4.12.5

For official releases, refer to Dependency Track Docs >> Changelogs for information about improvements and upgrade notes.
If additional details are required, consult the closed issues for this release milestone.

# SHA1
d5c8c84612e6f09dcbefe596545c11384615f14c  dependency-track-apiserver.jar
c4c020b2652413f99daf41965231a8c17f90e2a8  dependency-track-bundled.jar
# SHA256
b0e9a93c06fb92d2c4bba2724689d58cc8455ac92c42cb5cf844686fad2d2820  dependency-track-apiserver.jar
ba569456a971f772d4d8a70fddc6fea2c9d4fbc6b12dfc7458d102dc97ed0206  dependency-track-bundled.jar
# SHA512
925cd222dad2715483cb3f5e9a7d85468d557448293a529d564957ad70429546e8d67d3a832a569df3ded79a4d486d4219f6e0f4fb7cce2358776164d0d7b9ed  dependency-track-apiserver.jar
7ea8917def588a57de9bbca9e8bf9420097e48946e6a9a50b4b2678b02b652279b79075f8c8cbbd48083532ccbfa477314dd712d885e207e56c0780a764c8f3e  dependency-track-bundled.jar

What's Changed

Dependency Updates 🤖

• Backport: Bump io.github.jeremylong:open-vulnerability-clients from 7.2.1 to 7.2.2 by @nscuro in #4656
• Backport: Bump bundled frontend to 4.12.5 by @nscuro in #4659

Other Changes

• Add changelog for v4.12.5 by @nscuro in #4657

Full Changelog: 4.12.4...4.12.5

4.12.4

For official releases, refer to Dependency Track Docs >> Changelogs for information about improvements and upgrade notes.
If additional details are required, consult the closed issues for this release milestone.

# SHA1
6467242cb3ce65fb128ded6e4d40bd45bf3c74f3  dependency-track-apiserver.jar
a27297edf0da4d208c3b89d31fcd441958767e48  dependency-track-bundled.jar
# SHA256
9abd2ec5091645779d1eecbcad0ed78c4175565fe93eddce8b600113fe66f476  dependency-track-apiserver.jar
fe490211de5988fb651a8e869e36d46c33caca030b26a61172e9fc49b0d94404  dependency-track-bundled.jar
# SHA512
b7289546a53ec598430a0c2e435d9dee6c2e53ca0eedfa7232ba882c77c18bf54b92185817e05181d0081ffe35d7250c61f18f3a80109afa90e1bd4c8273a268  dependency-track-apiserver.jar
1aebd3967192d6749059ab31b30e3faed0e7fba416692d0096d82ae6e4f212e820b4432093e665cd169657e8e2dca786be808694dcf685d7475b0f6699491373  dependency-track-bundled.jar

What's Changed

Bug Fixes 🐛

• Backport: Fix possible NPEs during tag binding by @nscuro in #4595
• Backport: Fix false negatives in CPE matching for ANY and NA versions by @nscuro in #4612
• Backport: Refactor VulnerabilityAnalysisTask to be more efficient by @nscuro in #4625
• Backport: Refactor VulnerabilityManagementUploadTask to be more efficient by @nscuro in #4626
• Backport: Fix erroneous URL-encoding of the Maven groupId by @nscuro in #4629
• Backport: Handle invalid CVSS vectors and processing failures for OSV by @nscuro in #4638

Dependency Updates 🤖

• Backport: Bump Temurin base image to 21.0.6_7 by @nscuro in #4628
• Backport: Bump bundled frontend to 4.12.4 by @nscuro in #4641

Other Changes

• Add changelog for v4.12.4 by @nscuro in #4630

Full Changelog: 4.12.3...4.12.4

4.12.3

For official releases, refer to Dependency Track Docs >> Changelogs for information about improvements and upgrade notes.
If additional details are required, consult the closed issues for this release milestone.

