[FP]: GoCD plugin base package confused for GoCD itself

[chadlwilson]

Package URl

pkg:maven/cd.go.plugin.base/[email protected]

CPE

cpe:2.3:a:thoughtworks:gocd:0.0.8:*:*:*:*:*:*:*

CVE

No response

ODC Integration

{"label"=>"Gradle Plugin"}

ODC Version

11.1.1

Description

GoCD (the server standalone product) is completely different to the GOCD plugin-base helper utility versioned independently at https://mvnrepository.com/artifact/cd.go.plugin.base/gocd-plugin-base

[github-actions]

Maven Coordinates

<dependency>
   <groupId>cd.go.plugin.base</groupId>
   <artifactId>gocd-plugin-base</artifactId>
   <version>0.0.8</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #7229
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/cd\.go\.plugin\.base/gocd-plugin-base@.*$</packageUrl>
   <cpe>cpe:/a:thoughtworks:gocd</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/12183700607

[chadlwilson]

approved

[github-actions]

Suppress rule has been added to the generatedSuppressions branch.