[FP]: jruby-jzlib confused for JRuby itself

[chadlwilson]

Package URl

pkg:maven/org.jruby/jzlib@1.1.5

CPE

cpe:/a:jruby:jruby

CVE

No response

ODC Integration

{"label"=>"Gradle Plugin"}

ODC Version

8.2.1

Description

jruby-jzlib is an independent artifact from jruby itself, versioned independently, and a fork of JCraft's jzlib: https://github.com/jruby/jzlib

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.jruby</groupId>
   <artifactId>jzlib</artifactId>
   <version>1.1.5</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #5762
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.jruby/jzlib@.*$</packageUrl>
   <cpe>cpe:/a:jruby:jruby</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/5206560001

[aikebah]

approved

@chadlwilson hope to take a look later to review whether we should put a broader suppression in place in a next release for the tool-embedded suppressions, but this will get it out of the way for this lib

[github-actions]

Suppress rule has been added to the generatedSuppressions branch.