dependabot[bot] commented 2 weeks ago

Bumps org.owasp:dependency-check-maven from 9.2.0 to 10.0.0.

Release notes

Sourced from org.owasp:dependency-check-maven's releases.

Version 10.0.0

Refer to the CHANGELOG.md for information about improvements and upgrade notes.

Changelog

Sourced from org.owasp:dependency-check-maven's changelog.

Version 10.0.0 (2024-07-01)

breaking change: upgrade to dotnet 8.0 (#6580)

Users of the AssemblyAnalyzer must upgrade/utilize dotnet 8 to analyze assemblies

feat: fix the NVD API related errors by adding cvssV4 support (#6756)

breaking changes: anyone utilizing a centralized database will need to upgrade the schema; see changes in [PR #6756](jeremylong/DependencyCheck#6756)

fix: avoid escaping unnecessary chars in HTML report suppression regexes (#6749)

fix: #6688 Trim version number when parsin POM (#6705)

fix: change request if lockfile is file v3 (#6690)

fix: skip pyproject.toml unless it contains tool.poetry before ensuring lockfiles (#6681)

See the full listing of changes.

Commits

2ce874a build: prepare release v10.0.0
cfe0b39 docs: prepare release
ad0d16a feat: add cvssV4 support (#6756)
a798f89 feat: upgrade to dotnet 8.0 (#6580)
1af4856 build(deps): bump bundled jQuery versions from 3.5.1 to 3.7.1 (#6750)
9b42aed fix: avoid escaping unnecessary chars in HTML report suppression regexes (#6749)
fff64eb build(deps): bump jackson.version from 2.16.1 to 2.17.1 (#6648)
84868b6 build(deps): bump org.apache.maven.plugins:maven-failsafe-plugin from 3.2.5 t...
66cf0b3 build(deps): bump org.apache.maven.plugins:maven-clean-plugin from 3.3.2 to 3...
5afb495 build(deps): bump org.apache.maven.plugins:maven-project-info-reports-plugin ...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

github-actions[bot] commented 2 weeks ago

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 7e4cc22cfb6698d7c3fa3d5a363798359554c698.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package

Version

Score

Details

maven/org.owasp:dependency-check-maven

10.0.0

:green_circle: 6.8

Details

Check	Score	Reason
Code-Review	:green_circle: 10	all changesets reviewed
Maintained	:green_circle: 10	30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
License	:green_circle: 10	license file detected
CII-Best-Practices	:green_circle: 5	badge detected: Passing
Branch-Protection	:warning: -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases	:green_circle: 8	5 out of the last 5 releases have a total of 5 signed artifacts.
Dangerous-Workflow	:green_circle: 10	no dangerous workflow patterns detected
Security-Policy	:green_circle: 10	security policy file detected
Token-Permissions	:warning: 0	detected GitHub workflow tokens with excessive permissions
SAST	:green_circle: 10	SAST tool is run on all commits
Binary-Artifacts	:green_circle: 10	no binaries found in the repo
Fuzzing	:warning: 0	project is not fuzzed
Pinned-Dependencies	:warning: 1	dependency not pinned by hash detected -- score normalized to 1
Packaging	:green_circle: 10	packaging workflow detected
Vulnerabilities	:warning: 0	434 existing vulnerabilities detected

maven/org.owasp:dependency-check-maven

9.2.0

:green_circle: 6.8

Details

Check	Score	Reason
Code-Review	:green_circle: 10	all changesets reviewed
Maintained	:green_circle: 10	30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
License	:green_circle: 10	license file detected
CII-Best-Practices	:green_circle: 5	badge detected: Passing
Branch-Protection	:warning: -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases	:green_circle: 8	5 out of the last 5 releases have a total of 5 signed artifacts.
Dangerous-Workflow	:green_circle: 10	no dangerous workflow patterns detected
Security-Policy	:green_circle: 10	security policy file detected
Token-Permissions	:warning: 0	detected GitHub workflow tokens with excessive permissions
SAST	:green_circle: 10	SAST tool is run on all commits
Binary-Artifacts	:green_circle: 10	no binaries found in the repo
Fuzzing	:warning: 0	project is not fuzzed
Pinned-Dependencies	:warning: 1	dependency not pinned by hash detected -- score normalized to 1
Packaging	:green_circle: 10	packaging workflow detected
Vulnerabilities	:warning: 0	434 existing vulnerabilities detected