Skip to content

Bump dependency-check-maven from 8.0.2 to 8.1.0

Dependabot requested to merge dependabot-maven-org.owasp-dependency-check-maven-8.1.0 into master

Bumps dependency-check-maven from 8.0.2 to 8.1.0.

Release notes

Sourced from dependency-check-maven's releases.

Version 8.1.0

Added

  • Pipefile.lock files are now supported (#5404).
  • Python projects with only a pyproject.toml but no lock file or requirements will report an error as ODC is unable to analyze the project (#5409).

Fixed

  • Some maven projects caused false positives due to bad string interpolation (#5421).
  • Error message from Assembly Analyzer has been updated to emphasize dotnet 6 is required for analysis (#5408).
  • Correct issue where database defrag occurs even when no updates were performed (#5441).
  • Fixed several False Positives and one False Negative.
  • Fixed the format configuration more flexible in the gradle plugin ([dependency-check-gradle/#324](dependency-check/dependency-check-gradle#324)).

See the full listing of changes.

Changelog

Sourced from dependency-check-maven's changelog.

Version 8.1.0 (2023-01-26)

Added

  • Pipefile.lock files are now supported (#5404).
  • Python projects with only a pyproject.toml but no lock file or requirements will report an error as ODC is unable to analyze the project (#5409).

Fixed

  • Some maven projects caused false positives due to bad string interpolation (#5421).
  • Error message from Assembly Analyzer has been updated to emphasize dotnet 6 is required for analysis (#5408).
  • Correct issue where database defrag occurs even when no updates were performed (#5441).
  • Fixed several False Positives and one False Negative.
  • Fixed the format configuration more flexible in the gradle plugin ([dependency-check-gradle/#324](dependency-check/dependency-check-gradle#324)).

See the full listing of changes.

Commits
  • 8a6517e build:prepare release v8.1.0
  • 6c82d94 docs: release notes
  • 1347904 build(deps): bump amannn/action-semantic-pull-request from 5.0.2 to 5.1.0 (#5...
  • c8bd0ac fix(fp): False Positives on GitPython (#5442)
  • 6cb9f33 fix: correctly return update status in KnownExploitedDataSource (#5441)
  • 182721d fix: resolve false negative on yii2 (#5434)
  • 8cde561 fix: ensure pyproject.toml has lock (#5409)
  • 4730296 feat: support Pipenv - Pipfile.lock (#5404)
  • c0fcd40 fix(FP): Fp suppressions too hard for our automation (#5438)
  • 8773d4f build(deps): bump maven-deploy-plugin from 3.0.0 to 3.1.0 (#5439)
  • Additional commits viewable in compare view

Dependabot commands
You can trigger Dependabot actions by commenting on this MR
  • $dependabot rebase will rebase this MR
  • $dependabot recreate will recreate this MR rewriting all the manual changes and resolving conflicts

Merge request reports