Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Added 21.3.2 release notes

...

Info
titleRelease Notes & Announcements Subscription Service
You can subscribe to the Customer Community Portal Announcements section in order to receive immediate email notifications on important announcements and product release notes. 

Version 21.3.2 (11-April-2021)

NOTE: The GitHub Enterprise, Bitbucket Server, and GitLab integrations in this version support version 21.3.1 of the Unified Agent. The GitHub.com integration in this version supports version 21.3.2 of the Unified Agent. The WhiteSource for Bitbucket integration in this version supports version 20.12.2 of the Bitbucket Add-on.

Resolved Issues

ProductDescription

WhiteSource Advise for IntelliJ,
WhiteSource Advise for WebStorm,
WhiteSource Advise for PyCharm,

Better handling when the developers' environment is disconnected from the internet or has no access to the WhiteSource servers.

WhiteSource Advise for Visual StudioIn some cases, scanning a C# project resulted in an exception, and in addition, no vulnerabilities were displayed.
WhiteSource for GitHub.comWhen adding an empty whitesource-config repository from a default "main" branch to the integration, it was not initialized with WhiteSource configuration files.
WhiteSource for GitLabWhen using the security dashboard, issues were published but the commit comment was not updated with scan results and remained with a "scan in progress" indication.

Version 21.3.1 (4-April-2021)

New Features & Updates

ProductDescription
WhiteSource Advise for IntelliJ IDEA,
WhiteSource Advise for WebStorm

An improved notification message is now displayed when no vulnerabilities are found in a scanned project.

WhiteSource Advise for IntelliJ IDEA

Added support for the "apply from" script plugin in Gradle projects, which can reference a dependency file contained within the scanned project or outside of it.
NOTE: Remote script location is not supported.

WhiteSource Advise for Eclipse,
WhiteSource Advise for Visual Studio

Beginning in this version, you can configure the plugin to alert only on direct dependency vulnerabilities (as opposed to both direct and transitive vulnerabilities).
WhiteSource for Bitbucket Server, 
WhiteSource for Bitbucket Data Center,
WhiteSource for GitHub Enterprise,
WhiteSource for GitLab,
WhiteSource for GitHub.com

For NPM projects only - Added support for remediation of transitive npm packages when a package-lock.json is present. 
NOTE: This functionality is disabled by default.

WhiteSource for Bitbucket Server, 
WhiteSource for Bitbucket Data Center,
WhiteSource for GitHub Enterprise,
WhiteSource for GitLab,
WhiteSource for GitHub.com

Beginning in this version, a new WhiteSource Security/License Check summary will be displayed in case a scan results in an empty inventory (as opposed to when one or more Security/License issues are detected).

WhiteSource Remediate Remediate sometimes, and Renovate often, needs to query github.com for tags and releases (e.g. for release notes fetching).
Customers using Renovate especially will get rate limited by github.com quickly if they don't provide authentication with every request. Guidelines on how to do that are provided here.

NOTE: The GitHub Enterprise, Bitbucket Server, and GitLab integrations in this version support version 21.2.2 of the Unified Agent. The GitHub.com integration in this version supports version 21.3.1 of the Unified Agent. The WhiteSource for Bitbucket integration in this version supports version 20.12.2 of the Bitbucket Add-on.

Resolved Issues

ProductDescription

WhiteSource Advise for IntelliJ

When scanning a large Gradle project (~20 modules), the plugin would run for an excessive amount of time, which resulted in the IDE being frozen.

WhiteSource for Bitbucket Server, 
WhiteSource for Bitbucket Data Center,
WhiteSource for GitHub Enterprise,
WhiteSource for GitLab
Improved rotation of the application container logs by modifying the maximum log size from 10GB to 2GB, and the maximum history days from 600 to 60 days.

...

NOTE: The GitHub Enterprise, Bitbucket Server, and GitLab integrations in this version support version 21.1.2 of the Unified Agent. The GitHub.com integration in this version supports version 21.2.1 of the Unified Agent. The WhiteSource for Bitbucket integration in this version supports version 20.12.2 of the Bitbucket Add-on.

