Bump dependency org.owasp:dependency-check-maven to v13

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.owasp:dependency-check-maven (source)	12.2.2 → 13.0.0

---

Release Notes

dependency-check/DependencyCheck (org.owasp:dependency-check-maven)

v13.0.0: Version 13.0.0

Compare Source

What's Changed

• chore: tidy changelog; highlighting 12.2.2 DB schema change by @​chadlwilson in #​8476
• build(deps): bump golang from 1.26.2-alpine to 1.26.3-alpine by @​dependabot[bot] in #​8492
• build(deps): bump org.apache.groovy:groovy-ant from 5.0.5 to 5.0.6 by @​dependabot[bot] in #​8491
• fix(reports): Correct XML report attribute denoting matched status for a suppressed vulnerability by @​chadlwilson in #​8487
• docs: correct Core Engine menu display by @​chadlwilson in #​8481
• chore: deprecate Nexus v2 support for removal by @​chadlwilson in #​8455
• build(deps): bump org.apache.maven.plugins:maven-invoker-plugin from 3.10.0 to 3.10.1 by @​dependabot[bot] in #​8480
• chore(fp): remove duplicate Jetty FPs already handled in hosted suppressions by @​chadlwilson in #​8486
• build(deps): bump slf4j.version from 2.0.17 to 2.0.18 by @​dependabot[bot] in #​8502
• fix: ensure working hostedSuppressions/RetireJS forceUpdate & correct cache validForHours checks by @​chadlwilson in #​8494
• fix(cli): correct displayed application name and deprecations in help text by @​chadlwilson in #​8496
• chore(fp): remove unnecessary prometheus suppressions by @​chadlwilson in #​8500
• test: fix expectations for RetireJS against AngularJS integration test by @​chadlwilson in #​8511
• fix: migrate git-commit-id-plugin to maintained io.github.git-commit-id coordinates by @​Umesh042005 in #​8473
• test: make yarn tests agnostic of corepack defaults by @​chadlwilson in #​8413
• chore(fp): remove unnecessary grpc suppressions by @​chadlwilson in #​8505
• chore(fp): use more conservative CPE 22 prefix suppression syntax to avoid false negatives by @​chadlwilson in #​8509
• fix: publish-suppressions action trigger by @​jeremylong in #​8516
• docs: clarify Sonatype Guide OSS Index suggestions by @​chadlwilson in #​8477
• build(deps): bump org.apache.maven.plugins:maven-enforcer-plugin from 3.6.2 to 3.6.3 by @​dependabot[bot] in #​8517
• ci: fix FP ops workflow to generate CPE regex for optional suffix matches by @​chadlwilson in #​8531
• ci: automatically publish suppressions after merged PRs by @​chadlwilson in #​8527
• fix(analyzer): detect OpenSSL 3.x in OpenSSLAnalyzer by @​shawnjohnjr in #​8484
• docs(cli): fix escaping by @​chadlwilson in #​8551
• build(deps): bump org.junit:junit-bom from 5.14.3 to 5.14.4 by @​dependabot[bot] in #​8547
• build(deps): bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 by @​dependabot[bot] in #​8556
• build(deps): bump org.apache.maven.plugins:maven-dependency-plugin from 3.10.0 to 3.11.0 by @​dependabot[bot] in #​8557
• build(deps-dev): bump org.apache.maven.plugins:maven-surefire-report-plugin from 3.5.5 to 3.5.6 by @​dependabot[bot] in #​8555
• build(deps-dev): bump org.eclipse.parsson:jakarta.json from 1.1.7 to 1.1.9 by @​dependabot[bot] in #​8552
• fix(core): add missing nvd.api.key entry to dependencycheck.properties by @​anand1416 in #​8549
• fix(fp): allow stricter matching of suppression CPE 2.2 URI prefixes to only whole parts by @​chadlwilson in #​8548
• build(deps): bump org.apache.maven.plugins:maven-site-plugin from 3.21.0 to 3.22.0 by @​dependabot[bot] in #​8545
• build(deps): bump org.json:json from 2025122 to 2026052 by @​dependabot[bot] in #​8546
• build(deps): Pin Lock Threads action to v6.0.2 SHA by @​jeremylong with @​Copilot in #​8559
• build(deps): bump the actions-deps group with 4 updates by @​dependabot[bot] in #​8563
