title: OWASP Dependency check, how to use suppressions
body: <p>I have a build in CI failing on a the OWASP dependency check.
  For example</p>
  <pre><code>[HIGH] CVE-2021-37136 - io.netty:netty-codec-4.1.66.Final
  </code></pre>
  <p>I understand I can add a suppression in <code>owaspDependencyCheckSuppressions.xml</code> to fix this.</p>
  <p>It's something I haven't done before, but there is a guide here -
  <a href="https://jeremylong.github.io/DependencyCheck/general/suppression.html" rel="nofollow noreferrer">https://jeremylong.github.io/DependencyCheck/general/suppression.html</a>
  which says ...</p>
  <blockquote>
  <p>&quot;Suppressing these false positives is fairly easy using the HTML
  report.  In the report next to each CPE identified (and on CVE
  entries) there is a suppress button.  Clicking the suppression button
  will create a dialogue box which you can simple hit Control-C to copy
  the XML that you would place into a suppression XML file&quot;</p>
  </blockquote>
  <p>I have 2 questions</p>
  <p>#1 Do you know where I can find this HTML report? I thought it might be linked in CI (I'm using Circle CI), but I can't spot it there :(</p>
  <p>#2 An example suppression is given in the guide</p>
  <pre><code>&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;
  &lt;suppressions xmlns=&quot;https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd&quot;&gt;
     &lt;suppress&gt;
        &lt;notes&gt;&lt;![CDATA[
        file name: some.jar
        ]]&gt;&lt;/notes&gt;
        &lt;sha1&gt;66734244CE86857018B023A8C56AE0635C56B6A1&lt;/sha1&gt;
        &lt;cpe&gt;cpe:/a:apache:struts:2.0.0&lt;/cpe&gt;
     &lt;/suppress&gt;
  &lt;/suppressions&gt;
  </code></pre>
  <p>The guide goes on to say</p>
  <blockquote>
  <p>&quot;The above XML file will suppress the cpe:/a:apache:struts:2.0.0 from
  any file with the a matching SHA1 hash.&quot;</p>
  </blockquote>
  <p>What is meant by &quot;any file&quot;? Does this mean any Java class which uses the dependency?</p>
  <p>Thanks :)</p>