Signed-off-by: Niklas <nscuro@protonmail.com>

Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.7.0 to 4.0.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@c7c5346...ce36039)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.19.2 to 7.0.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@10e90e3...d08e5c3)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: Niklas <nscuro@protonmail.com>

… CPE

The previous logic did not explicitly "parse" the component's PURL when the component also has a CPE. It would still go on to fetch VulnerableSoftware records for CPE *and* PURL as expected, but would not follow the PURL-specific version comparison algorithms.

A leftover logic that pre-dates the introduction of vers caused version range analysis to be performed against VulnerableSoftware records that had no CPE information (i.e. maybeMatchCpe returns null). VulnerableSoftware records with PURL information were thus still considered, but in a logic branch that doesn't leverage ecosystem-aware or distro-aware matching.

Credit to @xavier-calland for identifying this as per DependencyTrack#5343 (comment)

Signed-off-by: nscuro <nscuro@protonmail.com>

Fix PURL-specific version matching being bypassed for components with CPE

…ot/github_actions/docker/build-push-action-7.0.0

build(deps): bump docker/build-push-action from 6.19.2 to 7.0.0

…ot/github_actions/docker/setup-qemu-action-4.0.0

build(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0

Bumps org.apache.maven:maven-artifact from 3.9.13 to 3.9.14.

---
updated-dependencies:
- dependency-name: org.apache.maven:maven-artifact
  dependency-version: 3.9.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: Zureno <pranshu21freak@gmail.com>
(cherry picked from commit f8910cc)

…ading-whitespace-clean

Bumps `lib.resilience4j.version` from 2.3.0 to 2.4.0.

Updates `io.github.resilience4j:resilience4j-retry` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/resilience4j/resilience4j/releases)
- [Changelog](https://github.com/resilience4j/resilience4j/blob/master/RELEASENOTES.adoc)
- [Commits](resilience4j/resilience4j@v2.3.0...v2.4.0)

Updates `io.github.resilience4j:resilience4j-ratelimiter` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/resilience4j/resilience4j/releases)
- [Changelog](https://github.com/resilience4j/resilience4j/blob/master/RELEASENOTES.adoc)
- [Commits](resilience4j/resilience4j@v2.3.0...v2.4.0)

Updates `io.github.resilience4j:resilience4j-micrometer` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/resilience4j/resilience4j/releases)
- [Changelog](https://github.com/resilience4j/resilience4j/blob/master/RELEASENOTES.adoc)
- [Commits](resilience4j/resilience4j@v2.3.0...v2.4.0)

---
updated-dependencies:
- dependency-name: io.github.resilience4j:resilience4j-retry
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.github.resilience4j:resilience4j-ratelimiter
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.github.resilience4j:resilience4j-micrometer
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [com.microsoft.sqlserver:mssql-jdbc](https://github.com/Microsoft/mssql-jdbc) from 13.2.1.jre11 to 13.4.0.jre11.
- [Release notes](https://github.com/Microsoft/mssql-jdbc/releases)
- [Changelog](https://github.com/microsoft/mssql-jdbc/blob/main/CHANGELOG.md)
- [Commits](https://github.com/Microsoft/mssql-jdbc/commits)

---
updated-dependencies:
- dependency-name: com.microsoft.sqlserver:mssql-jdbc
  dependency-version: 13.4.0.jre11
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 8.0.0 to 8.0.1.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@70fc10c...3e5f45b)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps eclipse-temurin from `2866f12` to `a6884e6`.

---
updated-dependencies:
- dependency-name: eclipse-temurin
  dependency-version: 25.0.2_10-jdk-alpine
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps debian from `85dfcff` to `99fc6d2`.

---
updated-dependencies:
- dependency-name: debian
  dependency-version: stable-slim
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

…ot/docker/src/main/docker/debian-99fc6d2

…ot/docker/src/main/docker/eclipse-temurin-a6884e6

…ot/maven/com.microsoft.sqlserver-mssql-jdbc-13.4.0.jre11

…ot/github_actions/actions/download-artifact-8.0.1

…ot/maven/lib.resilience4j.version-2.4.0

…ot/maven/org.apache.maven-maven-artifact-3.9.14

Bumps [io.swagger.parser.v3:swagger-parser](https://github.com/swagger-api/swagger-parser) from 2.1.38 to 2.1.39.
- [Release notes](https://github.com/swagger-api/swagger-parser/releases)
- [Commits](swagger-api/swagger-parser@v2.1.38...v2.1.39)

---
updated-dependencies:
- dependency-name: io.swagger.parser.v3:swagger-parser
  dependency-version: 2.1.39
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Fixes the internal vulnerability analyzer being unable to differentiate pre-release versions from release versions, which led to false positives.

