Merge branch 'main' into refresh-risk-score

.github/workflows/_meta-build.yaml

@@ -27,10 +27,10 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.1
 
       - name: Set up NodeJs
-        uses: actions/[email protected].3
+        uses: actions/[email protected].4
         with:
           node-version: '20'
           cache: 'npm'
@@ -43,7 +43,7 @@ jobs:
           npm run build --if-present
 
       - name: Upload Artifacts
-        uses: actions/upload-artifact@v4.3.4
+        uses: actions/upload-artifact@v4.4.2
         with:
           name: assembled-frontend
           path: |-
@@ -60,24 +60,24 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.1
 
       - name: Download Artifacts
         uses: actions/[email protected]
         with:
           name: assembled-frontend
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.1.0
+        uses: docker/setup-qemu-action@v3.2.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.4.0
+        uses: docker/setup-buildx-action@v3.7.1
         id: buildx
         with:
           install: true
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3.2.0
+        uses: docker/login-action@v3.3.0
         if: ${{ inputs.publish-container }}
         with:
           registry: ghcr.io
@@ -102,7 +102,7 @@ jobs:
           echo "tags=${TAGS}" >> $GITHUB_OUTPUT
 
       - name: Build multi-arch Container Image
-        uses: docker/build-push-action@v6.4.0
+        uses: docker/build-push-action@v6.9.0
         with:
           tags: ${{ steps.tags.outputs.tags }}
           build-args: |-
@@ -115,7 +115,7 @@ jobs:
 
       - name: Run Trivy Vulnerability Scanner
         if: ${{ inputs.publish-container }}
-        uses: aquasecurity/trivy-action@0.24.0
+        uses: aquasecurity/trivy-action@0.26.0
         with:
           image-ref: ghcr.io/dependencytrack/hyades-frontend:${{ inputs.app-version }}
           format: 'sarif'

.github/workflows/ci-publish.yaml

@@ -22,7 +22,7 @@ jobs:
           fi
 
       - name: Checkout Repository
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.1
 
       - name: Parse Version from package.json
         id: parse
@@ -52,7 +52,7 @@ jobs:
       - call-build
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.1
 
       - name: Download Artifacts
         uses: actions/[email protected]

.github/workflows/ci-release.yaml

@@ -21,10 +21,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/[email protected]
+        uses: actions/[email protected]
+        with:
+          persist-credentials: false
 
       - name: Set up NodeJs
-        uses: actions/[email protected].3
+        uses: actions/[email protected].4
         with:
           node-version: '20'
           cache: 'npm'
@@ -36,7 +38,11 @@ jobs:
 
           npm version ${{ github.event.inputs.version-to-bump }} -m "prepare-release: set version to %s"
 
-          git push origin "HEAD:${{ github.ref }}"
+      - name: Push Changes
+        uses: ad-m/github-push-action@master
+        with:
+          branch: ${{ github.ref }}
+          github_token: ${{ secrets.BOT_RELEASE_TOKEN }}
 
       - name: Create GitHub Release
         env:

.github/workflows/codeql-analysis.yaml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.1
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL

.github/workflows/dependency-review.yaml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.1
 
       - name: Dependency Review
         uses: actions/dependency-review-action@v4

.github/workflows/i18n.yaml

@@ -18,10 +18,10 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.1
 
       - name: Set up NodeJs
-        uses: actions/[email protected].3
+        uses: actions/[email protected].4
         with:
           node-version: '20'
           cache: 'npm'

.github/workflows/lint.yaml

@@ -18,10 +18,10 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4.1.7
+        uses: actions/checkout@v4.2.1
 
       - name: Set up NodeJs
-        uses: actions/[email protected].3
+        uses: actions/[email protected].4
         with:
           node-version: '20'
           cache: 'npm'

docker/Dockerfile.alpine

@@ -1,4 +1,4 @@
-FROM nginxinc/nginx-unprivileged:1.27.0-alpine@sha256:8f14986c54fab310b3c69186d814d6238a771f5569cf073c261e675daba88194
+FROM nginxinc/nginx-unprivileged:1.27.2-alpine@sha256:cf998f0d01644f219ba93374491336bad1b6c964ac975d3e19d2ea81dd8dc526
 
 # Arguments that can be passed at build time
 ARG COMMIT_SHA=unknown

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dependencytrack/frontend",
-  "version": "5.4.0",
+  "version": "5.5.0",
   "description": "Single Page Application for OWASP Dependency-Track",
   "author": "Steve Springett",
   "homepage": "https://dependencytrack.org/",
@@ -28,7 +28,7 @@
     "@coreui/vue": "2.1.2",
     "@johmun/vue-tags-input": "2.1.0",
     "@monaco-editor/loader": "1.4.0",
-    "axios": "1.6.8",
+    "axios": "1.7.4",
     "bootstrap": "4.6.2",
     "bootstrap-table": "1.22.4",
     "bootstrap-vue": "2.23.1",
@@ -93,6 +93,9 @@
     "vue-template-compiler": "2.7.16"
   },
   "overrides": {
+    "@cyclonedx/cyclonedx-npm": {
+      "@cyclonedx/cyclonedx-library": "6.11.0"
+    },
     "vue-bootstrap-toggle": {
       "merge": "2.1.1"
     }