Resolved Issues

ProductDescription

WhiteSource for GitHub Enterprise

In a forked repository with branch protection rules in place, when the last commit in a PR did not trigger a scan (not a valid push), then a neutral check run was created. In such a case, even if new vulnerabilities were introduced as part of the PR, merging the PR was still possible.

WhiteSource for GitHub.com

In cases where the WhiteSource License Check was enabled, license policy violation data for libraries with an unknown license (Requires Review license type) were not surfaced in the integration.

...

NOTE: The GitHub Enterprise, Bitbucket Server, and GitLab integrations in this version support version 21.1.1 of the Unified Agent. The GitHub.com integration in this version supports version 21.1.2 of the Unified Agent. The WhiteSource for Bitbucket integration in this version supports version 20.12.2 of the Bitbucket Add-on.

Resolved Issues

ProductDescription

WhiteSource for Bitbucket Server, 
WhiteSource for Bitbucket Data Center,
WhiteSource for GitHub.com,
WhiteSource for GitHub Enterprise,
WhiteSource for GitLab

  • When two or more valid push events occurred a few seconds apart from each other within the same repository,  new issues (which didn’t exist before) were sometimes created twice. NOTE: In this case, the duplicate issue(s) will be auto-closed.
  • In version 21.1.1 - in some edge cases, issues were not being created due to an internal exception.

WhiteSource Advise for PyCharm,
WhiteSource Advise for WebStorm

  • When multiple dependency paths were detected as part of a transitive dependency vulnerability, the indication of the number of paths detected inside the Brief Vulnerability Information popup was missing.

...

NOTE: The GitHub Enterprise, Bitbucket Server, and GitLab integrations in this version support version 20.12.3 of the Unified Agent. The GitHub.com integration in this version supports version 21.1.1 of the Unified Agent. The WhiteSource for Bitbucket integration in this version supports version 20.12.2 of the Bitbucket Add-on.

Resolved Issues

ProductDescription

WhiteSource Advise for PyCharm

  • When vulnerabilities with different severities (high/medium/low) were found on a project, the Problems Tool Window displayed all issues as errors (instead of displaying high severity vulnerabilities as errors, and medium/low severity vulnerabilities as warnings).
  • In some cases, dependencies declared inside a requirements.txt file were incorrectly identified when declared in a case-sensitive way.

WhiteSource Advise for PyCharm,
WhiteSource Advise for WebStorm

In some cases, a wrong transitive vulnerability tree was displayed for vulnerabilities detected under a direct dependency.

...

NOTE: The GitHub Enterprise, Bitbucket Server, and GitLab integrations in this version support version 20.12.2 of the Unified Agent. The GitHub.com integration in this version supports version 20.12.3 of the Unified Agent. The WhiteSource for Bitbucket integration in this version supports version 20.12.2 of the Bitbucket Add-on.

Resolved Issues

ProductDescription

WhiteSource Advise for IntelliJ IDEA,
WhiteSource Advise for PyCharm,
WhiteSource Advise for WebStorm

In some cases, when the Remember license key option was enabled during activation, the activation credentials would not be saved upon restarting the IDE.
WhiteSource for Bitbucket Server, 
WhiteSource for Bitbucket Data Center,
WhiteSource for GitHub Enterprise,
WhiteSource for GitLab
A .whitesource file pointing to a custom whitesource-config repo which is not the default one, led to the global repo configuration (global-config.json) being taken from the default whitesource-config repo location.

...

NOTE: The GitHub Enterprise, Bitbucket Server, and GitLab integrations in this version support version 20.12.1 of the Unified Agent. The GitHub.com integration in this version supports version 20.12.2 of the Unified Agent. The WhiteSource for Bitbucket integration in this version supports version 20.12.2 of the Bitbucket Add-on.

Resolved Issues

ProductDescription
WhiteSource Advise for IntelliJ IDEAScanning a Gradle project following file changes would sometimes not show markers for detected vulnerabilities.

WhiteSource for Bitbucket Server,
WhiteSource for Bitbucket Data Center

In an integrated repository page, the Critical severity metric inside the WhiteSource Security widget was modified to High in order to align with the WhiteSource UI severity metrics.

...

NOTE: The GitHub Enterprise, Bitbucket Server, and GitLab integrations in this version support version 20.11.2 of the Unified Agent. The GitHub.com integration in this version supports version 20.12.1 of the Unified Agent. The WhiteSource for Bitbucket integration in this version supports version 20.11.1 of the Bitbucket Add-on.

Resolved Issues

ProductDescription
WhiteSource Advise for IntelliJ IDEAThe No proxy HTTP setting was ignored by the plugin.
WhiteSource for Bitbucket Server, 
WhiteSource for Bitbucket Data Center,
WhiteSource for GitHub Enterprise,
WhiteSource for GitLab
The scanner container did not clean up between container restarts, resulting in a potentially large growth in the container’s disk size.

...

NOTE: The GitHub Enterprise, Bitbucket Server, and GitLab integrations in this version support version 20.11.1 of the Unified Agent. The GitHub.com integration in this version supports version 20.11.2 of the Unified Agent. The WhiteSource for Bitbucket integration in this version supports version 20.11.1 of the Bitbucket Add-on.

Resolved Issues

ProductDescription

WhiteSource for GitHub Enterprise

Renovate config presets were not being resolved.
WhiteSource for Bitbucket Server, 
WhiteSource for Bitbucket Data Center
In the WhiteSource Security Report (Code Insights), the table listing each vulnerability was not displayed correctly.

...

NOTE: The GitHub Enterprise, Bitbucket Server, and GitLab integrations in this version support version 20.10.2 of the Unified Agent. The GitHub.com integration in this version supports version 20.11.1 of the Unified Agent.

Resolved Issues

ProductDescription

WhiteSource Advise for IntelliJ,
WhiteSource Advise for Eclipse,
WhiteSource Advise for VS Code

  • When CVSS3 data was available for a vulnerability, WhiteSource Advise displayed CVSS2 severity instead of CVSS3 severity information.
WhiteSource Advise for IntelliJ
  • When no WhiteSource suggested fix was available for a vulnerability, WhiteSource Advise skipped the display of such vulnerability.

Version 20.10.2.1 (8-November-2020)

Resolved Issues

ProductDescription
WhiteSource for GitHub Enterprise

In some cases, two scans were triggered for the same commit. This led the issue publishing process to run twice at the exact same time, causing duplicate issues to be created.

...

NOTE: The GitHub Enterprise, Bitbucket Server, and GitLab integrations in this version support version 20.9.2 of the Unified Agent. The GitHub.com integration in this version supports version 20.10.1 of the Unified Agent.

Resolved Issues

ProductDescription
WhiteSource for Bitbucket Server
  • The WhiteSource Add-on had a limitation where you could only integrate up to 1,000 repositories.
  • In the Global Repo Configuration, it was not possible to specify a Project Key when using the ignoredRepos parameter inside the global-config.json file.
WhiteSource for Bitbucket Server,
WhiteSource for GitHub Enterprise,
WhiteSource for GitHub.com,
WhiteSource for GitLab
  • Remediate - No fix Pull Request/Merge Request was generated for library yaml.v2-v2.2.2.
  • When Global Repo Configuration was enabled, in some cases, scans were not triggered after a valid push was performed.

...

NOTE: The GitHub Enterprise, Bitbucket Server, and GitLab integrations in this version support version 20.8.1 of the Unified Agent. The GitHub.com integration in this version supports version 20.8.2 of the Unified Agent.

Resolved Issues

  • WhiteSource Advise for Eclipse: Reinstallation of the WhiteSource Advise plugin caused multiple entries in the Builders view.

...

