v8.0.0
版本发布时间: 2023-01-15 19:38:40
jeremylong/DependencyCheck最新发布版本:v10.0.4(2024-09-01 20:14:16)
Added
- Utilize the hosted suppression file to allow for faster remediation of reported False Positives (#4723).
- Include the CISA Known Exploited Vulnerability Catalog (#4878).
- The
gradle
andmaven
plugins now have the capability to scan the build plugins (#4035). - The
gradle
andmaven
plugins, for transitive dependencies, will report the root dependency in the project that included the transitive dependency (#5001). - Added
properties.security-severity
to SARIF report for better integration with GitHub Security Code scanning (#5277). - Allow for HTTP auth settings for Retire JS respository (#5209).
- New schema for the XML report was added to support some of the above additions (#5296).
- Added missing gradle option to only warn on remote errors from the OSS Index Analyzer (gradle #303).
Changed
- Breaking: the database schema updated - if using an external database the update scripts must be run!
- The exit codes from the CLI have been changed to be in the range from 0-255 (#4511.
- The OSS Index Analyzer will automatically disable itself if a transport error occurs - preventing copious errors from being reported (#5300).
Fixed
- Added an additional check for rejected CVEs to reduce FP (#5268).
- Corrected the analysis of
node_modules
to prevent NPEs (#5266). - Fixed error when scanning node packages with local dependencies (#5235).
- Fixed NPE in the MSBuild Analyzer (#5293).
- Several False Positives have been resolved.
See the full listing of changes.
1、 dependency-check-8.0.0-release.zip 29.25MB
2、 dependency-check-8.0.0-release.zip.asc 833B
3、 dependency-check-ant-8.0.0-release.zip 26.59MB
4、 dependency-check-ant-8.0.0-release.zip.asc 833B
5、 dependency-check-parent-8.0.0.buildinfo 6.31KB