[FP]: AndroidX.lifecycle.lifecycle-viewmodel

[ps-konfidas]

Package URl

pkg:maven/androidx.lifecycle/lifecycle-viewmodel@2.9.0

CPE

cpe:2.3:a:apache:impala:2.9.0:*:*:*:*:*:*:*

CVE

No response

ODC Integration

{"label" => "Gradle Plugin"}

ODC Version

12.1.3

Description

Detects the use of apache impala in lifecycle ViewModel.
https://github.com/androidx/androidx/tree/androidx-main/lifecycle/lifecycle-viewmodel

[github-actions]

Failed to automatically evaluate the false positive. See: https://github.com/dependency-check/DependencyCheck/actions/runs/17637204304

[github-actions]

Failed to automatically evaluate the false positive. See: https://github.com/dependency-check/DependencyCheck/actions/runs/17650961434

[marcelstoer]

@jeremylong This looks sane to me.

The workflow job, however, does not find the matching JAR file (https://github.com/dependency-check/DependencyCheck/actions/runs/17650961434/job/50161605666#step:9:46) - that's because there is none.

https://maven.google.com/web/index.html#androidx.core:core-viewtree:1.0.0 confirms that there is a sources JAR and an AAR but no JAR.

[chadlwilson]

Ahh that's why. I thought there was a problem with the repo URL, but forgot about this aar problem which has come up before - #5071

[ps-konfidas]

@marcelstoer @chadlwilson

What is the preferred way to progress here?
Should I provide some additional information? (If yes, which?)

[chadlwilson]

We're discussing why the automation to validate your FP isnt working - we don't generally have capacity to manually check and manage suppressions and rely on this to help.

[chadlwilson]

Despite its misleading name, this is basically the same as the duplicate here