bea/HidekoBot
1
0
Fork 0
Code Issues 8 Pull Requests 10 Packages Projects Releases Wiki Activity

Update dependency org.owasp:dependency-check-maven to v12.2.2 #72

Open
renovate wants to merge 1 commits from renovate/org.owasp-dependency-check-maven-12.x into main
pull from: renovate/org.owasp-dependency-check-maven-12.x
merge into: :main
Conversation 0 Commits 1 Files Changed 1
+1 -1
renovate commented 2026-04-11 23:08:02 +02:00
Collaborator
Copy Link
Copy Source

This PR contains the following updates:

Package Type Update Change
org.owasp:dependency-check-maven (source) build patch 12.2.0 → 12.2.2

Release Notes

dependency-check/DependencyCheck (org.owasp:dependency-check-maven)

v12.2.2

Compare Source

NOTE: The database schema was updated to fix #​8466 - if using an external database the update scripts must be run!

  • feat: improve Sonatype Guide / OSS Index cache handling and insufficient credits error reporting (#​8451)
  • feat: support and prefer githubID vuln identifiers from RetireJS (#​8419)
  • fix(db): widen reference URL column to handle long Mozilla CVE URLs (#​8467)
  • fix: add corepack to docker image (#​8386)
  • fix: bump open-vulnerability-clients to resolve NVD timestamp parsing errors (#​8427)
  • fix: de-duplicate and sort both includedBy and projectReferences in reports (#​8440)
  • fix: migrate default OSS Index API URL to Sonatype Guide; supporting optional username (#​8404)
  • docs: correct missing documentation for Gradle plugin (#​8431)
  • docs: tweak docs site structure; documenting missing analyzers (#​8462)
  • chore: remove spurious bundle-audit log line when there are no errors (#​8454)
  • chore: tidy CHANGELOG formatting (#​8414)
  • chore(fp): remove duplicate log4j FP suppressions (#​8468)
  • build(deps): bump apache.ant.version from 1.10.16 to 1.10.17 (#​8416)
  • build(deps): bump com.fasterxml.jackson:jackson-bom from 2.21.2 to 2.21.3 (#​8465)
  • build(deps): bump com.google.guava:guava from 33.5.0-jre to 33.6.0-jre (#​8420)
  • build(deps): bump com.mysql:mysql-connector-j from 9.6.0 to 9.7.0 (#​8445)
  • build(deps): bump commons-codec:commons-codec from 1.21.0 to 1.22.0 (#​8453)
  • build(deps): bump commons-io:commons-io from 2.21.0 to 2.22.0 (#​8448)
  • build(deps): bump httpcomponents.client.version from 5.6 to 5.6.1 (#​8432)
  • build(deps): bump joda-time:joda-time from 2.14.1 to 2.14.2 (#​8464)
  • build(deps): bump org.apache.maven.plugins:maven-invoker-plugin from 3.9.1 to 3.10.0 (#​8452)
  • build(deps): bump org.jsoup:jsoup from 1.22.1 to 1.22.2 (#​8437)
  • build(deps): bump org.postgresql:postgresql from 42.7.10 to 42.7.11 (#​8463)
  • build(deps): bump the actions-deps group with 8 updates (#​8472)

See the full listing of changes

v12.2.1

Compare Source

  • fix(core): correct xml schema validation handling without needing external access (#​8272)
  • fix(deps): upgrade slf4j and logback (#​8306)
  • fix(test): disable pnpm analyzer during test (#​8305)
  • fix: Correct published/hosted suppressions namespace header and indent (#​8258)
  • fix: Suppress noisy WARN logging from Apache Lucene within Maven and Ant plugins (#​8248)
  • fix: #​8140 AssemblyAnalyzer version resolution issue (#​8352)
  • fix: #​8140 fix version resolution
  • fix: #​8140 hint azure_identity_library_for_.net
  • fix: #​8356 narrow down VersionFilterAnalyzer scope to JAR files (#​8358)
  • fix: correct parsing for CVSSv4 strings with Provider Urgency (#​8377)
  • fix: evidence source in Retire JS analyzer (#​8303)
  • fix: exclude deprecations from Yarn Berry audit results (#​8380)
  • fix: improve PEAnalyzer reliability by migrating to maintained PE/COFF 4J library fork (#​8245)
  • fix: improve configuration consistency (casing) (#​8355)
  • fix: improve logging of unexpected Java Errors during processing of NVD (#​8250)
  • fix: raw type warning in ProcessReader (#​8324)
  • fix: suppress false positives for zabbix-utils #​8087 (#​8218)
  • fix: update docs (#​8405)
  • fix: warn if deprecated configs are used (#​8366)
  • docs: define schema locations in XML examples (#​8254)
  • docs: document external data sources and hostnames (#​8219)
  • docs: ensure OSS Index URL override is consistently documented (#​8338)
  • docs: fix minor typo in README (#​8246)
  • chore: avoid use of parent pom and maven properties where unnecessary (#​8322)
  • chore: bump java development to 25.0 (#​8365)
  • chore: fix Charset warnings; preferring typed charsets (#​8326)
  • chore: fix Maven scm tags after 12.2.1-SNAPSHOT bump (#​8265)
  • chore: pin GitHub actions to specific SHAs rather than mutable tags (#​8381)
  • chore: remove unused properties and schemas (#​8378)
  • test: Make tests locale independent (#​8328)
  • test: #​8140 reproduce current behavior
  • test: avoid polluting test classpaths with sample dependencies to be scanned (#​8267)
  • build: improve GHA workflow experience for forks (#​8285)
  • build: use maven jdk toolchains to build with Java 25; test against Java 11/17/21/25 (#​8292)

