build(deps): bump io.github.jeremylong:open-vulnerability-clients from 7.3.2 to 9.0.1

[dependabot]

Bumps io.github.jeremylong:open-vulnerability-clients from 7.3.2 to 8.0.0.

Release notes

Sourced from io.github.jeremylong:open-vulnerability-clients's releases.

v8.0.0

What's Changed

• feat: implement forced http caching on full mirror of NVD by @​jeremylong in jeremylong/open-vulnerability-cli#287
• feat: reduce memory usage by @​jeremylong in jeremylong/open-vulnerability-cli#288
• feat: mirror additional sources by @​jeremylong in jeremylong/open-vulnerability-cli#292
• chore: Upgrade to spring boot 3.4 and Java 17 fixes #263 by @​EugenMayer in jeremylong/open-vulnerability-cli#278

Full Changelog: jeremylong/open-vulnerability-cli@v7.2.2...v8.0.0

Commits

• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[aikebah]

LGTM

[aikebah]

@nhumblot Think this could be merged too? Or is there a reason to not include it in a minor release of ODC?

[jeremylong]

I felt this was a breaking change - so I was going to include it in the next major release. At least we should wait for the next minor release as opposed to the pending point release.

[aikebah]

While for the library it was a breaking release (split between CLI and the library code as separately released projects), I think for ODC it would not be a non-breaking change.

AFAICT We're only adapting our internals and introducing two configuration properties (not exposed to the plugin configs) - one might consider the added properties a new feature for people using properties-file configurstion, so I can see how you may want to skip the revision level and wait for a feature release, though I would say for a proper feature it should be extended with extending the configurability in the gradle- and maven plugin configuration settings.

[nhumblot]

Hi,

Sorry for the late reply.

I marked commit 8cc9ade with a ! because I thought an upgrade with this change might break for users using the CLI with the -P or --propertyfile option.

Documentation

I have to admit I did not manual test this part extensively. I am going to proceed additional testing and share with you if my initial thought was good or not.

[dependabot]

A newer version of io.github.jeremylong:open-vulnerability-clients exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

[jeremylong]

I'll revisit this PR soon based on @aikebah's comment above and the recent release of 9.0.1 (although most of the changes in 9.0.1 are related to GHSA).

[nhumblot]

Hi,

Sorry for the late reply.

I marked commit 8cc9ade with a ! because I thought an upgrade with this change might break for users using the CLI with the -P or --propertyfile option.

Documentation

I have to admit I did not manual test this part extensively. I am going to proceed additional testing and share with you if my initial thought was good or not.

This supposition is invalid.

This is not a blocker change as default values are hard-coded into core/src/main/java/org/owasp/dependencycheck/data/update/NvdApiDataSource.java. In case the properties are absent from a property file passed with the -P argument, while using the CLI, the hard-coded values apply.

Test conducted with a CLI packaged from commit 63575bb (HEAD of branch dependabot/maven/io.github.jeremylong-open-vulnerability-clients-8.0.0) and ran with the properties file of commit 5a41209 (HEAD of main).

I removed the breaking change notification ! in the title of the PR.

[nhumblot]

I'll revisit this PR soon based on @aikebah's comment above and the recent release of 9.0.1 (although most of the changes in 9.0.1 are related to GHSA).

Major version bump to 9.x.x is due to the removal of a public getter, which is not used by Dependency Check. I proposed to add it in this PR through 10de1bb. PR title has been changed.