Skip to content

Latest commit

 

History

History
240 lines (214 loc) · 16 KB

2023-04-18-v4.8.0.md

File metadata and controls

240 lines (214 loc) · 16 KB
Raw
title type
v4.8.0
major

Celebrating 10 years of OWASP Dependency-Track

Dependency-Track is celebrating its 10th anniversary this year!
Read the announcement from Steve Springett, creator of Dependency-Track, on the OWASP blog.

Highlights:

  • Improved frontend UX.
    • Navigating through the UI, switching tabs etc. now properly updates the URL in the browser. This makes it possible to share links to specific pages with others, and not lose context entirely when using the browser's "go back" functionality.
    • Criteria for the component search is now encoded in the URL, which allows "deep-linking" to searches, making it easier to collaborate with colleagues.
    • The UI will now remember various user preferences, i.e. selected columns, numbers of search results per page, whether to show inactive projects, and much more.
    • The dependency graph now optionally displays indicator icons for outdated components.
  • Polished policy engine. The policy engine received lots of love in this release, ranging from various bugfixes, to newly supported policy conditions.
  • Reduced resource footprint for vulnerability database mirroring. Downloading and processing vulnerability data from the NVD, GitHub, and OSV has historically been a heavy task that could cause large spikes in JVM heap usage. Due to various improvements, mirroring will now be faster, and a lot more lightweight (see apiserver/#2575 for comparisons).

Features:

  • Reduce log level for some recurring tasks to debug - apiserver/#2325
  • Reduce log level for Defect Dojo pagination advancement to info - apiserver/#2338
  • Add User-Agent header to Snyk requests - apiserver/#2396
  • Allow updating only the project's parent via PATCH, without having to worry about any other project properties. - apiserver/#2401
  • Include version of affected projects in Jira notification template - apiserver/#2408
  • Add support for regular expressions in policy conditions - apiserver/#2144
  • Show version status information on dependency graph nodes - apiserver/#2273
  • Add support for component age in policy conditions - apiserver/#772
  • Skip superfluous component metrics calculation during OSS Index analysis - apiserver/#2466
  • Handle deleted projects gracefully when processing uploaded BOMs - apiserver/#2467
  • Include persistence framework in logging configuration - apiserver/#2483
  • Drop dependency on Unirest library - apiserver/#2350
  • Simplify and speed up vulnerability metrics calculation - apiserver/#2481
  • Add developer documentation for skipping NVD mirroring - apiserver/#2547
  • Execute NVD and EPSS mirroring on multi-threaded event service - apiserver/#2526
  • Reduce memory footprint of vulnerability mirroring tasks - apiserver/#2525
  • Allow for prevention of re-opening Defect Dojo findings via "do not reactivate" flag - apiserver/#2424
  • Add support for vulnerability ID in policy conditions - apiserver/#2557
  • Add support for matching of non-existent CPEs and Package URLs in policy conditions - apiserver/#2587
  • Ingest remediation details from Snyk - apiserver/#2571
  • Handle errors from repository metadata analyzers more gracefully - apiserver/#2563
  • Add support for CPAN repositories - apiserver/#639
  • Allow inclusion of H2 web console for local development purposes - apiserver/#2592
  • Add BOM_PROCESSING_FAILED notification - apiserver/#2264
  • Ingest vulnerability publication time from Snyk - apiserver/#2626
  • Add health endpoints - apiserver/#1001
  • Include dependency graph in CycloneDX exports - apiserver/#2616
  • Allow for vulnerability alias synchronization to be disabled for each source that supports it - apiserver/#2670
  • Reduce heap usage during NVD mirroring - apiserver/#2575
  • Support Jira authentication with personal access token - apiserver/#2641
  • Allow parent project to be specified when upload a BOM - apiserver/#2412
  • Update branding - frontend/#387
  • Add deep linking capability throughout the entire UI - frontend/#391
  • Remember UI user preferences (selected columns, page sizes, etc.) - frontend/#348
  • Add deep linking for component search - frontend/#425
  • Make removing a project parent relationship more convenient - frontend/#424
  • Display multiple aliases in a vertical rather than horizontal list - frontend/#315
  • Display aliases column in all vulnerability list views - frontend/#315
  • Add optional tags column to projects list view - frontend/#319

Fixes:

  • Fix unhandled exceptions when fetching repository metadata for Composer components that no longer exist - apiserver/#2134
  • Fix invalid group name of Jira configuration properties - apiserver/#2313
  • Fix duplicate policy violations caused by the "Package URL" policy condition - apiserver/#1925
  • Fix policies with operator ALL behaving as if operator ANY was used - apiserver/#2212
  • Fix 2023 NVD feeds not being fetched unless DT is restarted in new year - apiserver/#2349
  • Fix VulnDB analysis results not being cached properly - apiserver/#2436
  • Fix incomplete ingestion of dependency graph from hierarchically merged BOMs - apiserver/#2411
  • Remove unnecessary parentUuid field from project model - apiserver/#2439
  • Fix AlreadyClosedException when committing search indexes - apiserver/#2379
  • Prevent OSV ecosystems being selected multiple times - apiserver/#2473
  • Fix NullPointerException when computing enabled OSV ecosystems - apiserver/#2527
  • Fix Finding Packaging Format (FPF) export containing internal technical fields - apiserver/#2469
  • Fix ACL definitions not being cloned when cloning a project - apiserver/#2493
  • Fix email notification for PROJECT_AUDIT_CHANGE missing some information - apiserver/#2420
  • Fix not all tags being checked when evaluating "limit to" for policies - apiserver/#2586
  • Fix internal server error when fetching all projects while ACL is enabled - apiserver/#2583
  • Fix failures to import BOMs when component author fields exceed 255 characters - apiserver/#2488
  • Fix incomplete implementation of apiserver/#2313 - apiserver/#2610
  • Fix dependency graph in UI being deleted after exporting project as CycloneDX - apiserver/#2494
  • Fix project URL in email and Cisco WebEx notifications - apiserver/#2631
  • Fix OSV overriding CVE data when NVD mirroring is also enabled - apiserver/#2293
  • Fix redundant POLICY_VIOLATION notifications for existing violations - apiserver/#2655
  • Fix email of LDAP users not being persisted - apiserver/#2320
  • Fix email of OIDC users not being persisted - apiserver/#2647
  • Fix VEX import not working for vulnerabilities from OSV, Snyk, and VulnDB - apiserver/#2538
  • Fix missing project and component information in Microsoft Teams notifications - apiserver/#2638
  • Fix API server not respecting HTTP proxy settings when communicating with OIDC Identity Provider - apiserver/#1940
  • Fix potential Invalid state. Transaction has already started error during repository metadata analysis - apiserver/#2678
  • Fix broken link to affected projects - frontend/#417
  • Fix duplicate PURL version in Affected Components tab of vulnerability details - frontend/#454

Upgrade Notes:

  • The parentUuid field has been removed from the project model and will thus no longer be returned by the REST API (apiserver/#2439)
  • Due to apiserver/#2469, the File Packaging Format (FPF) version has been bumped to 1.2; Refer to [File Formats] for details
  • Synchronization of vulnerability aliases is now disabled by default for OSV and Snyk (apiserver/#2670)

For a complete list of changes, refer to the respective GitHub milestones:

We thank all organizations and individuals who contributed to this release, from logging issues to taking part in discussions on GitHub & Slack to testing of fixes.

Special thanks to everyone who contributed code to implement enhancements and fix defects:
@Ehoky, @Gator8, @Hunroll, @StephenKing, @ch8matt, @jkowalleck, @lme-nca, @malice00, @mcombuechen @mehab, @msymons, @mvandermade, @rbt-mm, @roadSurfer, @s-spindler, @sahibamittal, @syalioune @valentijnscholten, @walterdeboer, @zgael

dependency-track-apiserver.jar
Algorithm Checksum
SHA-1 883754d3ed227a124976c3f9247345be48cc0561
SHA-256 0ab7e3a1d0cd308a9193a6bec7b561f3911d19052312a82e4a59607d4ff50fd0
dependency-track-bundled.jar
Algorithm Checksum
SHA-1 979f02a5bf3ea5d8b0bba7d4e73a725de1920219
SHA-256 af9f6d79e7828b4f744f9f82215486c0b5649abf6544d0374c945b2ab5d8b58a
frontend-dist.zip
Algorithm Checksum
SHA-1 852b8a16aa8d07ccd46b4bec38cda736c6271c42
SHA-256 40cffc6fcaafe4a23d2c347958c2e3f43e3c02afe3def238bfd4615684803537
Software Bill of Materials (SBOM)

[File Formats]: {{ site.baseurl }}{% link _docs/integrations/file-formats.md %}