# SHA1
3d315e8d6637a69a5db4f3f545391bb007ee6ae8  dependency-track-apiserver.jar
1ed5ad7b1afa61fbefbe30cc4d1587d5ae255966  dependency-track-bundled.jar
# SHA256
41d925a83b6720824ccd7b0ec5e04c8d52a21fe138418256abef191ac6f99dbc  dependency-track-apiserver.jar
1348c4fd3ed6ba73bd808c27ae0f64da0137fb2edeeb494f93852e75d53d821a  dependency-track-bundled.jar
# SHA512
19e03c1953766c2113774377243e5c8b977b4a1b83e5d171b8ff7907687c2f88af16674e57731dfe3e4d0d0757d8db6f7e00379c6a06e3683ac8ba1c31c6e0c9  dependency-track-apiserver.jar
db1666c9973cc2b3d3e960f468f88a10467f4a781eed77dea366975e17b3c5823a1e7a06449dbb0abac9768ce8a34b4c518eca8945064309df5e5f609578e828  dependency-track-bundled.jar

What's Changed

Bug Fixes 🐛

• Backport: Fix broken pagination in /api/v1/cwe endpoint by @nscuro in #4459
• Backport: Fix notification tests not working for Jira by @nscuro in #4460
• Backport: Fix component de-duplication potentially causing duplicate dependency graph entries by @nscuro in #4461
• Backport: Fix component SWID tag ID not being considered in project cloning by @nscuro in #4481
• Backport: Fix onlyOutdated ungrouped component filtering by @nscuro (original change by @sedan07) in #4513
• Backport: Fix REST endpoints for adding tags by @nscuro in #4543
• Backport: Recreate outdated check constraints for CLASSIFIER columns by @nscuro in #4545
• Backport: Handle GitHub GraphQL API rate limiting by @nscuro in #4581

Dependency Updates 🤖

• Bump Debian and Temurin base images to latest digest by @nscuro in #4582
• Backport: Bump bundled frontend to 4.12.3 by @nscuro in #4589

Other Changes

• Add changelog for v4.12.3 by @nscuro in #4583

Full Changelog: 4.12.2...4.12.3

4.12.2

For official releases, refer to Dependency Track Docs >> Changelogs for information about improvements and upgrade notes.
If additional details are required, consult the closed issues for this release milestone.

# SHA1
114d6a9f8b87a307be324f155daf3454dcc269bb  dependency-track-apiserver.jar
a15db1b85d0ac29977724deb3f9a65428c929d39  dependency-track-bundled.jar
# SHA256
ef6bb4ce3ebea410b620a91cf8347ab1e95c32b3f166103c749ece97f4098591  dependency-track-apiserver.jar
a8aba7cd926de3deeea31290be830ee90282128f1820fddde3ec8b346bba1bdd  dependency-track-bundled.jar
# SHA512
c2fc89377de194af70dab631b2f385f9e9cac93b140916e795a4b43bf7f3d7091ef64b64614bc1935282f23d9f7e3ba40dc41d2c98fa33167d62b409f75c79d8  dependency-track-apiserver.jar
684666c5b5456609d4694c5ce8b793bf64a49b77219784954ec6d5a6abe38895a2637f3644ca9197061fdc4e4ba203e3699849b656730d5eb52649a11cb685bb  dependency-track-bundled.jar

What's Changed

Enhancements 🚀

• Backport: Reduce memory usage of metrics update tasks by @nscuro in #4377

Bug Fixes 🐛

• Backport: Fix CPE matching for NVD mirroring via REST API by @nscuro (original change by @calderonth) in #4378
• Backport: Fix incorrect CWE schema in OpenAPI spec by @nscuro (original change by @fupgang) in #4379
• Backport: Fix NullPointerException when fetching findings by @nscuro in #4380
• Backport: Fix policy evaluation not happening upon creation or update of individual components by @nscuro (original change by @fupgang) in #4381
• Backport: Fix nullable metrics fields having getters of primitive type by @nscuro in #4382
• Backport: Fix Trivy analyzer vulnerability matching for Go packages by @nscuro in #4395
• Backport: Move GHSA notification logic outside recursion by @nscuro (original change by @antoinbo) in #4417
• Backport: Add cyclonedx json media type when exporting components by @nscuro (original change by @wratner) in #4420
• Backport: Fix NPE when cloning projects with broken dependency graph by @nscuro in #4419
• Backport: Fix project.active being nullable by @nscuro in #4418
• Fix incompatibility of swagger-core with newer jackson-databind versions by @nscuro in #4442

Dependency Updates 🤖

• Backport: Bump Alpine to 3.1.2 by @nscuro in #4436
• Backport: Bump bundled frontend to 4.12.2 by @nscuro in #4441

Other Changes

• Add changelog for v4.12.2 by @nscuro in #4439

Full Changelog: 4.12.1...4.12.2

4.12.1

For official releases, refer to Dependency Track Docs >> Changelogs for information about improvements and upgrade notes.
If additional details are required, consult the closed issues for this release milestone.

# SHA1
18911ef4fa28531d97293bd70de2ebb4033e5b5c  dependency-track-apiserver.jar
b3f3eb8cb5c8021ba7bdb37a5717cd2672550385  dependency-track-bundled.jar
# SHA256
682a3ffe268c59b0df03a55fd72b56d46299db3fd2cfe081966d8d57fbbea4f6  dependency-track-apiserver.jar
dc1a3e65e8ce767e39925bf329be8eff29ff09eebc627db8efd0e1b5ff6db573  dependency-track-bundled.jar
# SHA512
ab990553ea288960089441746908410a886453c5e0e3bc3f0752c27951a2e51adce7f8a02b29ac06fa8d99a17e7be74afd5af3436c92f2d37a2f64ec414cebd2  dependency-track-apiserver.jar
a03cef2139f90aeb8de2a037af5dbd374270c97460f60241cb4d5bddcec497e8581ba89d1a9f027066a275f921e88d39265ae7d9efec1f47af5e15566db247a6  dependency-track-bundled.jar

What's Changed

Bug Fixes 🐛

• Backport: Fix logs not containing usernames of deleted users by @nscuro (original change by @Gepardgame) in #4232
• Backport: Fix unintended manual flushing mode due to DataNucleus ExecutionContext pooling by @nscuro in #4233
• Backport: Prevent duplicate policy violations by @nscuro in #4234
• Backport: Enhance policy violation de-duplication logic by @nscuro in #4235
• Backport: Fix inaccuracies of Trivy analyzer by @nscuro in #4258
• Backport: Fix redundant query for "ignore unfixed" config during Trivy analysis by @nscuro in #4259
• Backport: Fix excessive memory usage of portfolio repository meta analysis by @nscuro in #4317

Dependency Updates 🤖

• Backport: Bump cyclonedx-core-java to 9.1.0 by @nscuro in #4271
• Backport: Bump Alpine to 3.1.1 by @nscuro in #4309
• Backport: Bump Temurin base image to 21.0.5_11 by @nscuro in #4315
• Backport: Bump bundled frontend to 4.12.1 by @nscuro in #4319

Other Changes

• Backport: Update Deploying Docker guide to Compose v2 by @nscuro (original change by @danihengeveld) in #4301
• Add changelog for v4.12.1 by @nscuro in #4280

Full Changelog: 4.12.0...4.12.1

4.12.0

For official releases, refer to Dependency Track Docs >> Changelogs for information about improvements and upgrade notes.
If additional details are required, consult the closed issues for this release milestone.

# SHA1
0cfe5d6cd014a0a25cdb0379e5a75596adc3d448  dependency-track-apiserver.jar
f7a1af3a5bf5f5b864d0db519fe2944391496f32  dependency-track-bundled.jar
# SHA256
83d31e132643249f7752154adc49690353484a66de6e77db7e25f0c1309528eb  dependency-track-apiserver.jar
3b4e27b29fd8a19cc5a250d394df43e0b046781f4d37c11720f8db8b9714d669  dependency-track-bundled.jar
# SHA512
44b47c7f864a09733b45fce747c3f6a115a0ba4d753d179b78a613404ab7bdd9008cef3539f5af72193506a7cd1b88fca5041a858a0f287612f2ac5572650fae  dependency-track-apiserver.jar
6e6b1210749d89b1ccc29ddc4dcbf2e38c926663f888f644488e63ffda00eb29c79eff1b180941dc798210f5ecf7c2a0e4175e03130f69a08beee36d66aef9fa  dependency-track-bundled.jar

What's Changed

Enhancements 🚀

• Raise baseline Java version to 21 by @nscuro in #3682
• Add active Field To Project Versions by @aravindparappil46 in #3691
• Support ingestion of CycloneDX v1.6 BOMs by @nscuro in #3710
• Gracefully handle NotSortableExceptions by @nscuro in #3724
• Migrate from Swagger v2 to OpenAPI v3 by @nscuro in #3726
• Improve OpenAPI v3 integration by @nscuro in #3728
• Add EPSS conditions to policies by @2000rosser in #3746
• Search component by group by @rcsilva83 in #3761
• Add Notification For BOM_VALIDATION_FAILED by @aravindparappil46 in #3796
• Bump CWE dictionary to v4.14 by @nscuro in #3819
• Bump SPDX license list to v3.24.0 by @nscuro in #3846
• feat: autocreate project with tags by @JCHacking in #3843
• Improve performance of findings retrieval by @nscuro in #3869
• Add REST endpoints for tag retrieval by @nscuro in #3881
• Deprecate /api/v1/tag/{policyUuid} in favor of /api/v1/tag/policy/{uuid} by @nscuro in #3887
• Enable string de-duplication JVM option per default by @nscuro in #3893
• Add REST endpoints for bulk tagging & un-tagging of projects by @nscuro in #3894
• Add REST endpoint for tag deletion by @nscuro in #3896
• Add REST endpoints to tag and untag policies in bulk by @nscuro in #3924
• Log warning when dependency graph is missing the root node by @nscuro in #3990
• Add option to test notification publisher by @2000rosser in #3983
• Add support for authors field by @2000rosser in #3969
• Add tag support for notifications, and REST endpoints for tagging & untagging notifications in bulk by @nscuro in #4031
• Disable H2 shutdown hook by @nscuro in #4106
• Support inclusion/exclusion of projects from BOM validation with tags by @nscuro in #4109
• Migrate Trivy integration to use Protobuf instead of JSON by @nscuro in #4116
• Bump generated BOM to CycloneDX v1.5; Add external references by @nscuro in #4110
• Bump Alpine to 3.1.0 and adopt new framework features by @nscuro in #4134
• Support customizable welcome message to display on login page by @Gepardgame in #4131
• Add AUTHOR -> AUTHORS migration by @nscuro in #4143
• Bump SPDX license list to v3.25.0 by @2000rosser in #4145
• Support configuration of system-wide default locale by @Gepardgame in #4136
• Include team name in audit trail for API-submitted audit changes by @Gepardgame in #4154
• Global Audit View: Policy Violations by @rbt-mm in #3544
• Support assigning of teams for portfolio ACL when creating a project by @Gepardgame in #4093
• Introduce isLatest project flag & allow policies to be limited to latest version by @rkg-mm in #4184
• Enhance badge API to require authorization by @SaberStrat in #4059
• Exclude pre-releases from NuGet latest version check by @brentos99 in #3468
• Ensure modifying project endpoints are transactional by @nscuro in #4194
• Fix redundant ConfigProperty queries in BadgeResource by @nscuro in #4202

Bug Fixes 🐛

• Fix failing JSON BOM validation when specVersion is not one of the first fields by @nscuro in #3697
• Fix broken global vuln audit view for MSSQL by @nscuro in #3700
• fix os handling when trivy sets pkgType on properties by @fnxpt in #3727
• Fix OpenAPI types of UNIX timestamp fields by @nscuro in #3731
• Handle breaking change in Trivy server API by @nscuro in #3738
• Add date format to support offset in nuget analyser by @sahibamittal in #3736
• Fix project name not showing in Jira tickets by @lgrguricmileusnic in #3745
• Fix jakarta.servlet-api not being inherited from alpine-server by @nscuro in #3770
• Fix licenses not being resolved by name by @nscuro in #3782
• Fix Slack notifications failing when no base URL is configured by @nscuro in #3791
• Issue-3769 : fix update component external references by @sahibamittal in #3805
• vulnerabilityAudit incorrectly displaying non-active projects by @2000rosser in #3839
• Fix BOM validation failing when URL contains encoded [ and ] characters by @nscuro in #3865
• Prevent XXE injection during CycloneDX validation and parsing by @nscuro in #3870
• Fix BOM_CONSUMED and BOM_PROCESSED notifications being dispatched with wrong scope by @nscuro in #3877
• Relax lowercase requirement for /api/v1/tag/{name}/project and /api/v1/tag/{name}/policy by @nscuro in #3888
• Fix NPE when querying component metadata for projects without findings by @nscuro in #3889
• Set license name instead of ID when using custom license by @2000rosser in #3915
• Fix JDOUserException when multiple licenses match a component's license name by @nscuro in #3958
• Add regression test for missing parent property in /v1/project/{uuid} response by @nscuro in #3959
• Fix missing projectTags parameter for POST /v1/bom endpoint by @nscuro in #3960
• Ensure no unique constraint violation for ProjectMetadata by @nscuro in #3982
• Fix validation error when XML BOM declares multiple namespaces by @philippn in #4020
• added missing endpoints in index html for open api upgrade by @mehab in #4022
• Handle breaking change in Trivy v0.54.0 server API by @nscuro in #4023
• Fix project link for new vulnerable dependency for email by @2000rosser in #4026
• Fix vex export returning invalid CycloneDX by @SaberStrat in https://github.com/DependencyTrack/dependency-track/pul...