Signed-off-by: nscuro <nscuro@protonmail.com>

…ot/maven/io.swagger.parser.v3-swagger-parser-2.1.39

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Niklas <nscuro@protonmail.com>

Bumps org.metaeffekt.core:ae-security from 0.153.1 to 0.153.2.

---
updated-dependencies:
- dependency-name: org.metaeffekt.core:ae-security
  dependency-version: 0.153.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps eclipse-temurin from `a6884e6` to `d556bfd`.

---
updated-dependencies:
- dependency-name: eclipse-temurin
  dependency-version: 25.0.2_10-jdk-alpine
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

…ot/maven/lib.protobuf-java.version-4.34.1

* Replaces usage of BOT_RELEASE_TOKEN with ephemeral GITHUB_TOKEN where the dedicated PAT is not needed. It's only required during release creation so that the `release: created` event is triggered.
* Updates release workflow to create releases as draft first, and only publish them after all assets have been uploaded. This enables us to use immutable GitHub releases.
* Removes unneeded workflows.

Signed-off-by: nscuro <nscuro@protonmail.com>

Harden GitHub Actions workflows

Fixes findings identified by zizmor (https://github.com/zizmorcore/zizmor)

Signed-off-by: nscuro <nscuro@protonmail.com>

Address zizmor GitHub Actions findings

…ype BIGINT

It's possible that schemas generated by an older version of DT use SERIAL / INT for ID columns. Handle this with explicit casting so the columns can be matched to Java long fields.

Signed-off-by: nscuro <nscuro@protonmail.com>

Fix scheduled notification query failing when ID columns are not of type BIGINT

Signed-off-by: Steffen Ohrendorf <steffen.ohrendorf@gmx.de>

Bumps [io.github.ascopes:protobuf-maven-plugin](https://github.com/ascopes/protobuf-maven-plugin) from 5.0.2 to 5.1.0.
- [Release notes](https://github.com/ascopes/protobuf-maven-plugin/releases)
- [Commits](ascopes/protobuf-maven-plugin@v5.0.2...v5.1.0)

---
updated-dependencies:
- dependency-name: io.github.ascopes:protobuf-maven-plugin
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bumps eclipse-temurin from `d556bfd` to `305fb0c`.

---
updated-dependencies:
- dependency-name: eclipse-temurin
  dependency-version: 25.0.2_10-jdk-alpine
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

…ot/maven/io.github.ascopes-protobuf-maven-plugin-5.1.0

build(deps-dev): bump io.github.ascopes:protobuf-maven-plugin from 5.0.2 to 5.1.0

…ot/docker/src/main/docker/eclipse-temurin-305fb0c

build(deps): bump eclipse-temurin from `d556bfd` to `305fb0c` in /src/main/docker

This was missed when originally introducing versatile. Both the Composer and NuGet meta analyzer rely on manual version comparison to determine the latest component version. Both used ComparableVersion before, which is a class from Maven, and thus can only apply Maven-specific semantics.

Signed-off-by: nscuro <nscuro@protonmail.com>

Sonatype Guide uses bearer tokens, whereas OSS Index expects basic auth using email and token.

Note that the OSS Index API does not yet support Guide tokens, but will soon. This change ensures a smooth transition when the time comes.

Signed-off-by: nscuro <nscuro@protonmail.com>

…atest-version-detection

Use ecosystem-aware version comparison for latest version detection

Support Sonatype Guide tokens for OSS Index analyzer

Signed-off-by: nscuro <nscuro@protonmail.com>

Signed-off-by: nscuro <nscuro@protonmail.com>

Fix version in docs

Bump bundled frontend to 4.14.1

It turns out that creating a draft release doesn't trigger a `release: created` event. Instead, we need to push a tag, which then fires the `push: tags` event.

For this to work, the push must be performed with a non-default PAT. A BOT_RELEASE_GITHUB_TOKEN secrets has been created with minimal privileges, and scoped to this repository.

Note that tags were previously created implicitly when creating the GitHub release.

Also replaces commits via GitHub CLI with actual commits using git.

Signed-off-by: nscuro <nscuro@protonmail.com>

Fix release workflow

Signed-off-by: Niklas <nscuro@protonmail.com>

Signed-off-by: Niklas <nscuro@protonmail.com>

Signed-off-by: Steffen Ohrendorf <steffen.ohrendorf@gmx.de>