How to make Dependency Track to suppress certain VULs?

[qianwch]

Current Behavior

I am using docker version of dependency track.
Some VULs are definitely false, for an example CVE-2022-28111.
So we need to configure Dependency Track to ignore such VULs, then we could get less false notifications.
I have tried to use /data/.dependency-track/dependency-check/suppressions.xml or /data/.dependency-track/suppressions.xml file:

<?xml version="1.0" encoding="UTF-8"?>
<suppressions>
<suppress>
   <notes><![CDATA[
    Ignored CVEs
   ]]></notes>
  <cve>CVE-2022-22965</cve>
  <cve>GHSA-36p3-wjmg-h94x</cve>
  <cve>sonatype-2022-1764</cve>
  <cve>CVE-2022-28111</cve>
  <cve>GHSA-w559-623p-vfg8</cve>
</suppress>
</suppressions>

But no luck! I have searched a lot, but still no clue.

Proposed Behavior

The VULs could be ignored.

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this enhancement was already requested

[nscuro]

Duplicate of #1495

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.