filePath does not work for findings in WAR files during release builds

Our project finally builds an EAR which contains multiple JAR and a WAR. We are using Java 8, maven 3.8 and dependency-check 6.5.3.
Besides lot of other dependencies the project contains org.exolab.castor:castor-xml:0.9.6b (don't blame me for the old version, the whole project is quite old ;)). I use castor as an example for the bug, there are some more finding like this.

We solved the CVE-2014-3004 for Castor via config.properties and added a suppression:

org.exolab.castor:castor-xml:0.9.6b
CVE-2014-3004

This is working fine since years.

Now, I don't know what changed (perhaps dependency-check update, perhaps first time we have a critical JAR in the project?) normal builds are still ok, but release builds fail with a finding in:

File Path: /home/jenkins/.m2/repository/de/abc/def/webapplication/1.3.0.25/webapplication-1.3.0.25.war/WEB-INF/lib/castor-xml-0.9.6b.jar
MD5: 15de72b04a2973fb5d12fd844042e6f1
SHA1: e35b79c311a030c77f0a2dca518226249e2632c4
SHA256:8b99aa1c927e3ed4487ff1028c8f146ff932ecbd9dc746a270a9a26a4df559f1
Referenced In Project/Scope:MyApplication :: Webapplication Container:compile

Evidence is empty.

Identifiers:
cpe:2.3:a:castor_project:castor:0.9.6b:*:*:*:*:*:*:* (Confidence:Low)

This webapplication-1.3.0.25.war is the WAR which is contained in the EAR and it is right, that the WAR contains the castor.jar.

I also understood, that the suppression above does not match, because dependency-check did not find the GAV, but just a file.

I don't understand, why dependency-check scans the files from maven m2-repo folder. If someone can tell me, how to avoid this, it would be a valid solution.

As I did not find any way to avoid this scan, I thought it would help to add a suppression via filePath. So I created the following:

.*
CVE-2014-3004

First there was more context in the regex, I reduced this during testing. But also with the above ".*" the castor finding in the WAR is reported and fails the build.

Is this a bug in dependency-check or should I fix something?

**Log file**
[2022-06-29T11:28:13.395Z] + mvn -Dstyle.color=always dependency-check:aggregate
[2022-06-29T11:28:13.396Z] ----- withMaven Wrapper script -----
[2022-06-29T11:28:13.396Z] Picked up JAVA_TOOL_OPTIONS: -Dmaven.ext.class.path="/build/workspace/ntingApplication_master-depcheck@tmp/withMavendb455bbd/pipeline-maven-spy.jar" -Dorg.jenkinsci.plugins.pipeline.maven.reportsFolder="/build/workspace/ntingApplication_master-depcheck@tmp/withMavendb455bbd"
[2022-06-29T11:28:13.396Z] Apache Maven 3.8.5 (3599d3414f046de2324203b78ddcf9b5e4388aa0
[2022-06-29T11:28:13.396Z] Maven home: /usr/share/java/maven-3
[2022-06-29T11:28:13.396Z] Java version: 1.8.0_322, vendor: IcedTea, runtime: /usr/lib/jvm/java-1.8-openjdk/jre
[2022-06-29T11:28:13.396Z] Default locale: en_US, platform encoding: UTF-8
[2022-06-29T11:28:13.396Z] OS name: "linux", version: "4.18.0-394.el8.x86_64", arch: "amd64", family: "unix"
[2022-06-29T11:28:14.948Z] [13:28:14] dependency-check-maven:6.5.3:aggregate
[2022-06-29T11:28:19.544Z] [13:28:18] Checking for updates
[2022-06-29T11:28:19.544Z] [13:28:18] Skipping NVD check since last check was within 168 hours.
[2022-06-29T11:28:19.544Z] [13:28:19] Check for updates complete (287 ms)
[2022-06-29T11:28:19.544Z]
[2022-06-29T11:28:22.076Z] [13:28:21] Finished Archive Analyzer (2 seconds)
[2022-06-29T11:28:22.077Z] [13:28:21] Finished File Name Analyzer (0 seconds)
[2022-06-29T11:28:19.544Z] [13:28:19] Analysis Started
[2022-06-29T11:28:22.643Z] [13:28:22] Finished Jar Analyzer (0 seconds)
[2022-06-29T11:28:22.643Z] [13:28:22] Finished Dependency Merging Analyzer (0 seconds)
[2022-06-29T11:28:22.643Z] [13:28:22] Finished Version Filter Analyzer (0 seconds)
[2022-06-29T11:28:22.643Z] [13:28:22] Finished Hint Analyzer (0 seconds)
[2022-06-29T11:28:23.578Z] [13:28:23] Created CPE Index (1 seconds)
[2022-06-29T11:28:25.483Z] [13:28:25] Finished CPE Analyzer (2 seconds)
[2022-06-29T11:28:25.483Z] [13:28:25] Finished False Positive Analyzer (0 seconds)
[2022-06-29T11:28:25.483Z] [13:28:25] Finished NVD CVE Analyzer (0 seconds)
[2022-06-29T11:28:25.743Z] [13:28:25] Finished RetireJS Analyzer (0 seconds)
[2022-06-29T11:28:32.311Z] [13:28:31] Finished Sonatype OSS Index Analyzer (5 seconds)
[2022-06-29T11:28:32.311Z] [13:28:31] Finished Vulnerability Suppression Analyzer (0 seconds)
[2022-06-29T11:28:32.311Z] [13:28:31] Finished Dependency Bundling Analyzer (0 seconds)
[2022-06-29T11:28:32.311Z] [13:28:31] Analysis Complete (12 seconds)
[2022-06-29T11:28:32.311Z] [13:28:31] Writing report to: /build/workspace/ntingApplication_master-depcheck/target/dependency-check-report.xml
[2022-06-29T11:28:32.311Z] [13:28:31] Writing report to: /build/workspace/ntingApplication_master-depcheck/target/dependency-check-report.html
[2022-06-29T11:28:32.311Z] [13:28:31] Writing report to: /build/workspace/ntingApplication_master-depcheck/target/dependency-check-report.json
[2022-06-29T11:28:32.311Z] [13:28:31] Writing report to: /build/workspace/ntingApplication_master-depcheck/target/dependency-check-report.csv
[2022-06-29T11:28:32.311Z] [13:28:31] Writing report to: /build/workspace/ntingApplication_master-depcheck/target/dependency-check-report.sarif
[2022-06-29T11:28:32.311Z] [13:28:31] Writing report to: /build/workspace/ntingApplication_master-depcheck/target/dependency-check-junit.xml
[2022-06-29T11:28:32.311Z]
[2022-06-29T11:28:32.312Z] One or more dependencies were identified with known vulnerabilities in PrintingApplication:
[2022-06-29T11:28:32.312Z]
[2022-06-29T11:28:32.312Z] webapplication-1.3.0.25.war: bcprov-jdk15on-1.64.jar (cpe:2.3:a:bouncycastle:bouncy-castle-crypto-package:1.64:*:*:*:*:*:*:*, cpe:2.3:a:bouncycastle:bouncy_castle_crypto_package:1.64:*:*:*:*:*:*:*, cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle:1.64:*:*:*:*:*:*:*, cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.64:*:*:*:*:*:*:*, cpe:2.3:a:bouncycastle:the_bouncy_castle_crypto_package_for_java:1.64:*:*:*:*:*:*:*) : CVE-2020-15522
[2022-06-29T11:28:32.312Z] webapplication-1.3.0.25.war: castor-xml-0.9.6b.jar (cpe:2.3:a:castor_project:castor:0.9.6b:*:*:*:*:*:*:*) : CVE-2014-3004
[2022-06-29T11:28:32.312Z] webapplication-1.3.0.25.war: reactor-netty-core-1.0.19.jar (cpe:2.3:a:netty:netty:1.0.19:*:*:*:*:*:*:*) : CVE-2014-3488, CVE-2015-2156, CVE-2019-16869, CVE-2019-20444, CVE-2019-20445, CVE-2021-21290, CVE-2021-21295, CVE-2021-21409, CVE-2021-37136, CVE-2021-37137, CVE-2021-43797, CVE-2022-24823
[2022-06-29T11:28:32.312Z] webapplication-1.3.0.25.war: spring-core-5.3.20.jar (cpe:2.3:a:pivotal_software:spring_framework:5.3.20:*:*:*:*:*:*:*, cpe:2.3:a:springsource:spring_framework:5.3.20:*:*:*:*:*:*:*, cpe:2.3:a:vmware:spring_framework:5.3.20:*:*:*:*:*:*:*) : CVE-2016-1000027