OWASP Dependency-Track v5.0.5 released

By SecBurg

OWASP Dependency-Track continuously monitors SBOMs for known vulnerabilities, helping organizations track and reduce risk across their software supply chain.

Version 5.0.5 is a maintenance release backporting one enhancement and eight bug fixes to the v5 branch, covering fixes for component metrics, notification templates, license names, and OSV version range conversion.

Changelog for v5.0.5:

## What's Changed
### Enhancements 🚀
* Backport: Leverage OSV's modified_id.csv list for full archive downloads by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/7073
### Bug Fixes 🐛
* Backport: Fix teams being logged as object references instead of names by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/7059
* Backport: Fix 500 in /v1/vulnerability/component/{uuid} when a project has >1 analysis for the same vuln by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/7060
* Backport: v4-migrator: Fix unique constraint violation on duplicate OIDC group mappings by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/7061
* Backport: Fix unassigned severity missing from component metrics by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/7062
* Backport: Fix component license name not being returned by v2 component APIs by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/7063
* Backport: Fix POLICY_VIOLATION notification templates referencing nonexistent policyCondition field by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/7064
* Backport: Fix notification templates referencing nonexistent variables by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/7069
* Backport: Fix conversion of OSV version ranges by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/7072
### Dependency Updates 🤖
* Backport: Bump Temurin base image to 25.0.4_7 by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/7071
### Other Changes
* Backport: Add zizmor CI job by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/7065
* Backport: Add CodeQL analysis by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/7066
* Backport: Generate SLSA build provenance by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/7067
* Backport: Have release notes refer to upgrade notes by @nscuro in https://github.com/DependencyTrack/dependency-track/pull/7095

Full Changelog: https://github.com/DependencyTrack/dependency-track/compare/5.0.4...5.0.5

Full release notes: GitHub releases