Maven repo name affects the list of affected dependencies

Depending on the name of your local Maven repository, the list of dependencies having known vulnerabilities may vary.
Apparently the found CVEs are bundled to a dependency that is more relevant to the current project where the dependency-check is run (which is good). However, this bundling does not seem to happen when a differently named local Maven repository is used.

Perhaps it's related to this line of code: https://github.com/jeremylong/DependencyCheck/blob/v4.0.2/core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java#L329

### Example:

pom.xml:
```

4.0.0
com.example
myproject
1.0.0-SNAPSHOT

org.apache.spark
spark-core_2.10
1.6.3

```

#### Maven local repo with the default name:

Command: `mvn org.owasp:dependency-check-maven:4.0.2:aggregate -Dmaven.repo.local=repository`
This works the same way as without specifying the repository name and hence defaulting to `$HOME/m2/repository`: `mvn org.owasp:dependency-check-maven:4.0.2:aggregate`

Output:
```
spark-core_2.10-1.6.3.jar (org.apache.spark:spark-core_2.10:1.6.3, cpe:/a:apache:spark:1.6.3) : CVE-2017-7678, CVE-2018-11804, CVE-2018-1334, CVE-2017-12612, CVE-2018-8024, CVE-2018-11770, CVE-2018-17190
avro-mapred-1.7.7-hadoop2.jar (cpe:/a:apache:hadoop:1.7.7, org.apache.avro:avro-mapred:1.7.7) : CVE-2017-3162, CVE-2016-5001, CVE-2017-3161
commons-collections-3.2.1.jar (cpe:/a:apache:commons_collections:3.2.1, commons-collections:commons-collections:3.2.1) : CVE-2015-6420, CVE-2017-15708
commons-beanutils-1.7.0.jar (commons-beanutils:commons-beanutils:1.7.0, cpe:/a:apache:commons_beanutils:1.7.0) : CVE-2014-0114
commons-beanutils-core-1.8.0.jar (commons-beanutils:commons-beanutils-core:1.8.0, cpe:/a:apache:commons_beanutils:1.8.0) : CVE-2014-0114
xz-1.0.jar (cpe:/a:tukaani:xz:1.0, org.tukaani:xz:1.0) : CVE-2015-4035
jaxb-api-2.2.2.jar (cpe:/a:oracle:glassfish:2.2.2, javax.xml.bind:jaxb-api:2.2.2) : CVE-2015-2808, CVE-2013-2566
hadoop-mapreduce-client-core-2.2.0.jar (cpe:/a:apache:hadoop:2.2.0, org.apache.hadoop:hadoop-mapreduce-client-core:2.2.0) : CVE-2017-15713, CVE-2016-6811, CVE-2014-3627, CVE-2017-3162, CVE-2016-5001, CVE-2017-3161, CVE-2014-0229
