feat: upgrade to dotnet 8.0

.github/dependabot.yml

@@ -12,9 +12,3 @@ updates:
     directory: "/"
     schedule:
      interval: "daily"
-    ignore:
-     # stay .net 3.1
-     - dependency-name: "mcr.microsoft.com/dotnet/runtime"
-       versions:
-         - "5.x"
-         - "6.x"

Dockerfile

@@ -4,7 +4,7 @@ FROM azul/zulu-openjdk-alpine:17 AS jlink
 
 RUN "$JAVA_HOME/bin/jlink" --compress=2 --module-path /opt/java/openjdk/jmods --add-modules java.base,java.compiler,java.datatransfer,jdk.crypto.ec,java.desktop,java.instrument,java.logging,java.management,java.naming,java.rmi,java.scripting,java.security.sasl,java.sql,java.transaction.xa,java.xml,jdk.unsupported --output /jlinked
 
-FROM mcr.microsoft.com/dotnet/runtime:6.0-alpine3.16
+FROM mcr.microsoft.com/dotnet/runtime:8.0-alpine3.18
 
 ARG VERSION
 ARG POSTGRES_DRIVER_VERSION=42.2.19

README.md

@@ -80,8 +80,8 @@ In order to analyze some technology stacks dependency-check may require other
 development tools to be installed. Some of the analysis listed below may be
 experimental and require the experimental analyzers to be enabled.
 
-1. To analyze .NET Assemblies the dotnet 6 run time or SDK must be installed.
-   - Assemblies targeting other run times can be analyzed - but 6 is required to run the analysis.
+1. To analyze .NET Assemblies the dotnet 8 run time or SDK must be installed.
+   - Assemblies targeting other run times can be analyzed - but 8 is required to run the analysis.
 2. If analyzing GoLang projects `go` must be installed.
 3. The analysis of `Elixir` projects requires `mix_audit`.
 4. The analysis of `npm`, `pnpm`, and `yarn` projects requires `npm`, `pnpm`, or `yarn` to be installed.
@@ -171,7 +171,7 @@ For installation to pass, you must have the following components installed:
 * Maven: `mvn -version` 3.5.0 and higher
 
 Tests cases require:
-* dotnet core version 6.0
+* dotnet core version 8.0
 * Go: `go version` 1.12 and higher
 * Ruby [bundler-audit](https://github.com/rubysec/bundler-audit#install)
 * [Yarn](https://classic.yarnpkg.com/en/docs/install/)

core/src/main/java/org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java

@@ -355,7 +355,7 @@ public void prepareFileTypeAnalyzer(Engine engine) throws InitializationExceptio
                     + "'exe' or 'dll' was scanned. The 'dotnet' executable could not be found on "
                     + "the path; either disable the Assembly Analyzer or add the path to dotnet "
                     + "core in the configuration.");
-            LOGGER.error("The dotnet 6.0 core runtime or SDK is required to analyze assemblies");
+            LOGGER.error("The dotnet 8.0 core runtime or SDK is required to analyze assemblies");
             LOGGER.error("----------------------------------------------------");
             return;
         }
@@ -367,28 +367,28 @@ public void prepareFileTypeAnalyzer(Engine engine) throws InitializationExceptio
                 final String error = processReader.getError();
                 if (p.exitValue() != 1 || !StringUtils.isBlank(error)) {
                     LOGGER.warn("An error occurred with the .NET AssemblyAnalyzer, please see the log for more details.\n"
-                    + "dependency-check requires dotnet 6.0 core runtime or sdk to be installed to analyze assemblies.");
+                    + "dependency-check requires dotnet 8.0 core runtime or sdk to be installed to analyze assemblies.");
                     LOGGER.debug("GrokAssembly.dll is not working properly");
                     grokAssembly = null;
                     setEnabled(false);
-                    throw new InitializationException("Could not execute .NET AssemblyAnalyzer, is the dotnet 6.0 runtime or sdk installed?");
+                    throw new InitializationException("Could not execute .NET AssemblyAnalyzer, is the dotnet 8.0 runtime or sdk installed?");
                 }
             }
         } catch (InterruptedException e) {
             Thread.currentThread().interrupt();
             LOGGER.warn("An error occurred with the .NET AssemblyAnalyzer;\n"
-                    + "dependency-check requires dotnet 6.0 core runtime or sdk to be installed to analyze assemblies;\n"
+                    + "dependency-check requires dotnet 8.0 core runtime or sdk to be installed to analyze assemblies;\n"
                     + "this can be ignored unless you are scanning .NET DLLs. Please see the log for more details.");
             LOGGER.debug("Could not execute GrokAssembly {}", e.getMessage());
             setEnabled(false);
             throw new InitializationException("An error occurred with the .NET AssemblyAnalyzer", e);
         } catch (IOException e) {
             LOGGER.warn("An error occurred with the .NET AssemblyAnalyzer;\n"
-                    + "dependency-check requires dotnet 6.0 core to be installed to analyze assemblies;\n"
+                    + "dependency-check requires dotnet 8.0 core to be installed to analyze assemblies;\n"
                     + "this can be ignored unless you are scanning .NET DLLs. Please see the log for more details.");
             LOGGER.debug("Could not execute GrokAssembly {}", e.getMessage());
             setEnabled(false);
-            throw new InitializationException("An error occurred with the .NET AssemblyAnalyzer, is the dotnet 6.0 runtime or sdk installed?", e);
+            throw new InitializationException("An error occurred with the .NET AssemblyAnalyzer, is the dotnet 8.0 runtime or sdk installed?", e);
         }
     }
 

core/src/test/java/org/owasp/dependencycheck/analyzer/AssemblyAnalyzerTest.java

@@ -163,7 +163,7 @@ public void testWithSettingMono() throws Exception {
             aanalyzer.prepare(null);
             fail("Expected an InitializationException");
         } catch (InitializationException ae) {
-            assertEquals("An error occurred with the .NET AssemblyAnalyzer, is the dotnet 6.0 runtime or sdk installed?", ae.getMessage());
+            assertEquals("An error occurred with the .NET AssemblyAnalyzer, is the dotnet 8.0 runtime or sdk installed?", ae.getMessage());
         } finally {
             System.setProperty(LOG_KEY, oldProp);
             // Recover the logger