Fabrizio Di Giuseppe
Fabrizio Di Giuseppe
The project will be distribuited with both MIT license and Hippocratic License 3.0. Here is the customized HL3 that will be used: https://firstdonoharm.dev/build?modules=sv
Actually, the latest version is 1.3.
Some items (i.e. "component") allow any attributes from a namespace other than bom schema's namespace (lax validation). Custom attributes could be defined in the build.sbt, so tbat they are included...
The repository gives a wrong suggestion on how to add the dependency. The line > libraryDependencies += "io.github.siculo" % "sbt-bom" % "0.3.0" is wrong. It should be > libraryDependencies +=...
As part of our efforts to improve the security and quality posture of the open source supply chain, we plan to enable additional scanning of dependencies for security alerts soon....
ModuleReport have no component description, even if the POM of its artifact has one.
https://docs.dependencytrack.org/usage/cicd/
Evicted indirect dependencies are added to the BOM document, even if they are not actually used. Hence, any problem with those dependencies is reported by tools like Dependency Track, even...