[FP]: Custom package `openapi-generator-templates` != `openapi_generator` about dependencycheck

[github-actions]

Failed to automatically evaluate the false positive. See: https://github.com/jeremylong/DependencyCheck/actions/runs/9064806481

[github-actions]

Failed to automatically evaluate the false positive. See: https://github.com/jeremylong/DependencyCheck/actions/runs/9064866742

[OrangeDog]

As it's a private internal dependency, there's not much point publishing a suppression, as you're the only person who needs it.

[DennisHartrampf]

I agree to that point - we can generate the suppresion ourselves.
I'm just wondering why there is even a match on that cpe. Our package name is openapi-generator-templates, the cpe is cpe:2.3:a:openapi-generator:openapi_generator:3.2.2:*:*:*:*:*:*:*. To me it looks like the matching is done with a prefix-match like the cpe was cpe:2.3:a:openapi-generator:openapi_generator*:3.2.2:*:*:*:*:*:*:* (note the asterisk after the package name). Isn't that a bug in the dependency check?

[OrangeDog]

Isn't that a bug

No: #6658

[DennisHartrampf]

Alright, thanks for your fast response and for the reference. I'll close this issue then.