Since Dependency Check is build in Java, it would be cool to also have a plain Java API besides the CLI interface and the several tool plugins. Would it be a big effort to provide a library that can be used to build other Java applications above Dependency Check? Something like... DependencyCheck dc...

Hi all, I am attempting to temporally suppress the following vulnerability reported in one of my NPM dependencies. @angular/core:6.1.10 | NPM1088994 | Medium |   -- | -- | -- | -- File Path : /Users/jenkins/workspace/_XX/XX/[email protected]/core SHA-1 : SHA-256: Description: A vulnerabil...

Hello, The Maven package spring-retry appears in the Dependency Check report with the version number not being substituted: Which causes the hyperlink to be broken: pkg:maven/org.springframework.retry/[email protected]%24%7Brevision%7D The original POM file can be found here: https://repo1.maven.org/m...

ODC7.4.1 tomcat-api-8.5.40.jar cpe:2.3🅰️apache:tomcat:8.5.40:::::::cpe:2.3🅰️apache_tomcat:apache_tomcat:8.5.40::::::: pkg:maven/org.apache.tomcat/[email protected] CRITICAL 23 Highest 25 maven https://mvnrepository.com/artifact/org.apache.tomcat/tomcat-api/8.5.40 The jar has no vulnerabilities...

Maven link : https://mvnrepository.com/artifact/org.springframework/spring-core/4.2.0.RELEASE CPE from ODC7.4.1 report : cpe:2.3🅰️pivotal_software:spring_framework:4.2.0:rc3:::::: cpe:2.3🅰️springsource:spring_framework:4.2.0:rc3:::::: cpe:2.3🅰️vmware:spring_framework:4.2.0:rc3:::::: Maven CVEs: CVE...

Package URl pkg:maven/com.vaadin/[email protected] CPE cpe:2.3🅰️vaadin:flow:2.0.0:alpha:::::: CVE CVE-2021-31407, CVE-2021-31404, CVE-2020-36321, CVE-2021-31412 ODC Integration {"label"=>"Maven Plugin"} ODC Version 8.0.2 Description No response

Describe the bug When using the Pip analyzer to process requirements.txt files, the DependencyCheck tool will perform searches for multiple packages/components if the Python package name is PascalCase (likely also including camelCase). This will result in incorrect CVE's being flagged for a package,...

Hi! We're experiencing some issues with dependency-check specifically when we analyze Maven projects, the thing is that we receive timeouts from Maven-central when the dependency-check analysis starts. [WARN] An error occurred while analyzing '/tmp/dctempb8d2c904-06d3-4ce5-bf76-8ef17532c3b8/check170...

Package URl pkg:maven/org.locationtech.spatial4j/[email protected] CPE cpe:2.3🅰️voyager_project:voyager:0.7:::::::* CVE CVE-2014-125074 ODC Integration {"label"=>"Gradle Plugin"} ODC Version 8.0.2 Description spatial4j: https://github.com/locationtech/spatial4j is being confused with voyager: https:/...

Is your feature request related to a problem? Please describe. Since ArchiveAnalyzer now reports unreadable zips correctly thanks to #5371, i get the following exception: AnalysisException: java.util.zip.ZipException: encrypted ZIP entry not supported Describe the solution you'd like I think that th...