[FP]: Suppress false positives for the new module spring-boot-mongodb (Spring Boot 4.x)

[waileong]

Package URl

pkg:maven/org.springframework.boot/spring-boot-mongodb@4.0.1

CPE

cpe:2.3:a:mongodb:mongodb:4.0.1:::::::*

CVE

No response

ODC Integration

{"label" => "Gradle Plugin"}

ODC Version

12.1.9

Description

No response

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.springframework.boot</groupId>
   <artifactId>spring-boot-mongodb</artifactId>
   <version>4.0.1</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #8210
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.springframework\.boot/spring-boot-mongodb@.*$</packageUrl>
   <cpe>cpe:/a:mongodb:mongodb</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/20652142820

[chadlwilson]

How are you running ODC to get these FPs? (Which config of analyzers, data sources etc)

The automation can't reproduce this, so there might be something different with your setup we should dig into.

[waileong]

@chadlwilson
This is a minimal reproducible sample:
https://github.com/waileong/dependency-check-spring-boot-4-mongodb

Please have a look and let me know if you need any additional information or changes to help with the review.

[chadlwilson]

Thanks for that! This is a problem with our automation it seems - you are completely correct about these FPs turning up.

(I keep forgetting, the automation just does a scan of the individual jar file, and any project whose jars do not include POM files, such as any produced with gradle itself like Spring Boot will miss matches)

[chadlwilson]

approved

[github-actions]

Suppress rule has been added to the generatedSuppressions branch.