• build(deps): bump org.apache.maven.plugins:maven-failsafe-plugin from 3.5.5 to 3.5.6 by @​dependabot[bot] in #​8562
• fix: improve Java 17+ compatibility by removing jdiagnostics by @​chadlwilson in #​8565
• build(deps): bump golang from 1.26.3-alpine to 1.26.4-alpine by @​dependabot[bot] in #​8569
• build(deps): bump org.codehaus.gmavenplus:gmavenplus-plugin from 4.3.1 to 5.0.0 by @​dependabot[bot] in #​8568
• build(deps): bump com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.22.0 by @​dependabot[bot] in #​8561
• build(deps): bump org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15 by @​dependabot[bot] in #​8574
• fix(fp): extend service project suppression to all Maven artifacts by @​chadlwilson in #​8677
• fix(windows): use JAVA_HOME when java is not on PATH by @​mohan485 in #​8656
• docs: document configuration of Gradle connection timeouts by @​chadlwilson in #​8490
• build(deps-dev): bump com.github.spotbugs:spotbugs-maven-plugin from 4.9.8.3 to 4.10.2.0 by @​dependabot[bot] in #​8585
• fix(reports): render CVSSv4 baseScore = 0.0 in JSON+XML reports by @​chadlwilson in #​8663
• build(deps): bump the actions-deps group with 7 updates by @​dependabot[bot] in #​8647
• build(deps): bump httpcomponents.client.version from 5.6.1 to 5.6.2 by @​dependabot[bot] in #​8646
• build(deps-dev): bump org.sonatype.central:central-publishing-maven-plugin from 0.10.0 to 0.11.0 by @​dependabot[bot] in #​8615
• docs: fix Maven debug command in configuration.md by @​JackPGreen in #​8610
• chore(fp): remove Glassfish server suppressions duplicated into generated/hosted suppressions by @​chadlwilson in #​8604
• build(deps): bump com.github.spotbugs:spotbugs-annotations from 4.9.8 to 4.10.2 by @​dependabot[bot] in #​8586
• build(deps)!: bump maven-core from 3.6.3 to 3.8.1 by @​jeremylong in #​7612
• fix(tests): update failing retireJs test by @​jeremylong in #​8682
• build(deps): bump golang from 1.26.4-alpine to 1.26.5-alpine by @​dependabot[bot] in #​8655
• build(deps): bump org.apache.httpcomponents.core5:httpcore5 from 5.4.2 to 5.4.3 by @​dependabot[bot] in #​8635
• build(deps): bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 by @​dependabot[bot] in #​8684
• fix(fp): remove duplicate oracle:projects base suppression by @​chadlwilson in #​8688
• build(deps-dev): bump com.github.spotbugs:spotbugs-maven-plugin from 4.10.2.0 to 4.10.3.0 by @​dependabot[bot] in #​8687
• build(deps): bump com.github.spotbugs:spotbugs-annotations from 4.10.2 to 4.10.3 by @​dependabot[bot] in #​8686
• docs: document NVD 2.0 data feeds by @​Eljees in #​8680
• build(deps): bump org.jspecify:jspecify from 1.0.0 to 1.0.1 by @​dependabot[bot] in #​8683
• build(deps): bump the actions-deps group with 9 updates by @​dependabot[bot] in #​8690
• fix(core): reopen database after update failure by @​Eljees in #​8679
• build(deps): bump com.mysql:mysql-connector-j from 9.7.0 to 26.7.0 by @​dependabot[bot] in #​8685
• docs: Clarify how suppress items are matched against files by @​kwin in #​8354
• build(deps): bump commons-codec:commons-codec from 1.22.0 to 1.22.1 by @​dependabot[bot] in #​8696
• build(deps): bump httpcomponents.client.version from 5.6.2 to 5.6.3 by @​dependabot[bot] in #​8695
• build(deps): bump com.fasterxml.jackson:jackson-bom from 2.22.0 to 2.22.1 by @​dependabot[bot] in #​8694
• build(deps): bump org.jsoup:jsoup from 1.22.2 to 1.23.1 by @​dependabot[bot] in #​8693
• build(deps): bump org.apache.groovy:groovy-ant from 5.0.6 to 5.0.8 by @​dependabot[bot] in #​8692
• chore!: drop deprecated configuration, integration options & Nexus V2 Search support by @​chadlwilson in #​8691
• build(deps): bump open-vulnerability-clients from 9.0.5 to 9.0.6 by @​jeremylong in #​8697
• build(deps): bump logback from 1.5.32 to 1.5.34 by @​jeremylong in #​8698

New Contributors

• @​shawnjohnjr made their first contribution in #​8484
• @​anand1416 made their first contribution in #​8549
• @​mohan485 made their first contribution in #​8656
• @​Eljees made their first contribution in #​8680

Full Changelog: dependency-check/DependencyCheck@v12.2.2...v13.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

☀️   Quality Monitor

Tests

     Unit Tests: ✅ successful — 87 passed $\textsf{(±0)}$, 2 skipped $\textsf{(±0)}$
   ⛔   Architecture Tests: ✅ successful — 18 passed $\textsf{(±0)}$, 2 skipped $\textsf{(±0)}$

Coverage for New Code

   〰️   Line Coverage: 100.00% — perfect 🎉
   ➰   Branch Coverage: 100.00% — perfect 🎉
     Mutation Coverage: 100.00% — perfect 🎉
   💪   Test Strength: 100.00% — perfect 🎉

Coverage for Whole Project

   〰️   Line Coverage: 92.03% $\textsf{(±0)}$ — 64 missed lines
   ➰   Branch Coverage: 92.04% $\textsf{(±0)}$ — 18 missed branches
     Mutation Coverage: 91.16% $\textsf{(±0)}$ — 29 survived mutations
   💪   Test Strength: 93.15% $\textsf{(±0)}$ — 22 survived mutations in tested code

Style

     CheckStyle: No warnings $\textsf{(±0)}$
     PMD: No warnings $\textsf{(±0)}$
   ☕   Java Compiler: No warnings $\textsf{(±0)}$

Bugs

     SpotBugs: No bugs $\textsf{(±0)}$
   🐛   Error Prone: No bugs $\textsf{(±0)}$

API Problems

   🚫   Revapi: No warnings $\textsf{(±0)}$

Vulnerabilities

   🛡️   OWASP Dependency Check: No vulnerabilities $\textsf{(±0)}$

Software Metrics

   🌀   Cyclomatic Complexity: 397 (total)
   💭   Cognitive Complexity: 173 (total)
   ➿   N-Path Complexity: 361 (total)
   📏   Lines of Code: 4722 (total)
   📝   Non Commenting Source Statements: 1338 (total)
   🔗   Class Cohesion: 71.43% (maximum)
   ⚖️   Weight of Class: 100.00% (maximum)

📌 Reference Results

Delta reports computed against the reference results of 9b1d6b9 in workflow run 30760174939.

🚦 Quality Gates

Overall Status: ✅ SUCCESS

✅ Passed Gates

• ✅ Overall Tests Success Rate: 100.00 >= 100.00
• ✅ Line Coverage in New Code: 100.00 >= 90.00
• ✅ Branch Coverage in New Code: 100.00 >= 90.00
• ✅ Mutation Coverage in New Code: 100.00 >= 90.00
• ✅ Potential Bugs in Whole Project: 0.00 <= 0.00
• ✅ Style Violation in Whole Project: 0.00 <= 0.00

---

Created by Quality Monitor v4.15.0 (#82d77af). More details are shown in the GitHub Checks Result.