[FP]: angus-activation confused for angus-mail

[chadlwilson]

Package URl

pkg:maven/org.eclipse.angus/angus-activation@2.0.3

CPE

cpe:2.3:a:eclipse:angus_mail:2.0.3:*:*:*:*:*:*:*

CVE

CVE-2025-7962

ODC Integration

{"label" => "Gradle Plugin"}

ODC Version

12.1.9

Description

angus-activation (Jakarta Activation reference impl) is a separate project to angus-mail (Jakarta Mail reference impl) with independent versioning.

https://github.com/eclipse-ee4j/angus-activation vs https://github.com/eclipse-ee4j/angus-mail

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.eclipse.angus</groupId>
   <artifactId>angus-activation</artifactId>
   <version>2.0.3</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #8130
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.eclipse\.angus/angus-activation@.*$</packageUrl>
   <cpe>cpe:/a:eclipse:angus_mail</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/19358685269

[chadlwilson]

approved

[github-actions]

Suppress rule has been added to the generatedSuppressions branch.

[sadeesh89]

Thank you for confirming the false positive report. Could you please provide an estimated timeline for when this will be addressed in the OWASP tool?

[chadlwilson]

Its already released.

The hosted suppressions file is updated immediately and available to everyone after such a ticket is approved and merged. https://dependency-check.github.io/DependencyCheck/data/index.html

If you're still seeing it, you either have a stale suppressions file, or are probably still scanning arbitrary files in a way they cannot be matched reliably to maven artifacts, as noted in #8151 (comment)

If it is the latter,.you need to review and change your scanning approach. Open a discussion, sharing your scans ING methodology and arguments if you want help understanding why you are still getting FPs and how to stop them.

[github-actions]

Suppress already exists in generatedSuppressions branch. See issue #8130.