Port changes from upstream DT release 4.10.x

[VinodAnandan]

API server:

• 4.10.0: https://github.com/DependencyTrack/dependency-track/milestone/25?closed=1
• 4.10.1: https://github.com/DependencyTrack/dependency-track/milestone/35?closed=1

Frontend:

• 4.10.0: https://github.com/DependencyTrack/frontend/milestone/16?closed=1

Issue / PR	Type	Description	Backported	Backport PR
DependencyTrack/dependency-track#3089	Enhancement	Use Java 21 JRE in container images	✅	DependencyTrack/hyades-apiserver#572
DependencyTrack/dependency-track#3103	CI	Pin digests of GitHub Actions	-	-
DependencyTrack/dependency-track#3104	CI	Use strict token permissions in GitHub Actions workflows	✅	DependencyTrack/hyades-apiserver#572
DependencyTrack/dependency-track#3118	Enhancement	Remove CPE table and associated code	✅	DependencyTrack/hyades-apiserver#547
DependencyTrack/dependency-track#3116	Enhancement	Improve efficiency of index operations	n/a, search indexes have been removed in Hyades	-
DependencyTrack/dependency-track#2987	Bugfix	Cannot manually rebuild search index of more than one entity type at time	n/a, search indexes have been removed in Hyades	-
DependencyTrack/dependency-track#3154	Enhancement	Add retry with exponential backoff for NVD feed downloads	n/a, NVD feeds are not used in Hyades	-
DependencyTrack/dependency-track#3172	Bugfix	Fix trailing comma in default Slack publisher template	✅	DependencyTrack/hyades-apiserver#571
DependencyTrack/dependency-track#3173	Enhancement	Add average event processing duration to Grafana dashboard	-	-
DependencyTrack/dependency-track#3112	Enhancement	Add support for github component sources	✅	#1032, DependencyTrack/hyades-apiserver#539
DependencyTrack/dependency-track#3175	Enhancement	Add support for mirroring of the NVD via API	n/a, already implemented in Hyades	-
DependencyTrack/dependency-track#3194	Bugfix	Fix NPE when affected node in OSV does not define a package	✅	#1072
DependencyTrack/dependency-track#2876	Enhancement	Support authentication for public / non-internal repositories	n/a, already implemented in Hyades	-
DependencyTrack/dependency-track#3198	Bugfix	Fix NPE for BOM_PROCESSING_FAILED notifications when parsing of the BOM failed	✅	#1073
DependencyTrack/dependency-track#3209	Bugfix	Fix false positives in CPE matching due to ambiguous vendor/product relations	✅	#1061
DependencyTrack/dependency-track#3211	Enhancement	Improve logging for notification publishing	✅	#1026, DependencyTrack/hyades-apiserver#536
DependencyTrack/dependency-track#3222	Bugfix	Fix Massive deterioration of the Portfolio Vulnerability Analysis performance due to unnecessary increment in the amount of components to proceed	n/a, code no longer exists in Hyades	-
DependencyTrack/dependency-track#3228	Bugfix	Fix failure to delete PolicyViolations when they have an audit trail	✅	DependencyTrack/hyades-apiserver#562
DependencyTrack/dependency-track#3232	Bugfix	Fix teams not being assignable to alerts with custom email publishers	✅	DependencyTrack/hyades-apiserver#550
DependencyTrack/dependency-track#3233	Bugfix	Fix erroneous warning log during VEX import	✅	DependencyTrack/hyades-apiserver#550
DependencyTrack/dependency-track#3244	Bugfix	Added a default value for the Project active field if it is null	✅	DependencyTrack/hyades-apiserver#550
DependencyTrack/dependency-track#3245	Bugfix	Tweak container health check to prevent wget zombie processes on slow hosts	✅	DependencyTrack/hyades-apiserver#550
DependencyTrack/dependency-track#3246	Bugfix	Fix NPEs in GitHub repository metadata analyzer	✅	#1051
DependencyTrack/dependency-track#2737	Enhancement	Add missing support for supplier and manufacturer	✅	DependencyTrack/hyades-apiserver#570
DependencyTrack/dependency-track#3247	Bugfix	Add migration to populate new AUTHENTICATIONREQUIRED column	na, already done in Hyades	-
DependencyTrack/dependency-track#3306	Bugfix	Backport: Fix notifications not being sent for child projects where active is null	✅	#1051
DependencyTrack/dependency-track#3308	Bugfix	Backport: Fix NPE in VersionDistancePolicyEvaluator when project has no direct dependencies	na, NPE is handled by sql, will add a test	-
DependencyTrack/dependency-track#3312	Bugfix	Backport: Fix ClassCastException when updating an existing ProjectMetadata#authors field	✅	DependencyTrack/hyades-apiserver#592
DependencyTrack/dependency-track#3323	Bugfix	Backport: Fix NVD API's last modified timestamp requiring restart to be applied	n/a, timestamp is stored differently in Hyades	-
DependencyTrack/dependency-track#3315	Bugfix	Backport: Improve Error handling and add default version type	✅	#1051

[nscuro]

Not anticipating this to be a big task. Main feature of 4.10 was support for the NVD REST API which Hyades already had for a long time.

[VinodAnandan]

I would like to work on DependencyTrack/dependency-track#3089, DependencyTrack/dependency-track#3103, DependencyTrack/dependency-track#3104 . I will try to complete them in the next 5 or 6 days.