From bcbbe1ccba51d5fd5ee74e86c59846d7ac69d3b7 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 6 Jul 2024 07:37:21 -0400 Subject: [PATCH 1/5] docs: release 10.0.2 --- CHANGELOG.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 373606cea68..79105e0312e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,17 @@ # Change Log +## [Version 10.0.2](https://github.com/jeremylong/DependencyCheck/releases/tag/v10.0.2) (2024-07-06) + +- build(deps): bump open-vulnerability-clients (#6810) +- fix(db): #6788 removing redundant db index "idxVulnerability" on "vulnerability.cve" (#6807) +- docs: Further improve formatting and docs of H2 database caching strats (#6804) +- fix: update_vulnerability in dbStatements_oracle.properties (#6803) +- fix: fix NPE (#6778) +- fix: add hint to resolve false negative (#6802) +- chore: update configure (#6794) + +See the full listing of [changes](https://github.com/jeremylong/DependencyCheck/milestone/86?closed=1). + ## [Version 10.0.1](https://github.com/jeremylong/DependencyCheck/releases/tag/v10.0.1) (2024-07-02) - build(deps): bump open-vulnerability-client (#6772) From f22ebf118f78a5852da7750443dd5995b669b350 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 6 Jul 2024 07:43:49 -0400 Subject: [PATCH 2/5] docs: mandatory upgrade notice --- README.md | 13 ++++++++----- SECURITY.md | 8 ++++---- 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index fc5c3ffcd5d..6128dfd4fa2 100644 --- a/README.md +++ b/README.md @@ -12,15 +12,18 @@ Documentation and links to production binary releases can be found on the [githu This product uses the NVD API but is not endorsed or certified by the NVD. -## 9.0.0 Upgrade Notice +## Mandatory Upgrade Notive -**Upgrading to 9.0.0 or later is mandatory**; previous versions of dependency-check -utilize the NVD data feeds which will be deprecated on Dec 15th, 2023. Versions -earlier then 9.0.0 are no longer supported and could fail to work after Dec 15th, 2023. +**Upgrading to 10.0.2 or later is mandatory** + +Older versions of dependency-check are causing numerous, duplicative requests that +end in processing failures are causing unnecassary load on the NVD API. Dependency-check +10.0.2 uses an updated `User-Agent` header that will allow the NVD to block calls +from the older client. ### NVD API Key Highly Recommended -With 9.0.0 dependency-check has moved from using the NVD data-feed to the NVD API. +Dependency-check has moved from using the NVD data-feed to the NVD API. Users of dependency-check are **highly** encouraged to obtain an NVD API Key; see https://nvd.nist.gov/developers/request-an-api-key Without an NVD API Key dependency-check's updates will be **extremely slow**. Please see the documentation for the cli, maven, gradle, or ant integrations on diff --git a/SECURITY.md b/SECURITY.md index 465256816a0..b33158baf1c 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,10 +2,10 @@ ## Supported Versions -| Version | Supported | -| ---------|--------------------| -| 10.0.0+ | :white_check_mark: | -| <= 9.2.0 | :x: | +| Version | Supported | +| ----------|--------------------| +| 10.0.2+ | :white_check_mark: | +| <= 10.0.1 | :x: | ## Reporting a Vulnerability From b7b030c6a2c10161b299c9885ed03eaf0ad2ad71 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 6 Jul 2024 07:44:56 -0400 Subject: [PATCH 3/5] build: prepare release v10.0.2 --- ant/pom.xml | 4 ++-- archetype/pom.xml | 6 +++--- cli/pom.xml | 4 ++-- core/pom.xml | 4 ++-- maven/pom.xml | 4 ++-- pom.xml | 6 +++--- utils/pom.xml | 4 ++-- 7 files changed, 16 insertions(+), 16 deletions(-) diff --git a/ant/pom.xml b/ant/pom.xml index bc2eeffebd4..8acf0ff9726 100644 --- a/ant/pom.xml +++ b/ant/pom.xml @@ -20,7 +20,7 @@ Copyright (c) 2013 - Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 10.0.2-SNAPSHOT + 10.0.2 dependency-check-ant @@ -32,7 +32,7 @@ Copyright (c) 2013 - Jeremy Long. All Rights Reserved. scm:git:https://github.com/jeremylong/DependencyCheck.git https://github.com/jeremylong/DependencyCheck/tree/main/ant scm:git:git@github.com:jeremylong/DependencyCheck.git - v6.4.1 + v10.0.2 diff --git a/archetype/pom.xml b/archetype/pom.xml index d04ae2275ac..01cf6207c5e 100644 --- a/archetype/pom.xml +++ b/archetype/pom.xml @@ -20,20 +20,20 @@ Copyright (c) 2017 Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 10.0.2-SNAPSHOT + 10.0.2 dependency-check-plugin Dependency-Check Plugin Archetype jar - 2024-07-02T11:57:33Z + 2024-07-06T11:44:09Z scm:git:https://github.com/jeremylong/DependencyCheck.git https://github.com/jeremylong/DependencyCheck/tree/main/archetype scm:git:git@github.com:jeremylong/DependencyCheck.git - HEAD + v10.0.2 diff --git a/cli/pom.xml b/cli/pom.xml index e7e85266403..abdcd8e319f 100644 --- a/cli/pom.xml +++ b/cli/pom.xml @@ -20,7 +20,7 @@ Copyright (c) 2012 - Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 10.0.2-SNAPSHOT + 10.0.2 dependency-check-cli @@ -32,7 +32,7 @@ Copyright (c) 2012 - Jeremy Long. All Rights Reserved. scm:git:https://github.com/jeremylong/DependencyCheck.git https://github.com/jeremylong/DependencyCheck/tree/main/cli scm:git:git@github.com:jeremylong/DependencyCheck.git - v6.4.1 + v10.0.2 dependency-check-${project.version} diff --git a/core/pom.xml b/core/pom.xml index f279c46e8c8..33ce6bfae0b 100644 --- a/core/pom.xml +++ b/core/pom.xml @@ -20,7 +20,7 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 10.0.2-SNAPSHOT + 10.0.2 dependency-check-core @@ -32,7 +32,7 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved. scm:git:https://github.com/jeremylong/DependencyCheck.git https://github.com/jeremylong/DependencyCheck/tree/main/core scm:git:git@github.com:jeremylong/DependencyCheck.git - v6.4.1 + v10.0.2 diff --git a/maven/pom.xml b/maven/pom.xml index 5a8eca499b1..26fdef8dd86 100644 --- a/maven/pom.xml +++ b/maven/pom.xml @@ -20,7 +20,7 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 10.0.2-SNAPSHOT + 10.0.2 dependency-check-maven maven-plugin @@ -34,7 +34,7 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved. scm:git:https://github.com/jeremylong/DependencyCheck.git https://github.com/jeremylong/DependencyCheck/tree/master/maven scm:git:git@github.com:jeremylong/DependencyCheck.git - v6.4.1 + v10.0.2 3.1.0 diff --git a/pom.xml b/pom.xml index 613901eeb74..e23494059f7 100644 --- a/pom.xml +++ b/pom.xml @@ -20,7 +20,7 @@ Copyright (c) 2012 - Jeremy Long org.owasp dependency-check-parent - 10.0.2-SNAPSHOT + 10.0.2 pom @@ -94,7 +94,7 @@ Copyright (c) 2012 - Jeremy Long scm:git:https://github.com/jeremylong/DependencyCheck.git https://github.com/jeremylong/DependencyCheck scm:git:https://github.com/jeremylong/DependencyCheck.git - v6.4.1 + v10.0.2 github @@ -112,7 +112,7 @@ Copyright (c) 2012 - Jeremy Long - 2024-07-02T11:57:33Z + 2024-07-06T11:44:09Z UTF-8 UTF-8 github diff --git a/utils/pom.xml b/utils/pom.xml index 48de74f6bfa..e935239904d 100644 --- a/utils/pom.xml +++ b/utils/pom.xml @@ -20,7 +20,7 @@ Copyright (c) 2014 - Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 10.0.2-SNAPSHOT + 10.0.2 dependency-check-utils @@ -30,7 +30,7 @@ Copyright (c) 2014 - Jeremy Long. All Rights Reserved. scm:git:https://github.com/jeremylong/DependencyCheck.git https://github.com/jeremylong/DependencyCheck/tree/main/utils scm:git:git@github.com:jeremylong/DependencyCheck.git - v6.4.1 + v10.0.2 org.owasp.dependencycheck.utils.* From ed20fdbca122c17c2d1c773735e5fa5115fa871a Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 6 Jul 2024 07:44:57 -0400 Subject: [PATCH 4/5] build: prepare for next development iteration --- ant/pom.xml | 4 ++-- archetype/pom.xml | 6 +++--- cli/pom.xml | 4 ++-- core/pom.xml | 4 ++-- maven/pom.xml | 4 ++-- pom.xml | 6 +++--- utils/pom.xml | 4 ++-- 7 files changed, 16 insertions(+), 16 deletions(-) diff --git a/ant/pom.xml b/ant/pom.xml index 8acf0ff9726..2ec0ef604da 100644 --- a/ant/pom.xml +++ b/ant/pom.xml @@ -20,7 +20,7 @@ Copyright (c) 2013 - Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 10.0.2 + 10.0.3-SNAPSHOT dependency-check-ant @@ -32,7 +32,7 @@ Copyright (c) 2013 - Jeremy Long. All Rights Reserved. scm:git:https://github.com/jeremylong/DependencyCheck.git https://github.com/jeremylong/DependencyCheck/tree/main/ant scm:git:git@github.com:jeremylong/DependencyCheck.git - v10.0.2 + v6.4.1 diff --git a/archetype/pom.xml