Tobias Kuhn

Please note the bot's suggested suppression rule does not work for me, I have to include both these CPEs for it to work: ``` cpe:/a:pivotal_software:spring_security cpe:/a:vmware:spring_security ```

Same issue on Ubuntu Budgie.

FYI I need to list these 3 CPEs in my suppression for it to work: ``` cpe:/a:pivotal:spring_security_oauth cpe:/a:pivotal_software:spring_security cpe:/a:vmware:spring_security ```

@aikebah I have tried to boil down the responsible code where I can still reproduce this behavior to this really simple project: https://github.com/xcq1/repro-dc-4617 Running `./gradlew dependencyCheckAnalyze` in the repo yields...

I just stumbled upon this behavior in the `kotlin` generator. This can be quite confusing since the Kotlin compiler initially reports ambiguous/invalid FQN usages where other JDK classes like `java.net.URI`...

@wing328 Thanks for the pointer! I thought I already had tried all kinds of mappings, but that is indeed much easier.