Release Milestone 4.13

[cheapshot2000]

Would it be possible to move the remaining/open issues in the 4.13 milestone to another and then release 4.13?
https://github.com/DependencyTrack/dependency-track/milestone/38

We are currently running 14.12.1 as it has some of the fixes we needed for Trivy (thank you again for the rapid support there). However, there are items in the 14.13 closed list that we also have been looking forward to implementing (esp. Collection Projects).

Or is there another way for us to run 4.13 as it stands now with the fixes from 4.12.1 too?

[cheapshot2000]

@nscuro - Any thoughts?

[acidghost]

Would be amazing to have Collection Projects shipped sooner! 😍

[nscuro]

We'll be looking into moving some issues planned for v4.13 to v4.14.

In the meantime, you could help us by testing the new feature using the snapshot builds: https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#testing-snapshot-versions

[acidghost]

@nscuro FWIW I've been running a couple of snapshot versions (e.g. latest image as of 2025-01-29) for the past month specifically to test Collection Projects and haven't had any issue for my use-cases.

[cheapshot2000]

@acidghost - Do you use Trivy integration? If so, have you had any issues?

[Shadow-Templar]

@nscuro has there been any reported issues with Trivy not working with 4.13?

Context: We had recently deployed 4.13-snapshot for testing. It has been observed that Trivy is failing to analyze boms and produce vulnerabilities. When sifting through the APIserver logs we see

Essentially, it states the Trivy analysis is running and completing, however, no results

[nscuro]

There was a bug causing NPEs during Trivy analysis, which has been fixed in #4668. The fix is included in the latest snapshot build and will also be released in v4.12.6 which we plan to publish on Monday.

CC @cheapshot2000 since you asked underneath another comment of this discussion.

[cheapshot2000]

@nscuro Even with the latest snapshot, we are still seeing projects without the analysis come back into DT. If you got ideas where to dig for more information, im happy to try and get some logs or try something different. Trivy version is the latest 59 as well.

[nscuro]

Should be fixed in latest snapshot and 4.12.7 as per #4735

[cheapshot2000]

@nscuro - Latest snapshot is working great - thank you!