[FP]: Eclipse jetty toolchain libs should also be excluded from eclipse:jetty cpe

[lread]

Package URl

pkg:maven/org.eclipse.jetty.toolchain/jetty-jakarta-websocket-api@2.0.0

CPE

cpe:2.3:a:eclipse:jetty:2.0.0:*:*:*:*:*:*:*

CVE

No response

ODC Integration

None

ODC Version

10.0.2

Description

I listed a specific package URI and cpe because this is what I understand the issue form to require, but I think we should instead tweak an existing suppression.

In #6799, the eclipse jetty tool chain libs were excluded from cpe:/a:jetty:jetty, but I think they also need to be excluded from cpe:/a:eclipse:jetty.

And with that, hopefully, the game of whack-a-mole will be complete!

[github-actions]

Maven Coordinates

<dependency>
   <groupId>org.eclipse.jetty.toolchain</groupId>
   <artifactId>jetty-jakarta-websocket-api</artifactId>
   <version>2.0.0</version>
</dependency>

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #6812
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.toolchain/jetty-jakarta-websocket-api@.*$</packageUrl>
   <cpe>cpe:/a:eclipse:jetty</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/9820006099

[chadlwilson]

Thanks! I guess this can be closed now :-)

[lread]

Sweet!

Fixed by #6813