It sounds like you are reporting that you upgraded defect dojo mid april and now you are seeing different behaviour. Is that correct?
No. The new behavior started without any upgrades. I tried to fix it by upgrading. But this didn't help. But I think I found out now what changed: I had so many related findings recently because the findings were reported for org.springframework.boot:spring-boot and org.springframework:spring-core . Both have around 10 <relatedDependency> entries reported from Dependency-Check. This was different for other/older findings which were caused by different jars (not spring-boot or spring-core) and had way less <relatedDependency> entries. That's why the noise increased and I thought the behavior of the import changed. But actually only the vulnerable jars had changed -> and this triggered the noise. I've attached an example file stripped down to only one dependency (spring-boot in this case). This dependency has 11 <relatedDependency> entries and 8 <vulnerability> entries. It creates 96 findings for those 8 vulnerabilities when imported. IMO it would sufficient to create 8 findings (simply on the actual <dependency>) but skip all <relatedDependency>.
OWASP Dependency-Check groups multiple jars that share the same content (identical hash) under a <relatedDependencies> block on a single dependency
That seems to be a misconception. <relatedDependencies> seem not to contain "multiple jars that share the same content (identical hash)" but actually contain completely different jars which are somehow related to the main vulnerable one. Is it an option to change the parser to skip all <relatedDependency> entries?
Hello, I'm using DD with scan_type=Dependency Check Scan to reimport scan results from org.owasp:dependency-check-maven plugin. It worked as expected for almost a year now. But since around mid of April it produces a lot of duplicate findings for each found vulnerability. It looks to me as if one entry is created for each of the related dependencies in addition to the actual vulnerable dependency. This produces a lot of noise in DD. I already tried to update DD and the Dependency Check maven plugin to the latest versions but this didn't change anything. I didn't change my deduplication configs so I don't understand why it started to behave differently. What could be the reason for this change in behavior in April? Did anyone of you experience something similar and how did you fix it? Thank you
