The Atlassian Community Forums are currently in read-only mode. We will be relaunching on a new platform on September 22 (read more here). We apologize for the extended downtime. For concerns or questions, please email communitymanagers@atlassian.com. See you on the other side, on the new Atlassian Community Forums! :)

×

Forums

Articles
Create
cancel
Showing results for 
Search instead for 
Did you mean: 

atlassian/bitbucket-dependency-scanner puts obvious false positives into report

Phil
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
October 8, 2025

We get a lot of false positives concerning PostgreSQL vulnerabilities in our .Net web app pipeline. This is due to the fact that we have the Testcontainers.PostgreSql:4.7.0 nuget installed in one of our projects.

This is the latest version of the nuget, and we assume that the dependency scanner shows all these PostgreSQL vulnerabilities in its report because of PostgreSql:4.7.0, which is part of the nuget name.

Here is a snippet from our report

bitbucket_dependency_report.jpg

Is it possible to fix this? Or is it possible to have a "ignore list" for false positives?

If you need any more information, let me know.

 

Thanks in advance

0 answers

Comments for this post are closed

Community moderators have prevented the ability to post new answers.

Post a new question

DEPLOYMENT TYPE
CLOUD
PRODUCT PLAN
STANDARD
TAGS
AUG Leaders

Atlassian Community Events