Skip to content

Bump dependency-check-maven from 6.0.3 to 6.3.0#7

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/org.owasp-dependency-check-maven-6.3.0
Closed

Bump dependency-check-maven from 6.0.3 to 6.3.0#7
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/org.owasp-dependency-check-maven-6.3.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2021

Copy link
Copy Markdown

Bumps dependency-check-maven from 6.0.3 to 6.3.0.

Release notes

Sourced from dependency-check-maven's releases.

Version 6.3.0

Changes in this Release

  • Many updates were made to improve performance on large scans, reduce false positives, and other bug fixes.
  • Increased the width of four columns in the database; if you use a an external database you should also update the width (see upgrade_5.1.sql).
  • See the full listing of changes.

Version 6.2.2

Changes in this Release

Version 6.2.1

Changes in this Release

Version 6.2.0

Changes in this Release

  • Added an experimental Perl CPAN analyzer #3378
  • Improved database performance #3206
  • The archive analyzer now extracts files from RPM archives #3226
  • Ensure ordered output in reports #3243
  • Several minor bug fixes and updates to reduce false positives
  • See the full listing of changes.

Version 6.1.6

Changes in this Release

  • Resolved issue with Sarif report (#3243)
  • Resolved issue with Ruby Bundle Audit (#3256)
  • Several minor bug fixes and updates to reduce false positives
  • See the full listing of changes.

Version 6.1.5

Changes in this Release

  • Fixed a second NPE introduced in 6.1.3 (see #3246)
  • See the full listing of changes.

Version 6.1.4

Changes in this Release

  • Fixed an NPE introduced in 6.1.3 (see #3212)
  • See the full listing of changes.

Version 6.1.3

Changes in this Release

  • Modified the new CPE matching strategy to be more performant (#3207)
  • Upgraded a vulnerable dependency (velocity-engine-core/CVE-2020-13936) (#3205)
  • See the full listing of changes.

Version 6.1.2

Changes in this Release

... (truncated)

Changelog

Sourced from dependency-check-maven's changelog.

Version 6.3.0 (2021-08-31)

Changes

  • Many updates were made to improve performance on large scans, reduce false positives, and other bug fixes.
  • Increased the width of four columns in the database; if you use a an external database you should also update the width (see upgrade_5.1.sql).
  • See the full listing of changes.

Version 6.2.2 (2021-06-10)

Changes

Version 6.2.1 (2021-06-08)

Changes

Version 6.2.0 (2021-05-29)

Changes

  • Added an experimental Perl CPAN analyzer #3378
    • Note that the full DSL of the CPAN is not yet supported so any required dependency is analyzed (i.e. there is no way to exclude development requirements)
  • Improved database performance #3206
  • The archive analyzer now extracts files from RPM archives #3226
  • Ensure ordered output in reports #3243
  • Several minor bug fixes and updates to reduce false positives
  • See the full listing of changes.

Version 6.1.6 (2021-04-29)

Changes

  • Resolved issue with Sarif report (#3243)
  • Resolved issue with Ruby Bundle Audit (#3256)
  • Several minor bug fixes and updates to reduce false positives
  • See the full listing of changes.

Version 6.1.5 (2021-03-31)

Changes

  • Fixed a second NPE introduced in 6.1.3 (see #3246)
  • See the full listing of changes.

... (truncated)

Commits
  • fe94282 [maven-release-plugin] prepare release v6.3.0
  • 2b70aa9 release 6.3.0
  • 012a3e7 Merge pull request #3616 from jeremylong/dependabot/maven/jackson.version-2.12.5
  • bc5603d Bump jackson.version from 2.12.4 to 2.12.5
  • b996579 Merge pull request #3613 from jeremylong/dependabot/github_actions/JamesIves/...
  • 8a30e7d Merge pull request #3614 from jeremylong/dependabot/maven/org.codehaus.plexus...
  • 1439e7d Merge pull request #3611 from jeremylong/dependabot/maven/org.mockito-mockito...
  • 3c338be Merge pull request #3599 from jeremylong/gomod
  • da2fc8a Bump plexus-utils from 3.4.0 to 3.4.1
  • d2e790d Bump JamesIves/github-pages-deploy-action from 4.1.4 to 4.1.5
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [dependency-check-maven](https://github.com/jeremylong/DependencyCheck) from 6.0.3 to 6.3.0.
- [Release notes](https://github.com/jeremylong/DependencyCheck/releases)
- [Changelog](https://github.com/jeremylong/DependencyCheck/blob/main/RELEASE_NOTES.md)
- [Commits](jeremylong/DependencyCheck@v6.0.3...v6.3.0)

---
updated-dependencies:
- dependency-name: org.owasp:dependency-check-maven
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 31, 2021
@dependabot @github

dependabot Bot commented on behalf of github Sep 7, 2021

Copy link
Copy Markdown
Author

Superseded by #8.

@dependabot dependabot Bot closed this Sep 7, 2021
@dependabot dependabot Bot deleted the dependabot/maven/org.owasp-dependency-check-maven-6.3.0 branch September 7, 2021 18:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants