Skip to content

false positives for jetcd libraries#7117

Merged
jeremylong merged 1 commit intodependency-check:generatedSuppressionsfrom
joannakotula:patch-1
Nov 6, 2024
Merged

false positives for jetcd libraries#7117
jeremylong merged 1 commit intodependency-check:generatedSuppressionsfrom
joannakotula:patch-1

Conversation

@joannakotula
Copy link
Copy Markdown

@joannakotula joannakotula commented Oct 30, 2024

Fixes Issue #7123

Description of Change

Have test cases been added to cover the new functionality?

no

@joannakotula
Copy link
Copy Markdown
Author

I see that some checks failed in codacy but I cannot see the details. Please advise.

Comment thread generatedSuppressions.xml Outdated
Comment thread generatedSuppressions.xml Outdated
Comment thread generatedSuppressions.xml Outdated
Comment thread generatedSuppressions.xml Outdated
@joannakotula joannakotula force-pushed the patch-1 branch 2 times, most recently from b7ffd13 to 1d4336f Compare November 4, 2024 12:20
Comment thread generatedSuppressions.xml Outdated
Comment thread generatedSuppressions.xml Outdated
@joannakotula
Copy link
Copy Markdown
Author

I've missed the jetcd-common library 🤦
I don't know the project very well, but maybe I can suppress all jetcd-x libraries by something like:

<suppress>
   <notes><![CDATA[
   FP per issue #7123
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/io\.etcd/jetcd-[a-z]*@.*$</packageUrl>
   <cpe>cpe:/a:etcd:etcd</cpe>
   <cpe>cpe:/a:redhat:etcd</cpe>
</suppress>

@joannakotula joannakotula marked this pull request as draft November 6, 2024 08:54
@chadlwilson
Copy link
Copy Markdown
Collaborator

Yeah, if you look at the rest of the suppressions file you'll note that there a number of suppressions like that.

* they were treated as etcd server
* jetcd-grpc was treated as io.grpc library
@joannakotula joannakotula marked this pull request as ready for review November 6, 2024 13:49
@joannakotula
Copy link
Copy Markdown
Author

Ok, so from my point of view, the PR is ready 😉
I'd still like to understand why the checks failed - the log message says only "An error occurred during this step."
When can I expect the merge?

Copy link
Copy Markdown
Collaborator

@jeremylong jeremylong left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@jeremylong jeremylong added this to the 11.1.1 milestone Nov 6, 2024
@jeremylong jeremylong merged commit 4346877 into dependency-check:generatedSuppressions Nov 6, 2024
@jeremylong
Copy link
Copy Markdown
Collaborator

Super busy - but I expect to release the next version within a few days.

@jeremylong
Copy link
Copy Markdown
Collaborator

regarding the failed check - I really dislike how frequently that check fails. It really hasn't been valuable and I'm considering removing the codacy check from the workflow soon.

@github-actions github-actions Bot locked as resolved and limited conversation to collaborators Dec 7, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants