dependency-check / dependency-check/DependencyCheck

Support non-jar packagings in false-positive processing

Open
#5,071 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

The false-positive OPS currently only supports automated analysis of jar libraries. It would be good to have it extended to other packagings such as ear, aar, war for maven.

**Describe the solution you'd like**
Support in the automation for maven package-urls with the `type=` parameter to allow for these other packagings.

**Additional context**
Hope to spend some time on the implementation after finishing up on my current FP report resolution round in which I discovered after updating the purl in #4984 that the advanced purl is currently not supported.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.