Merge pull request #5251 from nscuro/changelog-v4.13.4

Author: nscuro

docs/_posts/2025-08-26-v4.13.4.md

@@ -0,0 +1,65 @@
+---
+title: v4.13.4
+type: patch
+---
+
+This release primarily addresses the [removal of NVD 1.1 data feeds](https://www.nist.gov/itl/nvd), 
+which caused Dependency-Track's NVD mirroring process to fail. With this release, 
+Dependency-Track will consume the new 2.0 data feeds.
+
+Users who cannot perform this upgrade immediately can configure NVD mirroring to be performed via
+the NVD REST API instead. Refer to the [NVD datasource documentation] for details.
+
+**Features:**
+
+* Migrate to NVD 2.0 data feeds - [apiserver/#5236]
+
+**Fixes:**
+
+* Handle URLs in composer package metadata pattern - [apiserver/#5234]
+* Fix failing TrivyAnalysisTaskIntegrationTest - [apiserver/#5241]
+* Handle `adduser` / `addgroup` removal in Debian base image - [apiserver/#5246]
+* Fix inconsistent ordering in findings endpoints - [apiserver/#5247]
+* Fix failing Trivy OS matching for distro versions with special characters - [apiserver/#5249]
+
+For a complete list of changes, refer to the respective GitHub milestones:
+
+* [API server milestone 4.13.4](https://github.com/DependencyTrack/dependency-track/milestone/58?closed=1)
+* [Frontend milestone 4.13.4](https://github.com/DependencyTrack/frontend/milestone/43?closed=1)
+
+We thank all organizations and individuals who contributed to this release, from logging issues to taking part in discussions on GitHub & Slack to testing of fixes.
+
+###### dependency-track-apiserver.jar
+
+| Algorithm | Checksum |
+|:----------|:---------|
+| SHA-1     |          |
+| SHA-256   |          |
+
+###### dependency-track-bundled.jar
+
+| Algorithm | Checksum |
+|:----------|:---------|
+| SHA-1     |          |
+| SHA-256   |          |
+
+###### frontend-dist.zip
+
+| Algorithm | Checksum                                                         |
+|:----------|:-----------------------------------------------------------------|
+| SHA-1     | 827522ca8079450a8560a58a1b4e71add0a5d630                         |
+| SHA-256   | d0e604300d52047c32a98a51aa32e1cf2276525fa81557c4c95f1ad49f30d820 |
+
+###### Software Bill of Materials (SBOM)
+
+* API Server: [bom.json](https://github.com/DependencyTrack/dependency-track/releases/download/4.13.4/bom.json)
+* Frontend: [bom.json](https://github.com/DependencyTrack/frontend/releases/download/4.13.4/bom.json)
+
+[NVD datasource documentation]: {{ site.baseurl }}{% link _docs/datasources/nvd.md %}#mirroring-via-nvd-rest-api
+
+[apiserver/#5234]: https://github.com/DependencyTrack/dependency-track/pull/5234
+[apiserver/#5236]: https://github.com/DependencyTrack/dependency-track/pull/5236
+[apiserver/#5241]: https://github.com/DependencyTrack/dependency-track/pull/5241
+[apiserver/#5246]: https://github.com/DependencyTrack/dependency-track/pull/5246
+[apiserver/#5247]: https://github.com/DependencyTrack/dependency-track/pull/5247
+[apiserver/#5249]: https://github.com/DependencyTrack/dependency-track/pull/5249