dependabot[bot] commented 3 months ago

Bumps org.owasp:dependency-check-maven from 9.2.0 to 10.0.1.

Release notes

Sourced from org.owasp:dependency-check-maven's releases.

Version 10.0.1

Refer to the CHANGELOG.md for information about improvements and upgrade notes.

Version 10.0.0

Refer to the CHANGELOG.md for information about improvements and upgrade notes.

Changelog

Sourced from org.owasp:dependency-check-maven's changelog.

Version 10.0.1 (2024-07-02)

build(deps): bump open-vulnerability-client (#6772)

fix: remove debug logging (#6770)

fix: postgresql column count error (#6773)

fix: mssql column name and version (#6761)

docs: update supported versions (#6771)

See the full listing of changes.

Version 10.0.0 (2024-07-01)

breaking change: upgrade to dotnet 8.0 (#6580)

Users of the AssemblyAnalyzer must upgrade/utilize dotnet 8 to analyze assemblies

feat: fix the NVD API related errors by adding cvssV4 support (#6756)

breaking changes: anyone utilizing a centralized database will need to upgrade the schema; see changes in [PR #6756](jeremylong/DependencyCheck#6756)

fix: avoid escaping unnecessary chars in HTML report suppression regexes (#6749)

fix: #6688 Trim version number when parsin POM (#6705)

fix: change request if lockfile is file v3 (#6690)

fix: skip pyproject.toml unless it contains tool.poetry before ensuring lockfiles (#6681)

See the full listing of changes.

Commits

4d47fb9 build: prepare release v10.0.1
934a307 docs: release 10.0.1
763fe31 fix: postgresql error (#6773)
cab586e build(deps): bump open-vulnerability-client (#6772)
a8128a4 docs: update supported versions (#6771)
8c731cd fix: remove debug logging (#6770)
214bdd9 fix: Fix column name and version (#6761)
c0da58e Update initialize_mssql.sql
1d6bd7a build: Release 10.0.0 (#6759)
e31d456 Update CHANGELOG.md
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

github-actions[bot] commented 3 months ago

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 7837b3a3506cb7d6a268b41770c29504f27d9a51.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package

Version

Score

Details

maven/org.owasp:dependency-check-maven

10.0.1

:green_circle: 6.8

Details

Check	Score	Reason
Code-Review	:green_circle: 10	all changesets reviewed
Maintained	:green_circle: 10	30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
License	:green_circle: 10	license file detected
CII-Best-Practices	:green_circle: 5	badge detected: Passing
Branch-Protection	:warning: -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases	:green_circle: 8	5 out of the last 5 releases have a total of 5 signed artifacts.
Dangerous-Workflow	:green_circle: 10	no dangerous workflow patterns detected
Security-Policy	:green_circle: 10	security policy file detected
Token-Permissions	:warning: 0	detected GitHub workflow tokens with excessive permissions
SAST	:green_circle: 10	SAST tool is run on all commits
Binary-Artifacts	:green_circle: 10	no binaries found in the repo
Fuzzing	:warning: 0	project is not fuzzed
Pinned-Dependencies	:warning: 1	dependency not pinned by hash detected -- score normalized to 1
Packaging	:green_circle: 10	packaging workflow detected
Vulnerabilities	:warning: 0	434 existing vulnerabilities detected

maven/org.owasp:dependency-check-maven

9.2.0

:green_circle: 6.8

Details

Check	Score	Reason
Code-Review	:green_circle: 10	all changesets reviewed
Maintained	:green_circle: 10	30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
License	:green_circle: 10	license file detected
CII-Best-Practices	:green_circle: 5	badge detected: Passing
Branch-Protection	:warning: -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases	:green_circle: 8	5 out of the last 5 releases have a total of 5 signed artifacts.
Dangerous-Workflow	:green_circle: 10	no dangerous workflow patterns detected
Security-Policy	:green_circle: 10	security policy file detected
Token-Permissions	:warning: 0	detected GitHub workflow tokens with excessive permissions
SAST	:green_circle: 10	SAST tool is run on all commits
Binary-Artifacts	:green_circle: 10	no binaries found in the repo
Fuzzing	:warning: 0	project is not fuzzed
Pinned-Dependencies	:warning: 1	dependency not pinned by hash detected -- score normalized to 1
Packaging	:green_circle: 10	packaging workflow detected
Vulnerabilities	:warning: 0	434 existing vulnerabilities detected