I have a project which contains, in its configuration POM, a BOM-reference in the dependencyManagement section. The normal build lifecycle stages run perfectly fine. When I am doing an OWASP-security analysis (mvn org.owasp:dependency-check-maven:check), the dependency jakarta.annotation-api-1.3.5.jar: fails with CVE-2022-31569.
When checking out the dependency-tree, this dependency is a transitive dependency of a transitive dependency (spring-boot-starter) of spring-boot-starter-web.
I have tried to exclude jakarta-annotation in the configuration-pom, yet this does not change the dependency-tree at all - the dependency persists as if I had done nothing. Below the configuration-pom:
<groupId>nl.loxia.beheer</groupId>
<artifactId>engineeringsruimte-service.configuratie</artifactId>
<version>0.0.4-SNAPSHOT</version>
<name>configuratie</name>
<packaging>pom</packaging>
<parent>
<groupId>nl.mycompany</groupId>
<artifactId>mycompany-spring-boot-parent</artifactId>
<version>2.20.1</version>
<relativePath/>
</parent>
<properties>
<maven.deploy.skip>false</maven.deploy.skip>
<java.version>11</java.version>
</properties>
<dependencyManagement>
<dependencies>
<!-- Own artifacts -->
<dependency>
<groupId>nl.mycompany.project</groupId>
<artifactId>myproject-service.domain</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>nl.mycompany.project</groupId>
<artifactId>myproject-service.external</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>nl.mycompany.project</groupId>
<artifactIdmyproject-service.control</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>nl.myproject.project</groupId>
<artifactId>myproject-service.web</artifactId>
<version>${project.version}</version>
</dependency>
<!-- Company -->
<dependency>
<groupId>nl.mycompany</groupId>
<artifactId>mycompany-spring-boot-bom</artifactId>
<version>2.20.1</version>
<type>pom</type>
<scope>import</scope>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter</artifactId>
<version>2.6.7</version>
<exclusions>
<exclusion>
<groupId>jakarta.annotation</groupId>
<artifactId>jakarta.annotation-api</artifactId>
</exclusion>
</exclusions>
</dependency>
<!--- other deps -->
</dependencyManagement>
<dependencies>
<!-- Testing -->
<!-- more deps -->
</dependencies>
<build>
<pluginManagement>
<plugins>
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
<configuration>
<suppressionFiles>
<suppressionFile>owasp-suppression.xml</suppressionFile>
</suppressionFiles>
<skipSystemScope>true</skipSystemScope>
</configuration>
</plugin>
</plugins>
</pluginManagement>
</build>
It fails during the owasp-check of the myproject-service.web-module, which uses spring-boot-starter-web, and through it, jakarta.annotation-api.
Does anyone know why this dependency is not excluded? Any help is appreciated!
