suppressions.xml

<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
    <suppress>
        <notes>Conflates postgresql client version with vertx's version</notes>
        <packageUrl regex="true">^pkg:maven/io\.vertx/vertx\-pg\-client@.*$</packageUrl>
        <cpe>cpe:/a:postgresql:postgresql</cpe>
        <cpe>cpe:/a:www-sql_project:www-sql</cpe>
    </suppress>
    <suppress>
        <notes>Conflates spring-cloud-kubernetes-fabric8-config (client) with spring-cloud-config-server</notes>
        <packageUrl regex="true">
            ^pkg:maven/org\.springframework\.cloud/spring\-cloud(\-starter)?\-kubernetes\-fabric8\-.*$
        </packageUrl>
        <cpe>cpe:/a:kubernetes:kubernetes</cpe>
        <cpe>cpe:/a:vmware:spring_cloud_config</cpe>
    </suppress>
    <suppress>
        <notes>Conflates grpc version with reactive-grpc version</notes>
        <packageUrl regex="true">^pkg:maven/com\.salesforce\.servicelibs/react(ive|or)\-grpc\-.*$</packageUrl>
        <cpe>cpe:/a:grpc:grpc</cpe>
    </suppress>
    <suppress>
        <notes>Issue is in spring-web and will only be fixed by Spring in their next major release.</notes>
        <packageUrl regex="true">^pkg:maven/org\.springframework/spring\-web@.*$</packageUrl>
        <cve>CVE-2016-1000027</cve>
    </suppress>
</suppressions>