b/archetype/pom.xml index 01cf6207c5e..706e45f1be6 100644 --- a/archetype/pom.xml +++ b/archetype/pom.xml @@ -20,20 +20,20 @@ Copyright (c) 2017 Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 10.0.2 + 10.0.3-SNAPSHOT dependency-check-plugin Dependency-Check Plugin Archetype jar - 2024-07-06T11:44:09Z + 2024-07-06T11:44:57Z scm:git:https://github.com/jeremylong/DependencyCheck.git https://github.com/jeremylong/DependencyCheck/tree/main/archetype scm:git:git@github.com:jeremylong/DependencyCheck.git - v10.0.2 + HEAD diff --git a/cli/pom.xml b/cli/pom.xml index abdcd8e319f..84068639e45 100644 --- a/cli/pom.xml +++ b/cli/pom.xml @@ -20,7 +20,7 @@ Copyright (c) 2012 - Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 10.0.2 + 10.0.3-SNAPSHOT dependency-check-cli @@ -32,7 +32,7 @@ Copyright (c) 2012 - Jeremy Long. All Rights Reserved. scm:git:https://github.com/jeremylong/DependencyCheck.git https://github.com/jeremylong/DependencyCheck/tree/main/cli scm:git:git@github.com:jeremylong/DependencyCheck.git - v10.0.2 + v6.4.1 dependency-check-${project.version} diff --git a/core/pom.xml b/core/pom.xml index 33ce6bfae0b..15727a1eb03 100644 --- a/core/pom.xml +++ b/core/pom.xml @@ -20,7 +20,7 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 10.0.2 + 10.0.3-SNAPSHOT dependency-check-core @@ -32,7 +32,7 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved. scm:git:https://github.com/jeremylong/DependencyCheck.git https://github.com/jeremylong/DependencyCheck/tree/main/core scm:git:git@github.com:jeremylong/DependencyCheck.git - v10.0.2 + v6.4.1 diff --git a/maven/pom.xml b/maven/pom.xml index 26fdef8dd86..6a4dc2f0d89 100644 --- a/maven/pom.xml +++ b/maven/pom.xml @@ -20,7 +20,7 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 10.0.2 + 10.0.3-SNAPSHOT dependency-check-maven maven-plugin @@ -34,7 +34,7 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved. scm:git:https://github.com/jeremylong/DependencyCheck.git https://github.com/jeremylong/DependencyCheck/tree/master/maven scm:git:git@github.com:jeremylong/DependencyCheck.git - v10.0.2 + v6.4.1 3.1.0 diff --git a/pom.xml b/pom.xml index e23494059f7..0987f769b6d 100644 --- a/pom.xml +++ b/pom.xml @@ -20,7 +20,7 @@ Copyright (c) 2012 - Jeremy Long org.owasp dependency-check-parent - 10.0.2 + 10.0.3-SNAPSHOT pom @@ -94,7 +94,7 @@ Copyright (c) 2012 - Jeremy Long scm:git:https://github.com/jeremylong/DependencyCheck.git https://github.com/jeremylong/DependencyCheck scm:git:https://github.com/jeremylong/DependencyCheck.git - v10.0.2 + v6.4.1 github @@ -112,7 +112,7 @@ Copyright (c) 2012 - Jeremy Long - 2024-07-06T11:44:09Z + 2024-07-06T11:44:57Z UTF-8 UTF-8 github diff --git a/utils/pom.xml b/utils/pom.xml index e935239904d..2b59e20da1e 100644 --- a/utils/pom.xml +++ b/utils/pom.xml @@ -20,7 +20,7 @@ Copyright (c) 2014 - Jeremy Long. All Rights Reserved. org.owasp dependency-check-parent - 10.0.2 + 10.0.3-SNAPSHOT dependency-check-utils @@ -30,7 +30,7 @@ Copyright (c) 2014 - Jeremy Long. All Rights Reserved. scm:git:https://github.com/jeremylong/DependencyCheck.git https://github.com/jeremylong/DependencyCheck/tree/main/utils scm:git:git@github.com:jeremylong/DependencyCheck.git - v10.0.2 + v6.4.1 org.owasp.dependencycheck.utils.* From a25e6c7472a031ce2c386da08dd66f36daaa6209 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 6 Jul 2024 07:48:18 -0400 Subject: [PATCH 5/5] docs: Update CHANGELOG.md --- CHANGELOG.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 79105e0312e..e33819613e4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,8 @@ ## [Version 10.0.2](https://github.com/jeremylong/DependencyCheck/releases/tag/v10.0.2) (2024-07-06) +**Mandatory Upgrade** - due to older versions of dependency-check causing numerous, spurious requests that end in processing failures, this upgrade is mandatory so that the NVD can differentiate valid requests and block the old clients. + - build(deps): bump open-vulnerability-clients (#6810) - fix(db): #6788 removing redundant db index "idxVulnerability" on "vulnerability.cve" (#6807) - docs: Further improve formatting and docs of H2 database caching strats (#6804)