Bump org.owasp:dependency-check-maven from 11.1.1 to 12.0.1 #1681
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
Bumps [org.owasp:dependency-check-maven](https://github.com/jeremylong/DependencyCheck) from 11.1.1 to 12.0.1. - [Release notes](https://github.com/jeremylong/DependencyCheck/releases) - [Changelog](https://github.com/jeremylong/DependencyCheck/blob/main/CHANGELOG.md) - [Commits](jeremylong/DependencyCheck@v11.1.1...v12.0.1) --- updated-dependencies: - dependency-name: org.owasp:dependency-check-maven dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
added
the
dependencies
SummaryThe pull request updates the version of the
|
![stanzabot[bot]](https://avatars.githubusercontent.com/in/939320?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR updates the OWASP Dependency Check Maven plugin from version 11.1.1 to 12.0.1. This is a major version upgrade that introduces several important improvements to the security scanning capabilities.
Key Changes:
- Adds support for CVSS v4 reporting, providing more accurate vulnerability scoring
- Enhances authentication mechanisms with Bearer token support
- Introduces new failure conditions (e.g., unused suppression rules)
- Improves error handling and authentication processes
The change appears safe to merge, but there are a few considerations to keep in mind due to the major version bump.
Powered by Stanza
Available commands
`@stanza-ai review` - Re-review the PR `@stanza-ai ` - Chat with the code review agent| <plugin> | ||
| <groupId>org.owasp</groupId> | ||
| <artifactId>dependency-check-maven</artifactId> | ||
| <version>11.1.1</version> | ||
| <version>12.0.1</version> | ||
| <executions> | ||
| <execution> | ||
| <goals> |
There was a problem hiding this comment.
The plugin configuration is minimal, using only the basic 'check' goal. Consider enhancing the configuration to take advantage of the new features in v12:
- The new
failBuildOnUnusedSuppressionRuleflag can help maintain clean suppression files - CVSS v4 support might require configuration adjustments if you want to use the new scoring system
- If you're using authentication for external resources, review the new Bearer token authentication support
Example configuration to consider:
<configuration>
<failBuildOnUnusedSuppressionRule>true</failBuildOnUnusedSuppressionRule>
<!-- Add other relevant configuration options -->
</configuration>Note: Major version upgrades (11.x -> 12.x) may introduce breaking changes. Review the changelog carefully, particularly around authentication changes, new failure conditions, and CVSS scoring updates. Consider testing the build process thoroughly before merging to ensure no CI/CD disruptions.
Bumps org.owasp:dependency-check-maven from 11.1.1 to 12.0.1.
Release notes
Sourced from org.owasp:dependency-check-maven's releases.
Changelog
Sourced from org.owasp:dependency-check-maven's changelog.
Commits
eee5b46build: prepare release v12.0.18f76b42docs: prepare release9424f85build(deps): bump org.sonatype.goodies:package-url-java from 1.1.1 to 1.2.0 (...c5e6bcebuild(deps): bump org.apache.maven.plugins:maven-artifact-plugin from 3.5.3 t...7181e6abuild(deps): bump joda-time:joda-time from 2.10.4 to 2.13.0 (#7300)2c7b19bbuild(deps-dev): bump io.netty:netty-codec-http from 4.1.115.Final to 4.1.117...9502f82build(deps): bump golang from 1.23.4-alpine to 1.23.5-alpine (#7323)eb6be01docs: Fix OSS Index Maven config documentation (#7322)7485f9fbuild(deps): bump golang from 1.23.4-alpine to 1.23.5-alpined883343Fix OSS Index Maven config documentationDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)