Update module gitlab.com/gitlab-org/security-products/analyzers/dependency-scanning to v0.44.2 (master) (!1079) · Merge requests · GitLab.org / security-products / analyzers / gemnasium

This MR contains the following updates:

Package	Type	Update	Change
gitlab.com/gitlab-org/security-products/analyzers/dependency-scanning	require	minor	`v0.34.0` -> `v0.44.2`

⚠️ Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

gitlab-org/security-products/analyzers/dependency-scanning (gitlab.com/gitlab-org/security-products/analyzers/dependency-scanning)

`v0.44.2`

Compare Source

Fixed

Fix panic when vulnerability scanning is enabled and non-fatal error is returned by API (dependency-scanning!358 (merged))

`v0.44.1`

Compare Source

Fixed

Reduce risk of failure due to sbom scan taking longer than expected by increasing retry backoff (dependency-scanning!356 (merged))

Added

Prevent scan failure when the SBOM scan API returns a generic 403 (dependency-scanning!355 (merged))

`v0.42.3`

Compare Source

Maintenance

Update gitlab.com/gitlab-org/security-products/analyzers/report/v5 from v5.12.0 to v6.2.1 (dependency-scanning!299 (merged))

`v0.42.2`

Compare Source

Fixed

Trim trailing forward slashes in Swift package names to ensure valid PURL creation (dependency-scanning!353 (merged))

`v0.42.1`

Compare Source

Fixed

Continue parsing package-lock.json files when npm dependencies do not have separate entries (dependency-scanning!351 (merged))

`v0.42.0`

Compare Source

Added

Enable vulnerability scanning by default with GitLab >= 18.5 and temporarily skip its execution when SBOM scan API feature flag is disabled or rate limit is reached (dependency-scanning!349 (merged))

`v0.41.3`

Compare Source

Fixed

Reverted previous commit (dependency-scanning!350 (merged))

`v0.41.2`

Compare Source

Fixed

Continue parsing package-lock.json files when bundled npm dependencies do not have separate entries (dependency-scanning!340 (merged))

`v0.41.1`

Compare Source

Fixed

Revert default enablement of vulnerability scanning (dependency-scanning!348 (merged))

`v0.41.0`

Compare Source

Added

Enable vulnerability scanning by default and temporarily skip it when SBOM scan API feature flag is disabled (dependency-scanning!347 (merged))

`v0.40.0`

Compare Source

Added

Update releasing image to public repo without the v prefix (dependency-scanning!346 (merged))

`v0.39.5`

Compare Source

Fixed

Fix scan failure when poetry project depends on setuptools or pip. (dependency-scanning!342 (merged))

`v0.39.4`

Compare Source

Maintenance

Update github.com/urfave/cli/v2 from v2.27.6 to v2.27.7 (dependency-scanning!262 (merged))

`v0.39.3`

Compare Source

Maintenance

Update golang.org/x/sync from v0.16.0 to v0.17.0 (dependency-scanning!337 (merged))

`v0.39.2`

Compare Source

Fixed

Fix issue opening go.mod and go.graph files (dependency-scanning!341 (merged))

`v0.39.1`

Compare Source

Fixed

Fix golang dependency graph generation (dependency-scanning!326 (merged))

`v0.39.0`

Compare Source

Added

Introduce static reachability analysis for Java (dependency-scanning!320 (merged))

`v0.38.1`

Compare Source

Fixed

Correctly handle scan.scanner values from API (dependency-scanning!338 (merged))

`v0.38.0`

Compare Source

Added

Warn user when project has reached the soft rate limit for the SBOM vulnerability scanning API. (dependency-scanning!332 (merged))

`v0.37.0`

Compare Source

Added

Add vulnerability scanning capability to the run command. After generating SBOM files, the command now sends these files to a dedicated endpoint in the GitLab API to scan them for vulnerabilities. Once all scan results have been downloaded, a single dependency scanning security report is generated. (dependency-scanning!221 (merged))