curator-framework-2.4.0.jar (org.apache.curator:curator-framework:2.4.0, cpe:/a:apache:zookeeper:2.4.0) : CVE-2018-8012, CVE-2016-5017
zookeeper-3.4.5.jar (cpe:/a:apache:zookeeper:3.4.5, org.apache.zookeeper:zookeeper:3.4.5) : CVE-2018-8012, CVE-2016-5017, CVE-2017-5637
guava-14.0.1.jar (cpe:/a:google:guava:14.0.1, com.google.guava:guava:14.0.1) : CVE-2018-10237
slf4j-api-1.7.10.jar (cpe:/a:slf4j:slf4j:1.7.10, org.slf4j:slf4j-api:1.7.10) : CVE-2018-8088
jul-to-slf4j-1.7.10.jar (cpe:/a:slf4j:slf4j:1.7.10, org.slf4j:jul-to-slf4j:1.7.10) : CVE-2018-8088
jcl-over-slf4j-1.7.10.jar (cpe:/a:slf4j:slf4j:1.7.10, org.slf4j:jcl-over-slf4j:1.7.10) : CVE-2018-8088
akka-actor_2.10-2.3.11.jar (com.typesafe.akka:akka-actor_2.10:2.3.11, cpe:/a:akka:akka:2.3.11) : CVE-2017-1000034
netty-3.8.0.Final.jar (io.netty:netty:3.8.0.Final, cpe:/a:netty_project:netty:3.8.0) : CVE-2014-0193, CVE-2015-2156, CVE-2014-3488
protobuf-java-2.5.0.jar (cpe:/a:google:protobuf:2.5.0, com.google.protobuf:protobuf-java:2.5.0) : CVE-2015-5237
mesos-0.21.1-shaded-protobuf.jar (cpe:/a:apache:mesos:0.21.1, org.apache.mesos:mesos:0.21.1) : CVE-2017-7687, CVE-2018-8023, CVE-2017-9790
netty-all-4.0.29.Final.jar (cpe:/a:netty_project:netty:4.0.29, cpe:/a:all-for-one:all_for_one:4.0.29, io.netty:netty-all:4.0.29.Final) : CVE-2018-12056, CVE-2016-4970
jackson-databind-2.4.4.jar (cpe:/a:fasterxml:jackson-databind:2.4.4, com.fasterxml.jackson.core:jackson-databind:2.4.4, cpe:/a:fasterxml:jackson:2.4.4) : CVE-2017-15095, CVE-2017-17485, CVE-2017-7525, CVE-2018-7489, CVE-2018-5968
pyrolite-4.9.jar (cpe:/a:pickle:pickle:4.9, net.razorvine:pyrolite:4.9) : CVE-2007-1100
unused-1.0.0.jar (cpe:/a:apache:spark:1.0.0, org.spark-project.spark:unused:1.0.0) : CVE-2017-7678, CVE-2018-1334, CVE-2018-8024, CVE-2018-17190
spark-core_2.10-1.6.3.jar/META-INF/maven/org.eclipse.jetty/jetty-plus/pom.xml (org.eclipse.jetty:jetty-plus:8.1.19.v20160209, cpe:/a:eclipse:jetty:8.1.19.v20160209, cpe:/a:jetty:jetty:8.1.19.v20160209) : CVE-2017-7656, CVE-2017-7658, CVE-2017-7657, CVE-2017-9735
spark-unsafe_2.10-1.6.3.jar/META-INF/maven/org.apache.spark/spark-unsafe_2.10/pom.xml (org.apache.spark:spark-unsafe_2.10:1.6.3, cpe:/a:apache:spark:1.6.3) : CVE-2017-7678, CVE-2018-11804, CVE-2018-1334, CVE-2017-12612, CVE-2018-8024, CVE-2018-11770, CVE-2018-17190
```

