dependency-check / dependency-check/DependencyCheck
Allow to suppress by file path from report
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
The report only allows to generate suppressions snippets for `packageUrl`. However for shaded dependencies the `filePath` is more relevant.
For example with `pkg:maven/com.github.jknack/handlebars@4.3.1` I see the following report
1. Title: handlebars-4.3.1.jar (shaded: org.apache.commons:commons-lang3:3.12.0)
2. File Path: `/handlebars-4.3.1.jar/META-INF/maven/org.apache.commons/commons-lang3/pom.xml`
3. Package URL: `pkg:maven/org.apache.commons/commons-lang3@3.12.0`
4. `cpe:2.3:a:apache:commons_lang:3.12.0:*:*:*:*:*:*:*`
5. CVE: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-48924
However I can only generate suppressions by package url and cpe or CVE. Would be nice to expose a button to also suppress by `filePath` for shaded dependencies.
Contributor guide
Assessment
This issue has not been assessed yet.