Repository: dependency-check/DependencyCheck (language: java)

Issue:
[FP]: osgi-resource-locator detected as eclipse glassfish
### Package URl

pkg:maven/org.glassfish.hk2/osgi-resource-locator@1.0.3

### CPE

`cpe:2.3:a:eclipse:glassfish:1.0.3:*:*:*:*:*:*:*`

### CVE

CVE-2024-9329

### ODC Integration

{"label"=>"Maven Plugin"}

### ODC Version

10.0.1

### Description

Another dependency under the glassfish org is being detected as eclipse glassfish, which recently had a published CVE released.


Discussion / hints:
Maven Coordinates

```xml
<dependency>
   <groupId>org.glassfish.hk2</groupId>
   <artifactId>osgi-resource-locator</artifactId>
   <version>1.0.3</version>
</dependency>
```

Suppression rule:
```xml
<suppress base="true">
   <notes><![CDATA[
   FP per issue #7022
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.glassfish\.hk2/osgi-resource-locator@.*$</packageUrl>
   <cpe>cpe:/a:eclipse:glassfish</cpe>
</suppress>
```

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/11241118161
Dupe of #7015, already fixed in #7016 but needs another "automated" FP report to be merged before it gets published.

Fix patch:
diff --git a/generatedSuppressions.xml b/generatedSuppressions.xml
index fa9e4ac53eb..28bdc980f30 100644
--- a/generatedSuppressions.xml
+++ b/generatedSuppressions.xml
@@ -1556,9 +1556,9 @@
 </suppress>
 <suppress base="true">
    <notes><![CDATA[
-   hand-curated better suppression for FP per issues #6626 and #7015
+   hand-curated better suppression for FP per issues #6626, #7015, #7019, #7020, #7021, #7022
    ]]></notes>
-   <packageUrl regex="true">^pkg:maven/org\.glassfish\.(?!main).*$</packageUrl>
+   <packageUrl regex="true">^pkg:maven/org\.glassfish(?!\.main).*$</packageUrl>
    <cpe>cpe:/a:eclipse:glassfish</cpe>
 </suppress>
 <suppress base="true">


Test patch: