-
-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[FP]: thymeleaf-extras-java8time 3.0.4 is not thymeleaf <= 3.1.1 #6031
Comments
Failed to automatically evaluate the false positive. See: https://github.com/jeremylong/DependencyCheck/actions/runs/6711001769 |
It does indeed look like the extras are versioned independently of the main thymeleaf release. |
Maven Coordinates <dependency>
<groupId>org.thymeleaf.extras</groupId>
<artifactId>thymeleaf-extras-java8time</artifactId>
<version>3.0.4.RELEASE</version>
</dependency> Suppression rule: <suppress base="true">
<notes><![CDATA[
FP per issue #6031
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.thymeleaf\.extras/thymeleaf-extras-java8time@.*$</packageUrl>
<cpe>cpe:/a:thymeleaf:thymeleaf</cpe>
</suppress> Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/7290340958 |
approved |
Suppress rule has been added to the |
Package URl
pkg:maven/org.thymeleaf.extras/thymeleaf-extras-java8time@3.0.4.RELEASE
CPE
cpe:2.3:a:thymeleaf:thymeleaf:3.0.4:release:*:*:*:*:*:*
CVE
CVE-2023-38286
ODC Integration
{"label"=>"Maven Plugin"}
ODC Version
8.4.0
Description
No response
The text was updated successfully, but these errors were encountered: