Skip to content
This repository was archived by the owner on Oct 4, 2024. It is now read-only.

Comments

Bump dependency-check-maven from 6.5.3 to 7.0.0#505

Merged
pethers merged 1 commit intomasterfrom
dependabot/maven/org.owasp-dependency-check-maven-7.0.0
Mar 1, 2022
Merged

Bump dependency-check-maven from 6.5.3 to 7.0.0#505
pethers merged 1 commit intomasterfrom
dependabot/maven/org.owasp-dependency-check-maven-7.0.0

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 1, 2022

Bumps dependency-check-maven from 6.5.3 to 7.0.0.

Release notes

Sourced from dependency-check-maven's releases.

Version 7.0.0

Breaking Changes

  • The H2 database version has been upgraded.
    • if you use the dataDirectory option you will need to run a purge after upgrading.
  • Upgraded to dotnet core 6.0. If analyzing dotnet assemblies the system will need to have the dotnet core 6.0.x runtime available.

Changes

  • The Sarif report format has been fixed and can now be imported into GitHub if desired (See #3993).
  • Introduced IssueOps for False Positive reports to assist the team in evaluating FP reports.
  • When analyzing Java projects ODC now includes data from the developers section.
    • This will likely cause false positives on things like Apache James, please report the FP and we will fix these quickly.
  • General project maintenance, bug fixes, and false positive reductions.
  • See the full listing of changes.
Changelog

Sourced from dependency-check-maven's changelog.

Version 7.0.0 (2022-02-28)

Breaking Changes

  • The H2 database version has been upgraded.
    • if you use the dataDirectory option you will need to run a purge after upgrading.
  • Upgraded to dotnet core 6.0. If analyzing dotnet assemblies the system will need to have the dotnet core 6.0.x runtime available.

Changes

  • The Sarif report format has been fixed and can now be imported into GitHub if desired (See #3993).
  • Introduced IssueOps for False Positive reports to assist the team in evaluating FP reports.
  • When analyzing Java projects ODC now includes data from the developers section.
    • This will likely cause false positives on things like Apache James, please report the FP and we will fix these quickly.
  • General project maintenance, bug fixes, and false positive reductions.
  • See the full listing of changes.
Commits
  • a7e36ff [maven-release-plugin] prepare release v7.0.0
  • 8fad03d prepare release 7.0.0
  • a827499 Merge pull request #4119 from jeremylong/dependabot/maven/org.apache.maven.pl...
  • e5108b7 Merge pull request #4118 from jeremylong/dependabot/github_actions/actions/se...
  • 5468845 Merge pull request #4117 from jeremylong/dependabot/github_actions/pnpm/actio...
  • 86349a4 Bump maven-project-info-reports-plugin from 3.2.1 to 3.2.2
  • aa9b0df Bump actions/setup-dotnet from 1 to 2
  • fd76861 Bump pnpm/action-setup from 2.2.0 to 2.2.1
  • a61f07a Merge pull request #4108 from jeremylong/issue-3991
  • eed02d2 Merge pull request #4110 from jeremylong/issueOpsUpdate
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Mar 1, 2022
@secureflag-knowledge-base
Copy link

No description provided.

@ghost
Copy link

ghost commented Mar 1, 2022

Black Duck Security Report

Branch master has no Black Duck results, and could not be compared to #505. Analyze branch master to get a change comparison.

Removed Components

Clean: 17

Click here to see full report

@pethers pethers merged commit 52223dd into master Mar 1, 2022
@dependabot dependabot bot deleted the dependabot/maven/org.owasp-dependency-check-maven-7.0.0 branch March 1, 2022 16:56
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

dependencies Pull requests that update a dependency file size/XS

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant