fix: Return unsorted vulnerabilities in new HashSet, avoiding CoMod

Gilbert Handy · Gilbert Handy · commit e16e8517faf4 · 2025-08-01T15:05:31.000Z
diff --git a/core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java b/core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java
@@ -625,7 +625,7 @@ public synchronized Set<Vulnerability> getVulnerabilities(boolean sorted) {
         if (sorted) {
             vulnerabilitySet = new TreeSet<>(vulnerabilities);
         } else {
-            vulnerabilitySet = vulnerabilities;
+            vulnerabilitySet = new HashSet<>(vulnerabilities);
         }
         return Collections.unmodifiableSet(vulnerabilitySet);
     }

Original file line number	Diff line number	Diff line change
`@@ -625,7 +625,7 @@ public synchronized Set<Vulnerability> getVulnerabilities(boolean sorted) {`
`625`	`625`	`if (sorted) {`
`626`	`626`	`vulnerabilitySet = new TreeSet<>(vulnerabilities);`
`627`	`627`	`} else {`
`628`		`- vulnerabilitySet = vulnerabilities;`
	`628`	`+ vulnerabilitySet = new HashSet<>(vulnerabilities);`
`629`	`629`	`}`
`630`	`630`	`return Collections.unmodifiableSet(vulnerabilitySet);`
`631`	`631`	`}`