Dependency check cannot scan individual components with known vulnerabilities

[yanhui2623]

For the vulnerability CVE-2022-23395 in component jquery.cookie, dependency check seems unable to identify it.

I installed problematic components jquery.cookie and SixLabors.ImageSharp in a project I built locally.

My scanning command is as follows:

Surprisingly, there is no vulnerability information for jquire.cookie in my report results

Dependency check seems to only be able to detect information about jquery.cookie, but cannot identify security vulnerabilities.

Just to add, there is information about this CVE in my vulnerability database.

[yanhui2623]

Upon reviewing the documentation again, I discovered the -- hints parameter, which seems to be a key parameter for resolving false positives.

But it still doesn't seem to solve this problem.