Tobias Kuhn

Please note the bot's suggested suppression rule does not work for me, I have to include both these CPEs for it to work: ``` cpe:/a:pivotal_software:spring_security cpe:/a:vmware:spring_security ```

Same issue on Ubuntu Budgie.

FYI I need to list these 3 CPEs in my suppression for it to work: ``` cpe:/a:pivotal:spring_security_oauth cpe:/a:pivotal_software:spring_security cpe:/a:vmware:spring_security ```

@aikebah I have tried to boil down the responsible code where I can still reproduce this behavior to this really simple project: https://github.com/xcq1/repro-dc-4617 Running `./gradlew dependencyCheckAnalyze` in the repo yields...

I just stumbled upon this behavior in the `kotlin` generator. This can be quite confusing since the Kotlin compiler initially reports ambiguous/invalid FQN usages where other JDK classes like `java.net.URI`...

@wing328 Thanks for the pointer! I thought I already had tried all kinds of mappings, but that is indeed much easier.

@frederic-saunier Unfortunately not. As far as I know upgrading to v4 did reduce the frequency, but the problem is definitely still there.

@oryan-block I tried to use 13.1.1-SNAPSHOT in the same project and I'm now getting this exception ``` Caused by: graphql.kickstart.tools.SchemaError: Found applied directive key without corresponding directive definition. at graphql.kickstart.tools.SchemaParser.buildAppliedDirectives(SchemaParser.kt:355)...

@oryan-block Well I don't really want to define them in every service, but I tried the suggestion to see the results. So the first part of the federation stuff looks...

@rstoyanchev Thanks for the pointers. I'm upgrading from graphql-java-kickstart with a lot of custom code that deals with handling federation, data loaders, etc. Definitely will take another look at the...