CHANGELOG.txt

This Release
------------

Release 3.8.2

* Bumped JSoup to 1.23.1

Older Releases in this major version
------------------------------------

Release 3.8.1

* Bumped Jackson to 3.1.5 to address MEDIUM severity CVE-2026-59889

Release 3.8.0

* Optional ticketSearchURLTemplate element under Treatments JSON configuration which, when set, enables reports to kick off searches for the affected component and tag name (replacing the {componentShortNameAndTag} marker with the simple component name and tag). See src/test/resources/sampleTreatments.json for example.  The intent is to search a ticket system to see if existing tickets for this vulnerability have been already created. This is only shown for vulnerabilities where no ticket has been set.
* Fixed bug for comparison reports where treatments were missed from the report.

Release 3.7.7

* Updated to Spring Boot 4.1.0.

Release 3.7.6

* Updated to Spring Boot 4.0.6.
* Graph output now clips shaded areas to not spill into the margins, enabling models to extend band ranges below zero (see new recommended model)

Release 3.7.5

* Updated to Thymeleaf 3.1.4

Release 3.7.4

* Updated to Jackson 3.1.1

Release 3.7.3

* Updated to Spring Boot 4.0.5

Release 3.7.2

* Updated to Spring Boot 4.0.4
* Minor tidy up of graphing and better, more representative, priority models in tests

Release 3.7.1

* Updated to Spring Boot 4.0.3

Release 3.7.0

* Treatment notes may now optionally include the isAcceptedAsUnfixable boolean flag which, if set, marks the affected vulnerability/vulnerabilities as having no fix available - useful for management reporting.

Release 3.6.0

* Potentially breaking change: Clarified treatment plans with both artefacts and vulnerability ID set, the treatment must match both.

Release 3.5.0

* Breaking change: Setting a priority fail threshold will now return 1, not -1, in case of threshold being met, to align with Linux bash/sh 8-bit limit on return codes

Release 3.4.2

* Updated to Spring Boot 4.0.2, openhtmltopdf to 1.1.37

Release 3.4.1

* Updated to Spring Boot 4.0.1

Release 3.4.0

* Added automatic retries for calls to EPSS service to address occasional connectivity issues
* Minor bumps, mostly to openhtmltopdf

Release 3.3.3

* Reverted some optimisations to fix bug where, for components with high number of vulnerabilities, some EPSS scores were missing

Release 3.3.2

* Added the --bothPDFAndJSONOutput argument to output PDF and JSON in same call, saving time if you need both.

Release 3.3.1

* Minor performance optimisations

Release 3.3.0

* Upgrade of dependent frameworks, mostly upgrade to Spring Boot and Jackson 3
* Optimised calls to EPSS API

Release 3.2.2

* Treatment plan now reported in JSON as well as PDF

Release 3.2.1

* Treatment plan matching of artefact names now uses startsWith to allow treatments to match multiple tags
* Bumped commons-lang3 to 3.19.0

Release 3.2.0

* Now accepts optional treatment plan JSON as input for fuller, more meaningful progress reports

Release 3.1.0

* Now highlights those vulnerabilities that have fixes available (i.e. aiding prioritisation for remediation)

Release 3.0.16:

* Updated Spring Boot to 3.5.6.
* Reduced some code complexity by migrating to Lombok

Release 3.0.15:

* Updated openhtmltopdf to 1.1.31.

Release 3.0.14:

* Updated Java dependencies, esp. Sprint Boot to 3.5.5, Jsoup to 1.21.2, and Jackson to 2.20.0.

Release 3.0.13:

* Updated Sprint Boot to 3.5.3 and Jsoup to 1.21.1.

Release 3.0.12:

* Updated Jackson to 2.19.1.

Release 3.0.11:

* Updated Sprint Boot to 3.5.0.

Release 3.0.10:

* Fixed numeric output of CVSS and EPSS scores in JSON to guarantee more human readable.

Release 3.0.9:

* Fixed timezone issues with Trivy scan creation date.

Release 3.0.8:

* Added better error diagnostics for IOException cases.

Release 3.0.7:

* Refactored to enable dependabot, automating future security remediation as much as possible.
* Fixed legacy format of Gradle build file.

Releases 3.0.5 and 3.0.6:

* Patch release to bring Java dependencies up to date, now passing Trivy scans with zero vulnerabilities at date of issue.

Release 3.0.4:

* Better error handling in the rare case that EPSS service returns an error (happened for scores for date
2024-12-01 for some reason)

Release 3.0.3:

* Fixed bug caused by EPSS API changing response format - now ignores new fields
* Better diagnostics in exception conditions (separate message for files not found, error trace when EPSS API
generates exception)

Release 3.0.2:

* If the scan date is today, TrivySummary now omits the date from the EPSS Query as this
can sometimes cause issues if an explicit date of today is used (assume due to time
zones, calling this in the morning from the UK before the daily stats are generated).

* Default output file is now, for a single input file, the same name and folder but with
a .pdf suffix. For the scenario where two input files are used, the default output 
file path is the same as the input file but with name output.pdf.

* If not in offline mode and there are errors experienced in calling the EPSS API, the
operation will simply fail with an error message, rather than creating a report.

Release 3.0.1:

* Bug fixes

Release 3.0:

* Massive update...

* Simple EPSS/CVSS thresholds now replaced with a configurable priority model. Each 
CVE is now prioritised based on one of three models:
  1. SEVERITYONLY
     As in previous versions, priority is simple the stated vendor severity
  2. RECTANGULAR
     Each of CRITICAL, HIGH or MEDIUM priorities set by minimum CVSS and EPSS values.
     Shown as colour bands on the graph view.
  3. ELLIPTICAL
     Similar to RECTANGULAR but based on an ellipse bounded by the stated CVSS / EPSS
     thresholds, giving a much more elegant view of distance from the top right hand
     corner of the graph.

* Now defaults to querying for EPSS scores based on the scan date.
Supports --useTodayForEPSSQuery attribute to override this and force loading EPSS 
scores for the report date.

* BREAKING CHANGE: --failSeverityThreshold parameter now renamed --failPriorityThreshold 
to reflect the change from a severity-only world to the new priority models
error code.

* BREAKING CHANGE: --minimumCVSSToPrioritise and --minimumEPSSToPrioritise now removed,
replaced by the --priorityModel parameter