See the full listing of changes

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [org.owasp:dependency-check-maven](https://github.com/dependency-check/DependencyCheck.git) ([source](https://github.com/dependency-check/DependencyCheck/tree/HEAD/maven)) | build | patch | `12.2.0` → `12.2.2` | --- ### Release Notes <details> <summary>dependency-check/DependencyCheck (org.owasp:dependency-check-maven)</summary> ### [`v12.2.2`](https://github.com/dependency-check/DependencyCheck/blob/HEAD/CHANGELOG.md#Version-1222-2026-05-03) [Compare Source](https://github.com/dependency-check/DependencyCheck/compare/v12.2.1...v12.2.2) **NOTE**: The database schema was updated to fix [#&#8203;8466](https://github.com/dependency-check/DependencyCheck/pull/8466) - if using an external database the update scripts must be run! - feat: improve Sonatype Guide / OSS Index cache handling and insufficient credits error reporting ([#&#8203;8451](https://github.com/dependency-check/DependencyCheck/pull/8451)) - feat: support and prefer githubID vuln identifiers from RetireJS ([#&#8203;8419](https://github.com/dependency-check/DependencyCheck/pull/8419)) - fix(db): widen reference URL column to handle long Mozilla CVE URLs ([#&#8203;8467](https://github.com/dependency-check/DependencyCheck/pull/8467)) - fix: add corepack to docker image ([#&#8203;8386](https://github.com/dependency-check/DependencyCheck/pull/8386)) - fix: bump open-vulnerability-clients to resolve NVD timestamp parsing errors ([#&#8203;8427](https://github.com/dependency-check/DependencyCheck/pull/8427)) - fix: de-duplicate and sort both `includedBy` and `projectReferences` in reports ([#&#8203;8440](https://github.com/dependency-check/DependencyCheck/pull/8440)) - fix: migrate default OSS Index API URL to Sonatype Guide; supporting optional username ([#&#8203;8404](https://github.com/dependency-check/DependencyCheck/pull/8404)) - docs: correct missing documentation for Gradle plugin ([#&#8203;8431](https://github.com/dependency-check/DependencyCheck/pull/8431)) - docs: tweak docs site structure; documenting missing analyzers ([#&#8203;8462](https://github.com/dependency-check/DependencyCheck/pull/8462)) - chore: remove spurious bundle-audit log line when there are no errors ([#&#8203;8454](https://github.com/dependency-check/DependencyCheck/pull/8454)) - chore: tidy CHANGELOG formatting ([#&#8203;8414](https://github.com/dependency-check/DependencyCheck/pull/8414)) - chore(fp): remove duplicate log4j FP suppressions ([#&#8203;8468](https://github.com/dependency-check/DependencyCheck/pull/8468)) - build(deps): bump apache.ant.version from 1.10.16 to 1.10.17 ([#&#8203;8416](https://github.com/dependency-check/DependencyCheck/pull/8416)) - build(deps): bump com.fasterxml.jackson:jackson-bom from 2.21.2 to 2.21.3 ([#&#8203;8465](https://github.com/dependency-check/DependencyCheck/pull/8465)) - build(deps): bump com.google.guava:guava from 33.5.0-jre to 33.6.0-jre ([#&#8203;8420](https://github.com/dependency-check/DependencyCheck/pull/8420)) - build(deps): bump com.mysql:mysql-connector-j from 9.6.0 to 9.7.0 ([#&#8203;8445](https://github.com/dependency-check/DependencyCheck/pull/8445)) - build(deps): bump commons-codec:commons-codec from 1.21.0 to 1.22.0 ([#&#8203;8453](https://github.com/dependency-check/DependencyCheck/pull/8453)) - build(deps): bump commons-io:commons-io from 2.21.0 to 2.22.0 ([#&#8203;8448](https://github.com/dependency-check/DependencyCheck/pull/8448)) - build(deps): bump httpcomponents.client.version from 5.6 to 5.6.1 ([#&#8203;8432](https://github.com/dependency-check/DependencyCheck/pull/8432)) - build(deps): bump joda-time:joda-time from 2.14.1 to 2.14.2 ([#&#8203;8464](https://github.com/dependency-check/DependencyCheck/pull/8464)) - build(deps): bump org.apache.maven.plugins:maven-invoker-plugin from 3.9.1 to 3.10.0 ([#&#8203;8452](https://github.com/dependency-check/DependencyCheck/pull/8452)) - build(deps): bump org.jsoup:jsoup from 1.22.1 to 1.22.2 ([#&#8203;8437](https://github.com/dependency-check/DependencyCheck/pull/8437)) - build(deps): bump org.postgresql:postgresql from 42.7.10 to 42.7.11 ([#&#8203;8463](https://github.com/dependency-check/DependencyCheck/pull/8463)) - build(deps): bump the actions-deps group with 8 updates ([#&#8203;8472](https://github.com/dependency-check/DependencyCheck/pull/8472)) See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/106?closed=1) ### [`v12.2.1`](https://github.com/dependency-check/DependencyCheck/blob/HEAD/CHANGELOG.md#Version-1221-2026-04-11) [Compare Source](https://github.com/dependency-check/DependencyCheck/compare/v12.2.0...v12.2.1) - fix(core): correct xml schema validation handling without needing external access ([#&#8203;8272](https://github.com/dependency-check/DependencyCheck/pull/8272)) - fix(deps): upgrade slf4j and logback ([#&#8203;8306](https://github.com/dependency-check/DependencyCheck/pull/8306)) - fix(test): disable pnpm analyzer during test ([#&#8203;8305](https://github.com/dependency-check/DependencyCheck/pull/8305)) - fix: Correct published/hosted suppressions namespace header and indent ([#&#8203;8258](https://github.com/dependency-check/DependencyCheck/pull/8258)) - fix: Suppress noisy WARN logging from Apache Lucene within Maven and Ant plugins ([#&#8203;8248](https://github.com/dependency-check/DependencyCheck/pull/8248)) - fix: [#&#8203;8140](https://github.com/dependency-check/DependencyCheck/pull/8140) AssemblyAnalyzer version resolution issue ([#&#8203;8352](https://github.com/dependency-check/DependencyCheck/pull/8352)) - fix: [#&#8203;8140](https://github.com/dependency-check/DependencyCheck/pull/8140) fix version resolution - fix: [#&#8203;8140](https://github.com/dependency-check/DependencyCheck/pull/8140) hint azure\_identity\_library\_for\_.net - fix: [#&#8203;8356](https://github.com/dependency-check/DependencyCheck/pull/8356) narrow down VersionFilterAnalyzer scope to JAR files ([#&#8203;8358](https://github.com/dependency-check/DependencyCheck/pull/8358)) - fix: correct parsing for CVSSv4 strings with Provider Urgency ([#&#8203;8377](https://github.com/dependency-check/DependencyCheck/pull/8377)) - fix: evidence source in Retire JS analyzer ([#&#8203;8303](https://github.com/dependency-check/DependencyCheck/pull/8303)) - fix: exclude deprecations from Yarn Berry audit results ([#&#8203;8380](https://github.com/dependency-check/DependencyCheck/pull/8380)) - fix: improve PEAnalyzer reliability by migrating to maintained PE/COFF 4J library fork ([#&#8203;8245](https://github.com/dependency-check/DependencyCheck/pull/8245)) - fix: improve configuration consistency (casing) ([#&#8203;8355](https://github.com/dependency-check/DependencyCheck/pull/8355)) - fix: improve logging of unexpected Java Errors during processing of NVD ([#&#8203;8250](https://github.com/dependency-check/DependencyCheck/pull/8250)) - fix: raw type warning in ProcessReader ([#&#8203;8324](https://github.com/dependency-check/DependencyCheck/pull/8324)) - fix: suppress false positives for zabbix-utils [#&#8203;8087](https://github.com/dependency-check/DependencyCheck/pull/8087) ([#&#8203;8218](https://github.com/dependency-check/DependencyCheck/pull/8218)) - fix: update docs ([#&#8203;8405](https://github.com/dependency-check/DependencyCheck/pull/8405)) - fix: warn if deprecated configs are used ([#&#8203;8366](https://github.com/dependency-check/DependencyCheck/pull/8366)) - docs: define schema locations in XML examples ([#&#8203;8254](https://github.com/dependency-check/DependencyCheck/pull/8254)) - docs: document external data sources and hostnames ([#&#8203;8219](https://github.com/dependency-check/DependencyCheck/pull/8219)) - docs: ensure OSS Index URL override is consistently documented ([#&#8203;8338](https://github.com/dependency-check/DependencyCheck/pull/8338)) - docs: fix minor typo in README ([#&#8203;8246](https://github.com/dependency-check/DependencyCheck/pull/8246)) - chore: avoid use of parent pom and maven properties where unnecessary ([#&#8203;8322](https://github.com/dependency-check/DependencyCheck/pull/8322)) - chore: bump java development to 25.0 ([#&#8203;8365](https://github.com/dependency-check/DependencyCheck/pull/8365)) - chore: fix Charset warnings; preferring typed charsets ([#&#8203;8326](https://github.com/dependency-check/DependencyCheck/pull/8326)) - chore: fix Maven scm tags after 12.2.1-SNAPSHOT bump ([#&#8203;8265](https://github.com/dependency-check/DependencyCheck/pull/8265)) - chore: pin GitHub actions to specific SHAs rather than mutable tags ([#&#8203;8381](https://github.com/dependency-check/DependencyCheck/pull/8381)) - chore: remove unused properties and schemas ([#&#8203;8378](https://github.com/dependency-check/DependencyCheck/pull/8378)) - test: Make tests locale independent ([#&#8203;8328](https://github.com/dependency-check/DependencyCheck/pull/8328)) - test: [#&#8203;8140](https://github.com/dependency-check/DependencyCheck/pull/8140) reproduce current behavior - test: avoid polluting test classpaths with sample dependencies to be scanned ([#&#8203;8267](https://github.com/dependency-check/DependencyCheck/pull/8267)) - build: improve GHA workflow experience for forks ([#&#8203;8285](https://github.com/dependency-check/DependencyCheck/pull/8285)) - build: use maven jdk toolchains to build with Java 25; test against Java 11/17/21/25 ([#&#8203;8292](https://github.com/dependency-check/DependencyCheck/pull/8292)) See the full listing of [changes](https://github.com/dependency-check/DependencyCheck/milestone/104?closed=1) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMTAuMTYiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->
renovate added 1 commit 2026-05-03 15:06:34 +02:00
Update dependency org.owasp:dependency-check-maven to v12.2.2
continuous-integration/drone/pr Build is passing
Details
1e069a824e
renovate force-pushed renovate/org.owasp-dependency-check-maven-12.x from 394c6ed41c to 1e069a824e 2026-05-03 15:06:34 +02:00 Compare
renovate changed title from Update dependency org.owasp:dependency-check-maven to v12.2.1 to Update dependency org.owasp:dependency-check-maven to v12.2.2 2026-05-03 15:06:36 +02:00
All checks were successful
continuous-integration/drone/pr Build is passing
Details
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/org.owasp-dependency-check-maven-12.x:renovate/org.owasp-dependency-check-maven-12.x
git checkout renovate/org.owasp-dependency-check-maven-12.x
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
judas (judas) renovate (renovate) bea (Beatrice Dellacà)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: bea/HidekoBot#72