NOTE: The GitHub Enterprise, Bitbucket Server, and GitLab integrations in this version support version 20.7.3 of the Unified Agent. The GitHub.com integration in this version supports version 20.8.1 of the Unified Agent.

Resolved Issues

  • When a vulnerability affected multiple packages, only information on a single package was shown in the WhiteSource security check.
  • Global Configuration: Adding the migration.json file to a non-default branch generated a failed WhiteSource security check.

...

NOTE: The GitHub Enterprise, Bitbucket Server, and GitLab integrations in this version support version 20.7.2 of the Unified Agent. The GitHub.com integration in this version supports version 20.7.3 of the Unified Agent.

Resolved Issues

  • WhiteSource for GitHub.com, WhiteSource for GitHub Enterprise: Migrating specific repositories to the global configuration using the excludeRepos parameter led to incorrect results.

...

NOTE: The GitHub Enterprise, Bitbucket Server, and GitLab integrations in this version support version 20.7.1 of the Unified Agent. The GitHub.com integration in this version supports version 20.7.2 of the Unified Agent.

Resolved Issues

  • WhiteSource for GitHub.com, WhiteSource for GitHub Enterprise: When the content of a "WhiteSource Security Check" exceeded GitHub's size limit for a Check Run, the check run content was not displayed.
  • WhiteSource for Bitbucket Server, WhiteSource for GitHub Enterprise, WhiteSource for GitHub.com, WhiteSource for GitLab: As part of the Global Repo Configuration, the whitesource-config repository had to be initialized with a README file in order for the global-config.json and repo-config.json files to be automatically generated by the integration.

Version 20.7.1.1 (23-July-2020)

Resolved Issues

  • All Repo Integrations: In some scenarios, the WhiteSource Security Check summary functionality led to a NullPointer exception where we could not identify the package dependency file path. This led to the Check Run/Commit Status/Build Status being in Pending status for 6 hours, after which a timeout mechanism marked it as Failed.

...

NOTE: The GitHub Enterprise, Bitbucket Server, and GitLab integrations in this version support version 20.6.1 of the Unified Agent. The GitHub.com integration in this version supports version 20.6.2 of the Unified Agent.

Resolved Issues

  • WhiteSource for Bitbucket Server: When uninstalling the add-on, the activation key and list of integrated repositories were not cleared.

...

NOTE: The GitHub Enterprise, Bitbucket Server, and GitLab integrations in this version support version 20.4.2 of the Unified Agent. The GitHub.com integration in this version supports version 20.5.1 of the Unified Agent.

Resolved Issues

  • WhiteSource for GitHub Enterprise: When running the wss-ghe-app container, a FileNotFoundException error message appeared in the logs.

...

NOTE: The GitHub Enterprise, Bitbucket Server, and GitLab integrations in this version support version 20.4.1 of the Unified Agent. The GitHub.com integration in this version supports version 20.4.2.2 of the Unified Agent.

Resolved Issues

  • WhiteSource for GitHub Enterprise: When performing a scan, the local Maven registry directive was ignored.

...

NOTE: The GitHub Enterprise, Bitbucket Server, and GitLab Server integrations in this version support version 20.2.1 of the Unified Agent. The GitHub.com integration in this version supports version 20.2.2 of the Unified Agent.

Resolved Issues

  • WhiteSource Advise for Eclipse - Quick fix did not work when the version was provided as a variable

...

ProductDescription
WhiteSource for Bitbucket ServerThe .whitesource configuration file now includes a parameter minSeverityLevel, enabling you to decide whether to open a new Bitbucket Server Issue only if a certain Security Vulnerability Severity level is available.
WhiteSource Advise for ChromeRemoved browser permissions for the Chrome extension that were not used by WhiteSource.

Resolved Issues

ProductsDescription

WhiteSource for GitHub.com, WhiteSource for GitHub Enterprise

When executing a scan with either the LOCAL or EXTERNAL values set for the configMode parameter in the .whitesource configuration file, the includes and excludes parameters are ignored.

...