dependency-check / dependency-check/DependencyCheck

Allow to suppress by file path from report

Open
#8,350 6 comments 0 reactions 0 assignees View on GitHub
core enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

The report only allows to generate suppressions snippets for `packageUrl`. However for shaded dependencies the `filePath` is more relevant.
For example with `pkg:maven/com.github.jknack/handlebars@4.3.1` I see the following report

1. Title: handlebars-4.3.1.jar (shaded: org.apache.commons:commons-lang3:3.12.0)
2. File Path: `/handlebars-4.3.1.jar/META-INF/maven/org.apache.commons/commons-lang3/pom.xml`
3. Package URL: `pkg:maven/org.apache.commons/commons-lang3@3.12.0`
4. `cpe:2.3:a:apache:commons_lang:3.12.0:*:*:*:*:*:*:*`
5. CVE: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-48924

However I can only generate suppressions by package url and cpe or CVE. Would be nice to expose a button to also suppress by `filePath` for shaded dependencies.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.