Update dependecy-check plugin and add surpressions for false positives

cryptomator · Jan 4, 2023 · 16a3d0a · 16a3d0a
1 parent f8829b9
commit 16a3d0a
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 1 deletion.
diff --git a/pom.xml b/pom.xml
@@ -36,7 +36,7 @@
 		<maven.source.version>3.2.1</maven.source.version>
 		<maven.javadoc.version>3.4.1</maven.javadoc.version>
 		<maven.gpg.version>3.0.1</maven.gpg.version>
-		<dependency-check.version>7.3.0</dependency-check.version>
+		<dependency-check.version>7.4.0</dependency-check.version>
 		<jacoco.version>0.8.8</jacoco.version>
 		<nexus.staging.version>1.6.13</nexus.staging.version>
 	</properties>

diff --git a/suppression.xml b/suppression.xml
@@ -3,4 +3,14 @@
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.2.xsd"
 			  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 			  xsi:schemaLocation="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.2.xsd ">
+	<!-- Apache Commons-cli false positives below -->
+	<suppress>
+		<notes><![CDATA[
+			False positive for commons-cli due, see https://github.com/jeremylong/DependencyCheck/pull/4148
+		]]></notes>
+		<gav regex="true">^commons\-cli:commons\-cli:.*$</gav>
+		<cpe>cpe:/a:apache:james</cpe>
+		<cpe>cpe:/a:spirit-project:spirit</cpe>
+		<cpe>cpe:/a:apache:commons_net</cpe>
+	</suppress>
 </suppressions>