From cee27bf35d492efdcfc9e22bb34ebeeb585d72ad Mon Sep 17 00:00:00 2001
From: Sean Li <xili9@microsoft.com>
Date: Mon, 17 Aug 2026 11:55:52 -0700
Subject: [PATCH] Fix OWASP CPE suppression matching

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 buildscripts/dependency-check-suppressions.xml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/buildscripts/dependency-check-suppressions.xml b/buildscripts/dependency-check-suppressions.xml
index b50351ad23..982fc4ee27 100644
--- a/buildscripts/dependency-check-suppressions.xml
+++ b/buildscripts/dependency-check-suppressions.xml
@@ -45,13 +45,16 @@
   <suppress>
     <notes><![CDATA[
       azure-monitor-opentelemetry-autoconfigure is an Azure Java library, but dependency-check infers
-      cpe:2.3:a:opentelemetry:opentelemetry from its name. That CPE then matches OpenTelemetry
+      cpe:2.3:a:opentelemetry:opentelemetry from its name. The report displays CPE 2.3, but
+      suppression matching converts detected CPEs to CPE 2.2, so this rule uses the CPE 2.2 form.
+      The trailing colon enforces a whole product-name boundary and does not match
+      opentelemetry_collector. That CPE then matches OpenTelemetry
       Go / .NET / C++ CVEs whose fixed versions happen to be higher than this artifact's version,
       e.g. CVE-2026-39882 and CVE-2026-41178 (Go), CVE-2026-40894 and CVE-2026-41078 (.NET),
       CVE-2026-44967 (C++). None of them apply to Java.
     ]]></notes>
     <packageUrl regex="true">^pkg:maven/com\.azure/azure-monitor-opentelemetry-autoconfigure@.*$</packageUrl>
-    <cpe>cpe:2.3:a:opentelemetry:opentelemetry</cpe>
+    <cpe>cpe:/a:opentelemetry:opentelemetry:</cpe>
   </suppress>
   <suppress>
     <notes>