Add vulnerable dependency with multiple paths in dependency graph

[Copilot]

Overview

This PR adds a package with known security vulnerabilities (commons-collections:3.2.1) that appears in multiple paths within the dependency graph. This enhancement demonstrates how dependency scanning tools like GitHub Dependabot and CodeQL detect vulnerabilities across complex dependency chains.

What Changed

Added the following Maven dependencies to pom.xml:

• commons-collections:3.2.1 - Direct dependency with known CVE-2015-7501 deserialization vulnerability
• commons-beanutils:1.9.2 - Transitively depends on commons-collections:3.2.1
• commons-digester:2.1 - Depends on commons-beanutils:1.8.3, creating another path to commons-collections
• commons-configuration:1.10 - Additional dependency for graph complexity

Multiple Dependency Paths

The vulnerable package now appears in three distinct paths:

vulnerable-app
├── commons-collections:3.2.1 (DIRECT - CVE-2015-7501)
├── commons-beanutils:1.9.2
│   └── commons-collections:3.2.1 (TRANSITIVE)
└── commons-digester:2.1
    └── commons-beanutils:1.8.3
        └── commons-collections:3.2.1 (TRANSITIVE)

Verification

Run the following command to see the multiple paths:

mvn dependency:tree -Dverbose | grep -E "commons-collections|commons-beanutils|commons-digester"

Expected output shows commons-collections:3.2.1 appearing multiple times with annotations like "omitted for duplicate", confirming it's pulled through different dependency chains.

Documentation

• Updated README.md with vulnerability information and verification instructions
• Added DEPENDENCY_ANALYSIS.md with comprehensive explanation of:
  • Dependency graph structure
  • CVE details (CVE-2015-7501)
  • Security implications
  • Educational context

Why This Matters

In real-world scenarios, vulnerable dependencies often appear through multiple transitive paths, making them:

• Harder to identify without proper tooling
• More complex to remediate (requires updating multiple parent dependencies)
• More likely to be overlooked by basic security scans

This repository now provides a realistic example for testing and demonstrating dependency scanning capabilities.

Testing

• ✅ All existing tests pass
• ✅ Build successful (mvn clean compile)
• ✅ No breaking changes to application functionality

---

⚠️ Note: This change is intentional for educational and CodeQL demonstration purposes only. This application should never be deployed in a production environment.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>I need a package listed in the dependency graph, that has a vulnerability, to show up in multiple paths</issue_title>
<issue_description>I need a package listed in the dependency graph, that has a vulnerability, to show up in multiple paths</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes #4

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.