Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

How to read the report | Suppressing false positives | Getting Help: github issues

 Sponsor

Project: com.github.pmonks/clj-spdx 1.0.289-SNAPSHOT

Clojure core environment and runtime library.

Eclipse Public License 1.0: http://opensource.org/licenses/eclipse-1.0.php

  Apache Commons Lang, a package of Java utility classes for the
  classes that are in java.lang's hierarchy, or are considered to be so
  standard as to justify existence in java.lang.

  The code is tested using the latest revision of the JDK for supported
  LTS releases: 8, 11, 17 and 21 currently.
  See https://github.com/apache/commons-lang/blob/master/.github/workflows/maven.yml
  
  Please ensure your build environment is up-to-date and kindly report any build issues.
  

https://www.apache.org/licenses/LICENSE-2.0.txt

Specs for clojure.core

Eclipse Public License 1.0: https://opensource.org/license/epl-1-0/

Error Prone is a static analysis tool for Java that catches common programming mistakes at compile-time.

Apache 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

Gson JSON library

Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

Instaparse: No grammar left behind

Eclipse Public License: http://www.eclipse.org/legal/epl-v10.html

Java library which implements the Java object model for SPDX and provides useful helper functions.

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

jsoup is a Java library that simplifies working with real-world HTML and XML. It offers an easy-to-use API for URL fetching, data parsing, extraction, and manipulation using DOM API methods, CSS, and xpath selectors. jsoup implements the WHATWG HTML5 specification, and parses HTML to the same DOM as modern browsers.

The MIT License: https://jsoup.org/license

JSR305 Annotations for Findbugs

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

A micro-library for Clojure that provides first class support for named-capturing groups in regular expressions.

Apache-2.0: http://www.apache.org/licenses/LICENSE-2.0.html

The slf4j API

https://opensource.org/license/mit

Core libraries for SPDX

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

SPDX model versions 2.0, 2.1, and 2.3

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

The XClientMessageEvent struct used in certain components of X.Org 6.8.2 and earlier, possibly including (1) the X server and (2) Xlib, uses a "long" specifier for elements of the l array, which results in inconsistent sizes in the struct on 32-bit versus 64-bit platforms, and might allow attackers to cause a denial of service (application crash) and possibly conduct other attacks.

Generated java model source code

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt

Specification of data and functions

Eclipse Public License 1.0: https://opensource.org/license/epl-1-0/

A micro-library for Clojure(Script) that provides regular expression construction functions.

MPL-2.0: https://www.mozilla.org/en-US/MPL/2.0/