#### Maven local repo with a non-default name:

Command: `mvn org.owasp:dependency-check-maven:4.0.2:aggregate -Dmaven.repo.local=local-repository`

Output:
```
spark-core_2.10-1.6.3.jar (org.apache.spark:spark-core_2.10:1.6.3, cpe:/a:apache:spark:1.6.3) : CVE-2017-7678, CVE-2018-11804, CVE-2018-1334, CVE-2017-12612, CVE-2018-8024, CVE-2018-11770, CVE-2018-17190
avro-mapred-1.7.7-hadoop2.jar (cpe:/a:apache:hadoop:1.7.7, org.apache.avro:avro-mapred:1.7.7) : CVE-2017-3162, CVE-2016-5001, CVE-2017-3161
hadoop-client-2.2.0.jar (org.apache.hadoop:hadoop-client:2.2.0, cpe:/a:apache:hadoop:2.2.0) : CVE-2017-15713, CVE-2016-6811, CVE-2014-3627, CVE-2017-3162, CVE-2016-5001, CVE-2017-3161, CVE-2014-0229
hadoop-common-2.2.0.jar (org.apache.hadoop:hadoop-common:2.2.0, cpe:/a:apache:hadoop:2.2.0) : CVE-2017-15713, CVE-2016-6811, CVE-2014-3627, CVE-2017-3162, CVE-2016-5001, CVE-2017-3161, CVE-2014-0229
commons-collections-3.2.1.jar (cpe:/a:apache:commons_collections:3.2.1, commons-collections:commons-collections:3.2.1) : CVE-2015-6420, CVE-2017-15708
commons-beanutils-1.7.0.jar (commons-beanutils:commons-beanutils:1.7.0, cpe:/a:apache:commons_beanutils:1.7.0) : CVE-2014-0114
commons-beanutils-core-1.8.0.jar (commons-beanutils:commons-beanutils-core:1.8.0, cpe:/a:apache:commons_beanutils:1.8.0) : CVE-2014-0114
hadoop-auth-2.2.0.jar (cpe:/a:apache:hadoop:2.2.0, org.apache.hadoop:hadoop-auth:2.2.0) : CVE-2017-15713, CVE-2016-6811, CVE-2014-3627, CVE-2017-3162, CVE-2016-5001, CVE-2017-3161, CVE-2014-0229
xz-1.0.jar (cpe:/a:tukaani:xz:1.0, org.tukaani:xz:1.0) : CVE-2015-4035
hadoop-hdfs-2.2.0.jar (cpe:/a:apache:hadoop:2.2.0, org.apache.hadoop:hadoop-hdfs:2.2.0) : CVE-2017-15713, CVE-2016-6811, CVE-2014-3627, CVE-2017-3162, CVE-2016-5001, CVE-2017-3161, CVE-2014-0229
hadoop-mapreduce-client-app-2.2.0.jar (cpe:/a:apache:hadoop:2.2.0, org.apache.hadoop:hadoop-mapreduce-client-app:2.2.0) : CVE-2017-15713, CVE-2016-6811, CVE-2014-3627, CVE-2017-3162, CVE-2016-5001, CVE-2017-3161, CVE-2014-0229
hadoop-mapreduce-client-common-2.2.0.jar (cpe:/a:apache:hadoop:2.2.0, org.apache.hadoop:hadoop-mapreduce-client-common:2.2.0) : CVE-2017-15713, CVE-2016-6811, CVE-2014-3627, CVE-2017-3162, CVE-2016-5001, CVE-2017-3161, CVE-2014-0229
hadoop-yarn-client-2.2.0.jar (org.apache.hadoop:hadoop-yarn-client:2.2.0, cpe:/a:apache:hadoop:2.2.0) : CVE-2017-15713, CVE-2016-6811, CVE-2014-3627, CVE-2017-3162, CVE-2016-5001, CVE-2017-3161, CVE-2014-0229
jaxb-api-2.2.2.jar (cpe:/a:oracle:glassfish:2.2.2, javax.xml.bind:jaxb-api:2.2.2) : CVE-2015-2808, CVE-2013-2566
hadoop-yarn-server-common-2.2.0.jar (org.apache.hadoop:hadoop-yarn-server-common:2.2.0, cpe:/a:apache:hadoop:2.2.0) : CVE-2017-15713, CVE-2016-6811, CVE-2014-3627, CVE-2017-3162, CVE-2016-5001, CVE-2017-3161, CVE-2014-0229
hadoop-mapreduce-client-shuffle-2.2.0.jar (cpe:/a:apache:hadoop:2.2.0, org.apache.hadoop:hadoop-mapreduce-client-shuffle:2.2.0) : CVE-2017-15713, CVE-2016-6811, CVE-2014-3627, CVE-2017-3162, CVE-2016-5001, CVE-2017-3161, CVE-2014-0229
hadoop-yarn-api-2.2.0.jar (cpe:/a:apache:hadoop:2.2.0, org.apache.hadoop:hadoop-yarn-api:2.2.0) : CVE-2017-15713, CVE-2016-6811, CVE-2014-3627, CVE-2017-3162, CVE-2016-5001, CVE-2017-3161, CVE-2014-0229
hadoop-mapreduce-client-core-2.2.0.jar (cpe:/a:apache:hadoop:2.2.0, org.apache.hadoop:hadoop-mapreduce-client-core:2.2.0) : CVE-2017-15713, CVE-2016-6811, CVE-2014-3627, CVE-2017-3162, CVE-2016-5001, CVE-2017-3161, CVE-2014-0229
hadoop-yarn-common-2.2.0.jar (org.apache.hadoop:hadoop-yarn-common:2.2.0, cpe:/a:apache:hadoop:2.2.0) : CVE-2017-15713, CVE-2016-6811, CVE-2014-3627, CVE-2017-3162, CVE-2016-5001, CVE-2017-3161, CVE-2014-0229
hadoop-mapreduce-client-jobclient-2.2.0.jar (cpe:/a:apache:hadoop:2.2.0, org.apache.hadoop:hadoop-mapreduce-client-jobclient:2.2.0) : CVE-2017-15713, CVE-2016-6811, CVE-2014-3627, CVE-2017-3162, CVE-2016-5001, CVE-2017-3161, CVE-2014-0229
hadoop-annotations-2.2.0.jar (cpe:/a:apache:hadoop:2.2.0, org.apache.hadoop:hadoop-annotations:2.2.0) : CVE-2017-15713, CVE-2016-6811, CVE-2014-3627, CVE-2017-3162, CVE-2016-5001, CVE-2017-3161, CVE-2014-0229
spark-launcher_2.10-1.6.3.jar (org.apache.spark:spark-launcher_2.10:1.6.3, cpe:/a:apache:spark:1.6.3) : CVE-2017-7678, CVE-2018-11804, CVE-2018-1334, CVE-2017-12612, CVE-2018-8024, CVE-2018-11770, CVE-2018-17190
spark-network-common_2.10-1.6.3.jar (org.apache.spark:spark-network-common_2.10:1.6.3, cpe:/a:apache:spark:1.6.3) : CVE-2017-7678, CVE-2018-11804, CVE-2018-1334, CVE-2017-12612, CVE-2018-8024, CVE-2018-11770, CVE-2018-17190
spark-network-shuffle_2.10-1.6.3.jar (cpe:/a:apache:spark:1.6.3, org.apache.spark:spark-network-shuffle_2.10:1.6.3) : CVE-2017-7678, CVE-2018-11804, CVE-2018-1334, CVE-2017-12612, CVE-2018-8024, CVE-2018-11770, CVE-2018-17190
spark-unsafe_2.10-1.6.3.jar (org.apache.spark:spark-unsafe_2.10:1.6.3, cpe:/a:apache:spark:1.6.3) : CVE-2017-7678, CVE-2018-11804, CVE-2018-1334, CVE-2017-12612, CVE-2018-8024, CVE-2018-11770, CVE-2018-17190
curator-framework-2.4.0.jar (org.apache.curator:curator-framework:2.4.0, cpe:/a:apache:zookeeper:2.4.0) : CVE-2018-8012, CVE-2016-5017
zookeeper-3.4.5.jar (cpe:/a:apache:zookeeper:3.4.5, org.apache.zookeeper:zookeeper:3.4.5) : CVE-2018-8012, CVE-2016-5017, CVE-2017-5637
guava-14.0.1.jar (cpe:/a:google:guava:14.0.1, com.google.guava:guava:14.0.1) : CVE-2018-10237
slf4j-api-1.7.10.jar (cpe:/a:slf4j:slf4j:1.7.10, org.slf4j:slf4j-api:1.7.10) : CVE-2018-8088
jul-to-slf4j-1.7.10.jar (cpe:/a:slf4j:slf4j:1.7.10, org.slf4j:jul-to-slf4j:1.7.10) : CVE-2018-8088
jcl-over-slf4j-1.7.10.jar (cpe:/a:slf4j:slf4j:1.7.10, org.slf4j:jcl-over-slf4j:1.7.10) : CVE-2018-8088
slf4j-log4j12-1.7.10.jar (cpe:/a:slf4j:slf4j:1.7.10, org.slf4j:slf4j-log4j12:1.7.10) : CVE-2018-8088
akka-remote_2.10-2.3.11.jar (cpe:/a:akka:akka:2.3.11, com.typesafe.akka:akka-remote_2.10:2.3.11) : CVE-2017-1000034
akka-actor_2.10-2.3.11.jar (com.typesafe.akka:akka-actor_2.10:2.3.11, cpe:/a:akka:akka:2.3.11) : CVE-2017-1000034
netty-3.8.0.Final.jar (io.netty:netty:3.8.0.Final, cpe:/a:netty_project:netty:3.8.0) : CVE-2014-0193, CVE-2015-2156, CVE-2014-3488
