CISA Known Exploited Vulnerability Catalog (#4878).
  • The gradle and maven plugins now have the capability to scan the build plugins (#4035).
  • The gradle and maven plugins, for transitive dependencies, will report the root dependency in the project that included the transitive dependency (#5001).
  • Added properties.security-severity to SARIF report for better integration with GitHub Security Code scanning (#5277).
  • Allow for HTTP auth settings for Retire JS respository (#5209).
  • New schema for the XML report was added to support some of the above additions (#5296).
  • Added missing gradle option to only warn on remote errors from the OSS Index Analyzer ([gradle #303](dependency-check/dependency-check-gradle#303)).

Changed

  • Breaking: the database schema updated - if using an external database the update scripts must be run!
  • The exit codes from the CLI have been changed to be in the range from 0-255 (#4511.
  • The OSS Index Analyzer will automatically disable itself if a transport error occurs - preventing copious errors from being reported (#5300).

Fixed

  • Added an additional check for rejected CVEs to reduce FP (#5268.
  • Corrected the analysis of node_modules to prevent NPEs (#5266).
  • Fixed error when scanning node packages with local dependencies (#5235).
  • Fixed NPE in the MSBuild Analyzer (#5293).
  • Several False Positives have been resolved.

See the full listing of changes.

Changelog

Sourced from dependency-check-maven's changelog.

Version 8.0.0 (2023-01-15)

Added

  • Utilize the hosted suppression file to allow for faster remediation of reported False Positives (#4723).
  • Include the CISA Known Exploited Vulnerability Catalog (#4878).
  • The gradle and maven plugins now have the capability to scan the build plugins (#4035).
  • The gradle and maven plugins, for transitive dependencies, will report the root dependency in the project that included the transitive dependency (#5001).
  • Added properties.security-severity to SARIF report for better integration with GitHub Security Code scanning (#5277).
  • Allow for HTTP auth settings for Retire JS respository (#5209).
  • New schema for the XML report was added to support some of the above additions (#5296).
  • Added missing gradle option to only warn on remote errors from the OSS Index Analyzer ([gradle #303](dependency-check/dependency-check-gradle#303)).

Changed

  • Breaking: the database schema updated - if using an external database the update scripts must be run!
  • The exit codes from the CLI have been changed to be in the range from 0-255 (#4511.
  • The OSS Index Analyzer will automatically disable itself if a transport error occurs - preventing copious errors from being reported (#5300).

Fixed

  • Added an additional check for rejected CVEs to reduce FP (#5268.
  • Corrected the analysis of node_modules to prevent NPEs (#5266).
  • Fixed error when scanning node packages with local dependencies (#5235).
  • Fixed NPE in the MSBuild Analyzer (#5293).
  • Several False Positives have been resolved.

See the full listing of changes.

Commits
  • f3d806d build:prepare release v8.0.0
  • 990bbbf docs: prep 8.0.0 release
  • 5b65fa2 fix(fp): transfer generated suppressions
  • 7e36522 docs: updates for 8.0.0 (#5299)
  • 5c1c07a fix: correct supported versions
  • 8df6208 fix: Add hosted suppressions args to completion, fixup CLI documentation of a...
  • 465b942 fix: add CISA Known Exploited Vulnerability Catalog to report credits (#5301)
  • 4947c56 fix: disable OSS Index Analyzer when transport errors occur (#5300)
  • 345337f fix: add missing hostedSuppressions args to completion
  • d3bad35 fix: Fixup copy/paste error in CLI argument documentation
  • Additional commits viewable in compare view

Dependabot commands
You can trigger Dependabot actions by commenting on this MR
  • $dependabot rebase will rebase this MR
  • $dependabot recreate will recreate this MR rewriting all the manual changes and resolving conflicts

Merge request reports