MAVEN SBOM results

[jssuttles]

Discussed in #1415

^{Originally posted by jssuttles April 2, 2024}
Here are bomber (https://github.com/devops-kung-fu/bomber) results generated from an sbom (https://github.com/CycloneDX/cyclonedx-maven-plugin). As you can see, there are supposedly a few critical vulnerabilities. Do these need to be addressed?

[AlexanderSchuetz97]

most of these dependencies are only found in some modules of dcm4chee. Not saying this shouldnt be addressed, but most users (at least to my knowlege) do not use these modules. I have none of these dependencies in my dependency graph. I however only use the parts of dcm4chee needed to parse .dcm files for metadata and render them into buffered images. These dependencies appear to be mostly from a web/application server. I dont think many people are using the inplementations provided by dcm4chee as is for those purposes.

At least for me this has no priority.