protobuf-java-2.5.0.jar (cpe:/a:google:protobuf:2.5.0, com.google.protobuf:protobuf-java:2.5.0) : CVE-2015-5237
akka-slf4j_2.10-2.3.11.jar (cpe:/a:akka:akka:2.3.11, com.typesafe.akka:akka-slf4j_2.10:2.3.11) : CVE-2017-1000034
mesos-0.21.1-shaded-protobuf.jar (cpe:/a:apache:mesos:0.21.1, org.apache.mesos:mesos:0.21.1) : CVE-2017-7687, CVE-2018-8023, CVE-2017-9790
netty-all-4.0.29.Final.jar (cpe:/a:netty_project:netty:4.0.29, cpe:/a:all-for-one:all_for_one:4.0.29, io.netty:netty-all:4.0.29.Final) : CVE-2018-12056, CVE-2016-4970
jackson-databind-2.4.4.jar (cpe:/a:fasterxml:jackson-databind:2.4.4, com.fasterxml.jackson.core:jackson-databind:2.4.4, cpe:/a:fasterxml:jackson:2.4.4) : CVE-2017-15095, CVE-2017-17485, CVE-2017-7525, CVE-2018-7489, CVE-2018-5968
pyrolite-4.9.jar (cpe:/a:pickle:pickle:4.9, net.razorvine:pyrolite:4.9) : CVE-2007-1100
unused-1.0.0.jar (cpe:/a:apache:spark:1.0.0, org.spark-project.spark:unused:1.0.0) : CVE-2017-7678, CVE-2018-1334, CVE-2018-8024, CVE-2018-17190
spark-core_2.10-1.6.3.jar/META-INF/maven/org.eclipse.jetty/jetty-plus/pom.xml (org.eclipse.jetty:jetty-plus:8.1.19.v20160209, cpe:/a:eclipse:jetty:8.1.19.v20160209, cpe:/a:jetty:jetty:8.1.19.v20160209) : CVE-2017-7656, CVE-2017-7658, CVE-2017-7657, CVE-2017-9735
spark-core_2.10-1.6.3.jar/META-INF/maven/org.eclipse.jetty/jetty-security/pom.xml (org.eclipse.jetty:jetty-security:8.1.19.v20160209, cpe:/a:eclipse:jetty:8.1.19.v20160209, cpe:/a:jetty:jetty:8.1.19.v20160209) : CVE-2017-7656, CVE-2017-7658, CVE-2017-7657, CVE-2017-9735
spark-core_2.10-1.6.3.jar/META-INF/maven/org.eclipse.jetty/jetty-util/pom.xml (org.eclipse.jetty:jetty-util:8.1.19.v20160209, cpe:/a:eclipse:jetty:8.1.19.v20160209, cpe:/a:jetty:jetty:8.1.19.v20160209) : CVE-2017-7656, CVE-2017-7658, CVE-2017-7657, CVE-2017-9735
spark-core_2.10-1.6.3.jar/META-INF/maven/org.eclipse.jetty/jetty-server/pom.xml (cpe:/a:eclipse:jetty:8.1.19.v20160209, cpe:/a:jetty:jetty:8.1.19.v20160209, org.eclipse.jetty:jetty-server:8.1.19.v20160209) : CVE-2017-7656, CVE-2017-7658, CVE-2017-7657, CVE-2017-9735
spark-core_2.10-1.6.3.jar/META-INF/maven/org.eclipse.jetty/jetty-http/pom.xml (org.eclipse.jetty:jetty-http:8.1.19.v20160209, cpe:/a:eclipse:jetty:8.1.19.v20160209, cpe:/a:jetty:jetty:8.1.19.v20160209) : CVE-2017-7656, CVE-2017-7658, CVE-2017-7657, CVE-2017-9735
spark-core_2.10-1.6.3.jar/META-INF/maven/org.eclipse.jetty/jetty-continuation/pom.xml (cpe:/a:eclipse:jetty:8.1.19.v20160209, cpe:/a:jetty:jetty:8.1.19.v20160209, org.eclipse.jetty:jetty-continuation:8.1.19.v20160209) : CVE-2017-7656, CVE-2017-7658, CVE-2017-7657, CVE-2017-9735
spark-core_2.10-1.6.3.jar/META-INF/maven/org.eclipse.jetty/jetty-servlet/pom.xml (cpe:/a:eclipse:jetty:8.1.19.v20160209, org.eclipse.jetty:jetty-servlet:8.1.19.v20160209, cpe:/a:jetty:jetty:8.1.19.v20160209) : CVE-2017-7656, CVE-2017-7658, CVE-2017-7657, CVE-2017-9735
```

It's worth noting that the lists of CVEs covered across all dependencies in both cases are the same, i.e. vulnerabilities are detected the same way. What's different is the list of dependencies they are reported against in both cases.