Suppressions can be specified either as suppression files, as hosted suppressions, or as a SBT Setting Key. A suppression file can be either an actual file or a URL. Hosted Suppression are specified with a URL. The different between the two is that suppression files are meant to be project specific, whereas Hosted Suppression are meant to, or can be, more general. Hosted Suppressions are considered "base" suppressions, whereas suppression files are not.

Suppressions defined with the suppressions field on the dependencyCheckSuppressions key are created using the net.nmoncho.sbt.dependencycheck.settings.SuppressionRule class, providing an alternative to defining suppressions with XML files.

Whether this suppression is taken into account or not is governed by the Analyzer Setting vulnerabilitySuppressionEnabled. Another useful setting is failOnUnusedSuppressionRule which will fail the build if there is any non-base suppression not applied.

• Suppression Files
• Hosted Suppressions
• Suppression Rules in your SBT code
• Packaged Suppressions
  • Using Packaged Suppressions
  • Exporting Packaged Suppressions

It's possible to define suppression rules using Scala code in your SBT project definition if you want to avoid using any other syntax, like XML.

Here are some examples, and how would it look with its XML counter part

import net.nmoncho.sbt.dependencycheck.settings.SuppressionRule
import net.nmoncho.sbt.dependencycheck.settings.SuppressionRule.PropertyType._
import net.nmoncho.sbt.dependencycheck.settings.SuppressionSettings

dependencyCheckSuppressions := SuppressionSettings(
  suppressions = Seq(
    //
    // <suppress>
    //    <notes>
    //    <![CDATA[
    //    Suppress false positive on SBT `test-interface`. This CVE refers to SBT itself which is now 1.9.7+
    //    `test-interface` only has 1.0 published
    //    ]]>
    //    </notes>
    //    <gav regex="true">org.scala-sbt:test-interface:.*</gav>
    //    <vulnerabilityName>CVE-2023-46122</vulnerabilityName>
    // </suppress>
    //
    SuppressionRule.ofGavRegex(
      value = "org.scala-sbt:test-interface:.*".r,
      vulnerabilityNames = Seq("CVE-2023-46122".toPropertyType()),
      notes = """Suppress false positive on SBT `test-interface`. This CVE refers to SBT itself which is now 1.9.7+
                |`test-interface` only has 1.0 published""".stripMargin
    ),
    //
    // <suppress>
    //    <notes>
    //      <![CDATA[
    //        Suppresses false positive on Pekko connectors kafka.
    //        Sbt Dependency Check is mixing pekko connector kafka with kafka connect.
    //        ]]>
    //    </notes>
    //    <filePath regex="true">.*pekko-connectors-kafka.*</filePath>
    //    <vulnerabilityName>CVE-2018-1288</vulnerabilityName>
    //    <vulnerabilityName>CVE-2018-17196</vulnerabilityName>
    // </suppress>
    //
    SuppressionRule.ofFilePathRegex(
      value = ".*pekko-connectors-kafka.*".r,
      vulnerabilityNames = Seq("CVE-2018-1288".toPropertyType(), "CVE-2018-17196".toPropertyType()),
      notes = """Suppresses false positive on Pekko connectors kafka.
                |Sbt Dependency Check is mixing pekko connector kafka with kafka connect.""".stripMargin
    ),

    // <suppress>
    //    <vulnerabilityName>CVE-2015-0225</vulnerabilityName>
    // </suppress>
    SuppressionRule(vulnerabilityNames = Seq("CVE-2015-0225".toPropertyType()))
  )
)

Both CPEs and vulnerabilityNames need to be DependencyCheck's PropertyType. That's why we use the extension method .toPropertyType() in the example above. If that's too cumbersome, you can use implicit conversions that will do the trick for both Strings and Regexes.

import net.nmoncho.sbt.dependencycheck.settings.SuppressionRule
import net.nmoncho.sbt.dependencycheck.settings.SuppressionRule.PropertyType.PropertyTypeImplicitConversions._
import net.nmoncho.sbt.dependencycheck.settings.SuppressionSettings

dependencyCheckSuppressions := SuppressionSettings(
  suppressions = Seq(
    //
    // <suppress>
    //    <vulnerabilityName>CVE-2015-0225</vulnerabilityName>
    // </suppress>
    //
    SuppressionRule(vulnerabilityNames = Seq("CVE-2015-0225"))
  )
)

In order to avoid duplicating suppression rules between related projects, we can export suppressions rules defined in a project, and then reuse those suppressions on downstream projects. For example, say you have a "commons" project that includes a library with a CVE. And then another project including that "commons" project. If we run CI on both projects with a dependency check, we'd have to define the same suppression rule in both projects, as "commons" would have this dependency in its classpath, and the other project would also have it as a transitive dependency. If we could define the suppression only in "commons", and then reuse it on downstream projects, we would save us a lot of copy/paste and headaches.

We can use and export package suppressions by enabling with the packagedEnabled field in the dependencyCheckSuppressions key. By default, packaged suppressions rules are disabled.

To use exported packaged suppressions rules by other projects we need to whitelist what dependencies we'll accept suppressions rules from. By default, all dependencies are blacklisted.

For example, imagine we only want to accept packaged suppressions from libraries published by Typesafe or Lightbend, we would configure our builds like:

dependencyCheckSuppressions := SuppressionSettings(
  packagedEnabled = true,
  packagedFilter = PackageFilter.ofGav {
    case ("com.typesafe" | "com.lightbend", _, _) => true
    case _ => false
  }
)

There are other ways to define PackageFilters that can filter each dependency available in the classpath.

We can export the suppression rules we define in a project by just enabling the packaged suppression rules. An XML suppression rules file will be created and treated as a managed resource (i.e. will be included in the packaged JAR).

Only the suppression rules defined in the files (non-URLs, just files) and the suppressions fields on the dependencyCheckSuppressions key will be included in the packaged suppressions rules. The rationale is that URLs defined in the files field, or the hosted suppressions can be easily shared already.

Every packaged suppression rule will be marked as "base", meaning it won't show in the dependency check report, nor on the unused suppressions rules list. This is to avoid duplicating information on multiple projects.