opentelemetry-java-instrumentation/buildscripts/dependency-check-suppressions.xml

<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
  <suppress>
    <!-- this suppresses opentelemetry instrumentation modules and artifacts which get misidentified
         as real dependencies like dubbo and prometheus -->
    <packageUrl regex="true">^pkg:maven/io\.opentelemetry[./].*</packageUrl>
    <vulnerabilityName regex="true">^CVE-.*</vulnerabilityName>
  </suppress>
</suppressions>