log suppression when creating new violation analysis#6011
Open
stohrendorf wants to merge 78 commits into
Open
Conversation
Signed-off-by: Niklas <nscuro@protonmail.com>
Signed-off-by: Niklas <nscuro@protonmail.com>
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.7.0 to 4.0.0. - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](docker/setup-qemu-action@c7c5346...ce36039) --- updated-dependencies: - dependency-name: docker/setup-qemu-action dependency-version: 4.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.19.2 to 7.0.0. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@10e90e3...d08e5c3) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Niklas <nscuro@protonmail.com>
… CPE The previous logic did not explicitly "parse" the component's PURL when the component also has a CPE. It would still go on to fetch VulnerableSoftware records for CPE *and* PURL as expected, but would not follow the PURL-specific version comparison algorithms. A leftover logic that pre-dates the introduction of vers caused version range analysis to be performed against VulnerableSoftware records that had no CPE information (i.e. maybeMatchCpe returns null). VulnerableSoftware records with PURL information were thus still considered, but in a logic branch that doesn't leverage ecosystem-aware or distro-aware matching. Credit to @xavier-calland for identifying this as per DependencyTrack#5343 (comment) Signed-off-by: nscuro <nscuro@protonmail.com>
Fix PURL-specific version matching being bypassed for components with CPE
…ot/github_actions/docker/build-push-action-7.0.0 build(deps): bump docker/build-push-action from 6.19.2 to 7.0.0
…ot/github_actions/docker/setup-qemu-action-4.0.0 build(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0
Bumps org.apache.maven:maven-artifact from 3.9.13 to 3.9.14. --- updated-dependencies: - dependency-name: org.apache.maven:maven-artifact dependency-version: 3.9.14 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Zureno <pranshu21freak@gmail.com> (cherry picked from commit f8910cc)
…ading-whitespace-clean
Bumps `lib.resilience4j.version` from 2.3.0 to 2.4.0. Updates `io.github.resilience4j:resilience4j-retry` from 2.3.0 to 2.4.0 - [Release notes](https://github.com/resilience4j/resilience4j/releases) - [Changelog](https://github.com/resilience4j/resilience4j/blob/master/RELEASENOTES.adoc) - [Commits](resilience4j/resilience4j@v2.3.0...v2.4.0) Updates `io.github.resilience4j:resilience4j-ratelimiter` from 2.3.0 to 2.4.0 - [Release notes](https://github.com/resilience4j/resilience4j/releases) - [Changelog](https://github.com/resilience4j/resilience4j/blob/master/RELEASENOTES.adoc) - [Commits](resilience4j/resilience4j@v2.3.0...v2.4.0) Updates `io.github.resilience4j:resilience4j-micrometer` from 2.3.0 to 2.4.0 - [Release notes](https://github.com/resilience4j/resilience4j/releases) - [Changelog](https://github.com/resilience4j/resilience4j/blob/master/RELEASENOTES.adoc) - [Commits](resilience4j/resilience4j@v2.3.0...v2.4.0) --- updated-dependencies: - dependency-name: io.github.resilience4j:resilience4j-retry dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: io.github.resilience4j:resilience4j-ratelimiter dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: io.github.resilience4j:resilience4j-micrometer dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [com.microsoft.sqlserver:mssql-jdbc](https://github.com/Microsoft/mssql-jdbc) from 13.2.1.jre11 to 13.4.0.jre11. - [Release notes](https://github.com/Microsoft/mssql-jdbc/releases) - [Changelog](https://github.com/microsoft/mssql-jdbc/blob/main/CHANGELOG.md) - [Commits](https://github.com/Microsoft/mssql-jdbc/commits) --- updated-dependencies: - dependency-name: com.microsoft.sqlserver:mssql-jdbc dependency-version: 13.4.0.jre11 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 8.0.0 to 8.0.1. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@70fc10c...3e5f45b) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps eclipse-temurin from `2866f12` to `a6884e6`. --- updated-dependencies: - dependency-name: eclipse-temurin dependency-version: 25.0.2_10-jdk-alpine dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps debian from `85dfcff` to `99fc6d2`. --- updated-dependencies: - dependency-name: debian dependency-version: stable-slim dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
…ot/docker/src/main/docker/debian-99fc6d2
…ot/docker/src/main/docker/eclipse-temurin-a6884e6
…ot/maven/com.microsoft.sqlserver-mssql-jdbc-13.4.0.jre11
…ot/github_actions/actions/download-artifact-8.0.1
…ot/maven/lib.resilience4j.version-2.4.0
…ot/maven/org.apache.maven-maven-artifact-3.9.14
Bumps [io.swagger.parser.v3:swagger-parser](https://github.com/swagger-api/swagger-parser) from 2.1.38 to 2.1.39. - [Release notes](https://github.com/swagger-api/swagger-parser/releases) - [Commits](swagger-api/swagger-parser@v2.1.38...v2.1.39) --- updated-dependencies: - dependency-name: io.swagger.parser.v3:swagger-parser dependency-version: 2.1.39 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Fixes the internal vulnerability analyzer being unable to differentiate pre-release versions from release versions, which led to false positives. Signed-off-by: nscuro <nscuro@protonmail.com>
…ot/maven/io.swagger.parser.v3-swagger-parser-2.1.39
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Niklas <nscuro@protonmail.com>
Bumps org.metaeffekt.core:ae-security from 0.153.1 to 0.153.2. --- updated-dependencies: - dependency-name: org.metaeffekt.core:ae-security dependency-version: 0.153.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps eclipse-temurin from `a6884e6` to `d556bfd`. --- updated-dependencies: - dependency-name: eclipse-temurin dependency-version: 25.0.2_10-jdk-alpine dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps `lib.protobuf-java.version` from 4.34.0 to 4.34.1. Updates `com.google.protobuf:protobuf-java` from 4.34.0 to 4.34.1 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `com.google.protobuf:protobuf-java-util` from 4.34.0 to 4.34.1 --- updated-dependencies: - dependency-name: com.google.protobuf:protobuf-java dependency-version: 4.34.1 dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: com.google.protobuf:protobuf-java-util dependency-version: 4.34.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…ot/maven/lib.protobuf-java.version-4.34.1
* Replaces usage of BOT_RELEASE_TOKEN with ephemeral GITHUB_TOKEN where the dedicated PAT is not needed. It's only required during release creation so that the `release: created` event is triggered. * Updates release workflow to create releases as draft first, and only publish them after all assets have been uploaded. This enables us to use immutable GitHub releases. * Removes unneeded workflows. Signed-off-by: nscuro <nscuro@protonmail.com>
Harden GitHub Actions workflows
Fixes findings identified by zizmor (https://github.com/zizmorcore/zizmor) Signed-off-by: nscuro <nscuro@protonmail.com>
Address zizmor GitHub Actions findings
…ype BIGINT It's possible that schemas generated by an older version of DT use SERIAL / INT for ID columns. Handle this with explicit casting so the columns can be matched to Java long fields. Signed-off-by: nscuro <nscuro@protonmail.com>
Fix scheduled notification query failing when ID columns are not of type BIGINT
Signed-off-by: Steffen Ohrendorf <steffen.ohrendorf@gmx.de>
Bumps [io.github.ascopes:protobuf-maven-plugin](https://github.com/ascopes/protobuf-maven-plugin) from 5.0.2 to 5.1.0. - [Release notes](https://github.com/ascopes/protobuf-maven-plugin/releases) - [Commits](ascopes/protobuf-maven-plugin@v5.0.2...v5.1.0) --- updated-dependencies: - dependency-name: io.github.ascopes:protobuf-maven-plugin dependency-version: 5.1.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps eclipse-temurin from `d556bfd` to `305fb0c`. --- updated-dependencies: - dependency-name: eclipse-temurin dependency-version: 25.0.2_10-jdk-alpine dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…ot/maven/io.github.ascopes-protobuf-maven-plugin-5.1.0 build(deps-dev): bump io.github.ascopes:protobuf-maven-plugin from 5.0.2 to 5.1.0
…ot/docker/src/main/docker/eclipse-temurin-305fb0c build(deps): bump eclipse-temurin from `d556bfd` to `305fb0c` in /src/main/docker
This was missed when originally introducing versatile. Both the Composer and NuGet meta analyzer rely on manual version comparison to determine the latest component version. Both used ComparableVersion before, which is a class from Maven, and thus can only apply Maven-specific semantics. Signed-off-by: nscuro <nscuro@protonmail.com>
Sonatype Guide uses bearer tokens, whereas OSS Index expects basic auth using email and token. Note that the OSS Index API does not yet support Guide tokens, but will soon. This change ensures a smooth transition when the time comes. Signed-off-by: nscuro <nscuro@protonmail.com>
…atest-version-detection Use ecosystem-aware version comparison for latest version detection
Support Sonatype Guide tokens for OSS Index analyzer
Signed-off-by: nscuro <nscuro@protonmail.com>
Signed-off-by: nscuro <nscuro@protonmail.com>
Fix version in docs
Bump bundled frontend to 4.14.1
It turns out that creating a draft release doesn't trigger a `release: created` event. Instead, we need to push a tag, which then fires the `push: tags` event. For this to work, the push must be performed with a non-default PAT. A BOT_RELEASE_GITHUB_TOKEN secrets has been created with minimal privileges, and scoped to this repository. Note that tags were previously created implicitly when creating the GitHub release. Also replaces commits via GitHub CLI with actual commits using git. Signed-off-by: nscuro <nscuro@protonmail.com>
Fix release workflow
Signed-off-by: Niklas <nscuro@protonmail.com>
Signed-off-by: Niklas <nscuro@protonmail.com>
Signed-off-by: Steffen Ohrendorf <steffen.ohrendorf@gmx.de>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 0 |
| Duplication | 8 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Logs suppression when initially created policy violation audit is suppressed.
Fixes #5967
Checklist