* Add EPSS score support for GitHub Advisory (GHSA) vulnerabilities
Resolves https://github.com/DependencyTrack/dependency-track/issues/4330
- Map `percentage` (exploitation probability) and `percentile` (relative
rank) from the GitHub EPSS API response to the `epssScore` and
`epssPercentile` fields on GHSA Vulnerability records.
- Extend `VulnerabilityQueryManager.hasChanges()` to also trigger an
update when an advisory has EPSS data but the stored record does not,
enabling backfill without relying on a changed `updatedAt` timestamp.
- Add upgrade item `v4140Updater` that resets the GHSA mirror timestamp
on first boot, causing the next mirror run to re-fetch all advisories
and populate EPSS fields on existing records.
- Add `ModelConverterTest` (unit) and extend `GitHubAdvisoryMirrorTaskTest`
(integration) with EPSS test cases using real values from the GitHub API.
Signed-off-by: Valentijn Scholten <valentijnscholten@gmail.com>
* Address PR review comments: rename changelog, use ParameterizedTest
- Rename docs/_posts/2026-02-19-v4.14.0.md to 2026-xx-xx-v4.14.0.md
- Convert testConvertSeverityMapping to @ParameterizedTest with display name
Signed-off-by: Valentijn Scholten <valentijnscholten@gmail.com>
* add note to release notes
Signed-off-by: Valentijn Scholten <valentijnscholten@gmail.com>
---------
Signed-off-by: Valentijn Scholten <valentijnscholten@gmail.com>
The fix is achieved by using the same logic for persisting `Vulnerability` and `VulnerableSoftware` records that `NistApiMirrorTask` was already using. It handles duplicate records.
This should also yield a performance boost (did not benchmark because that wasn't the focus of this change), since the transaction commit frequency is reduced compared to the previous logic.
Fixes#3663
Signed-off-by: nscuro <nscuro@protonmail.com>
Instead of causing a full-blown service disruption when API token decryption fails, fall back to unauthenticated API usage to limit the impact.
Relates to #2366
Signed-off-by: nscuro <nscuro@protonmail.com>
`ClientErrorException` in JAX-RS corresponds to HTTP 4xx status codes. Those were previously handled by Alpine's `GlobalExceptionHandler`, resulting in an HTTP 500 response when it really should've been a 4xx.
Fixes#3645
Signed-off-by: nscuro <nscuro@protonmail.com>
Including default values for both `pageNumber`/`pageSize` and `offset`/`limit` causes the request generated by Swagger UI to use them all, which is confusing.
Signed-off-by: nscuro <nscuro@protonmail.com>