4.11.7

For official releases, refer to Dependency Track Docs >> Changelogs for information about improvements and upgrade notes.
If additional details are required, consult the closed issues for this release milestone.

# SHA1
9a916abcbb478a4dbad101f5335acdf2b8462062  dependency-track-apiserver.jar
c5a30ee550af8a943bb77167e515fb6422e51b36  dependency-track-bundled.jar
# SHA256
2df1b2ea67a16cdc6108c3ac2f538018e529205ce5f36a6da78f2feefeddd2c8  dependency-track-apiserver.jar
4665cdd14351d7b1c41004ffc57791297c4ec5fc7f958635cff246d1b1a95eed  dependency-track-bundled.jar
# SHA512
d83a209056a7f7ff55b42fa33818dab57668e99c97ffd63c579311743398abc3d102c4a4197577321f3cd3ef9a4654527f453be1d4c217d087d32282f7e57a91  dependency-track-apiserver.jar
2d6fc1c1dd0af04ed92f1b8383ee4524169cde1c715f1e29899cf95b5d6d50f98caa5ec9debc2bd3a2a388d60cc528adb3e861f2248c9c439e8b2f5078a0e3a8  dependency-track-bundled.jar

What's Changed

Bug Fixes 🐛

• Fix directDependencies, externalReferences, metadata missing from /api/v1/project/{uuid} response when not already cached by @nscuro in #4071

Dependency Updates 🤖

• Bump bundled frontend to 4.11.7 by @nscuro in #4073

Other Changes

• Add changelog for v4.11.7 by @nscuro in #4072

Full Changelog: 4.11.6...4.11.7

4.11.6

For official releases, refer to Dependency Track Docs >> Changelogs for information about improvements and upgrade notes.
If additional details are required, consult the closed issues for this release milestone.

# SHA1
daab7ed5b760ff909e4b9cc041b89c3374c1d955  dependency-track-apiserver.jar
8ff2bd4db69e7083d501a4c489f703677044a5f0  dependency-track-bundled.jar
# SHA256
a76cc3417728bdc880f41af613e543d3e5f033d7b0b1db84ffb397bcbcb3936b  dependency-track-apiserver.jar
fd1c25e2b2d727f377eeec8240370558a9796225fe4dc0f258021b1061fbc36f  dependency-track-bundled.jar
# SHA512
1064d3d04da4d47f35d38f04956adbd2e24a5bc8f828c0f9a7c93705fb09f4ebcdee266a9d931aa64d94f583ef7c11ddc788dad2cf0b1682546c4fe927194b57  dependency-track-apiserver.jar
e0cc1abd661c991dd2ef3e19dd09903d609d2860c8510cc120bb399fb4751757d25cb05c1ef160e935579350a1cb060add556f3535e0b340f4bcbe848b9e0038  dependency-track-bundled.jar

What's Changed

Bug Fixes 🐛

• Backport: Handle breaking change in Trivy v0.54.0 server API by @nscuro in #4040
• Backport: Fix anchors in changelog documentation by @nscuro (original change by @JCHacking) in #4043
• Backport: Fix validation error when XML BOM declares multiple namespaces by @nscuro (original change by @philippn) in #4041
• Backport: Fix project link for new vulnerable dependency for email by @nscuro (original change by @2000rosser) in #4044
• Backport: Fix JDOUserException when multiple licenses match a component's license name by @nscuro in #4042
• Fix parent field occasionally missing in /api/v1/project/{uuid} responses by @nscuro in #4049
• Backport: Fix vex export returning invalid CycloneDX by @nscuro (original change by @SaberStrat) in #4054

Dependency Updates 🤖

• Backport: Bump Temurin base image to 21.0.4_7 by @nscuro in #4056
• Bump bundled frontend to v4.11.6 by @nscuro in #4057

Other Changes

• Add changelog for v4.11.6 by @nscuro in #4045

Full Changelog: 4.11.5...4.11.6

4.11.5

For official releases, refer to Dependency Track Docs >> Changelogs for information about improvements and upgrade notes.
If additional details are required, consult the closed issues for this release milestone.

# SHA1
8fd45ea6ae725e8e7dac59ec9d471fcdaeb42c6d  dependency-track-apiserver.jar
eba6cbaa6c2da9ffb295da83ed39af68ff4130a8  dependency-track-bundled.jar
# SHA256
c39c15849cbb7dd19833ea689c20aaf92bc9f6965b758961e1d2a01a2b09f86f  dependency-track-apiserver.jar
7ebb11573b2a59084ed98fe92d363240c910dc7b5aa7ebeda64bee7d47089d9a  dependency-track-bundled.jar
# SHA512
5c885c595687f20da1792393a161e30f23bb3fdfd9deb31c6010be3da86e839a046d2ba854a52f1148ba38fd368c084c911910a90ea384391cf6cad5e52bc1cd  dependency-track-apiserver.jar
eb0e56faa86bae2cb7d81b77e95fa6f809eaa55e7ed8a412dcb15cb4491490ae8398812752e460a07d12ca03b08a0951567be60accd48462c73263388dcd21ef  dependency-track-bundled.jar

What's Changed

Bug Fixes 🐛

• Backport: Fix BOM_CONSUMED and BOM_PROCESSED notifications being dispatched with wrong scope for BOM processing V2 by @nscuro in #3941
• Backport: Set license name instead of ID when using custom license by @nscuro (original change by @2000rosser) in #3942

Dependency Updates 🤖

• Backport: Bump io.github.jeremylong:open-vulnerability-clients from 6.1.1 to 6.1.2 by @nscuro in #3940
• Backport: Bump debian from 0200978 to f8bbfa0 by @nscuro in #3943
• Bump oauth2-oidc-sdk from 10.15 to 11.13 by @nscuro in #3944
• Bump bundled frontend to 4.11.5 by @nscuro in #3945

Other Changes

• Add changelog for v4.11.5 by @nscuro in #3946

Full Changelog: 4.11.4...4.11.5

4.11.4

For official releases, refer to Dependency Track Docs >> Changelogs for information about improvements and upgrade notes.
If additional details are required, consult the closed issues for this release milestone.

# SHA1
19531d4f02cccf26478b3a63feba355da8726b3f  dependency-track-apiserver.jar
3c4bb658783157ae9c408b8323e25e55c9ab25fd  dependency-track-bundled.jar
# SHA256
9a09259ba4c19d02b81a39fb5894df758f19ff1bb43538d4b999b4a5789a9d9b  dependency-track-apiserver.jar
73fc867d347da8a8af14f8c6812e13b870037a28d7de83e2837db9c27d840100  dependency-track-bundled.jar
# SHA512
a357be2617e9da6d4eaf19120316927ccddbc1290b9f0179287619864ffe2f6a349c9cab729853469425e273662e64cb49a4ede5498da937817b3cda01997af9  dependency-track-apiserver.jar
13fbf6477f2820b0926ad082063332e9f34de622e64b11cfe0fa4574ba5d2d9f41c06c791740ddb69a34fc71e21b6456f20c36018eb2b52e0664fdc47a41645f  dependency-track-bundled.jar

What's Changed

Enhancements 🚀

• Backport: Support ingestion of CycloneDX v1.6 BOMs by @nscuro in #3863

Bug Fixes 🐛

• Backport: Fix inverted "show inactive" filter in vulnerability audit view by @nscuro (original change by @2000rosser) in #3864
• Backport: Fix BOM validation failing when URL contains encoded [ and ] characters by @nscuro in #3866
• Backport: Fix external references not being updated via POST /v1/component by @nscuro (original change by @sahibamittal) in #3867
• Backport: Prevent XXE injection during CycloneDX validation and parsing by @nscuro in #3871

Dependency Updates 🤖

• Backport: Bump bundled frontend to 4.11.4 by @nscuro in #3875

Other Changes

• Add changelog for v4.11.4 by @nscuro in #3868

Full Changelog: 4.11.3...4.11.4