dependency-check / dependency-check/DependencyCheck
Support non-jar packagings in false-positive processing
Open
enhancement
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
The false-positive OPS currently only supports automated analysis of jar libraries. It would be good to have it extended to other packagings such as ear, aar, war for maven.
**Describe the solution you'd like**
Support in the automation for maven package-urls with the `type=` parameter to allow for these other packagings.
**Additional context**
Hope to spend some time on the implementation after finishing up on my current FP report resolution round in which I discovered after updating the purl in #4984 that the advanced purl is currently not supported.
Contributor guide
Assessment
This issue has not been assessed yet.