Fixes:

• Fix OS package scanning for Trivy analyzer - apiserver/#7593
• Fix Trivy findings dropped for PURLs with URL-valued qualifiers - apiserver/#7592
• Fix NuGet package names being treated as case-sensitive for vulnerability matching - apiserver/#7565
• Fix PyPI package names not being PEP 503-normalized for vulnerability matching - apiserver/#7564
• Fix various issues with NPM version comparisons - apiserver/#7563
• Fix NEW_VULNERABLE_DEPENDENCY notifications not including project tags - apiserver/#7500
• Fix NPEs during DataNucleus L1 cache eviction - apiserver/#7499
• Fix scheduled portfolio vulnerability analysis aborting during cache eviction - apiserver/#7448
• Fix ReferenceError when trying to remove a policy condition - frontend/#1887
• Fix project properties modal showing stale data after navigating to another project - frontend/#1888
• Fix incorrect dependency graph link in component search - frontend/#1889

For a complete list of changes, refer to the respective GitHub milestones:

• API server milestone 4.14.5
• Frontend milestone 4.14.5

We thank all organizations and individuals who contributed to this release, from logging issues to taking part in discussions on GitHub & Slack to testing of fixes.

Special thanks to everyone who contributed code to implement enhancements and fix defects:

@ElenaStroebele, @mikael-carneholm-2-wcar, @nissessenap

dependency-track-apiserver.jar

Algorithm	Checksum
SHA-1	16d73175e293a807409c621bf39bac1e1aaa9c2b
SHA-256	50f698fa06078f800b6ca626c05ce6190efcbadecc88d03b0d80a6e144f60055

dependency-track-bundled.jar

Algorithm	Checksum
SHA-1	de0b87dbe7bb23d2d9bfd587ce56514820c35ded
SHA-256	9c1153fbb98b224a171121e0447abe20f085160a19445f82d36a77cd60b34733

frontend-dist.zip

Algorithm	Checksum
SHA-1	6a870f90f625103a0448bee4ef3fb0aae40dd91a
SHA-256	683889bf7afa305cdb87cc8accdb6063d80fcbede1dd7558ff33f544a4132a04

Software Bill of Materials (SBOM)

• API Server: bom.json
• Frontend: bom.json