Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

How to read the report | Suppressing false positives | Getting Help: github issues

 Sponsor

Project: com.github.pmonks/clj-spdx 1.0.258-SNAPSHOT

Clojure core environment and runtime library.

Eclipse Public License 1.0: http://opensource.org/licenses/eclipse-1.0.php

  Apache Commons Lang, a package of Java utility classes for the
  classes that are in java.lang's hierarchy, or are considered to be so
  standard as to justify existence in java.lang.
  

https://www.apache.org/licenses/LICENSE-2.0.txt

Specs for clojure.core

Eclipse Public License 1.0: https://opensource.org/license/epl-1-0/

Gson JSON library

Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

Instaparse: No grammar left behind

Eclipse Public License: http://www.eclipse.org/legal/epl-v10.html

Java library which implements the Java object model for SPDX and provides useful helper functions.

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

jsoup is a Java library for working with real-world HTML. It provides a very convenient API for fetching URLs and extracting and manipulating data, using the best of HTML5 DOM methods and CSS selectors. jsoup implements the WHATWG HTML5 specification, and parses HTML to the same DOM as modern browsers do.

The MIT License: https://jsoup.org/license

JSR305 Annotations for Findbugs

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

A micro-library for Clojure that provides first class support for named-capturing groups in regular expressions.

Apache-2.0: http://www.apache.org/licenses/LICENSE-2.0.html

The slf4j API

https://opensource.org/license/mit

Core libraries for SPDX

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

SPDX model versions 2.0, 2.1, and 2.3

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

The XClientMessageEvent struct used in certain components of X.Org 6.8.2 and earlier, possibly including (1) the X server and (2) Xlib, uses a "long" specifier for elements of the l array, which results in inconsistent sizes in the struct on 32-bit versus 64-bit platforms, and might allow attackers to cause a denial of service (application crash) and possibly conduct other attacks.

Generated java model source code

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

Specification of data and functions

Eclipse Public License 1.0: https://opensource.org/license/epl-1-0/

A micro-library for Clojure(Script) that provides regular expression construction functions.

MPL-2.0: https://www.mozilla.org/en-US/MPL/2.0/