Update vulnerable dependencies about spotbugs-maven-plugin HOT 4 CLOSED

owasp produces a lot of false positives. while a couple of those like really old maven might be valid, there is not much we can do about it given any upgrade basically blocks maven 3.1.1+ usage. Others like groovy, lombok are wrong. If you look at the physical report it has a column for confidence. If it's low, it's almost always a false positive. I know that project is working on trying to clear some of those issues but suspect there will always be some issues.

from spotbugs-maven-plugin.

Then is it better to remove dependency-check-maven from site generation phase? It will shorten time to build.

from spotbugs-maven-plugin.

I would leave it.

from spotbugs-maven-plugin.

It's just a matter of knowing what is or is not vulnerable based on the results. The false positives are not really the tools fault but rather NVD isn't very good on what is reported a lot of times. So there will always be false positives but it's important to have that insite. What you can do is go into the project though and configure it to stop reporting the false postive ones we have reviewed. I've never bothered in doing that given that could always change.

from spotbugs-maven-plugin.