Reduce frequency of vulnerability scan to weekly (#161)

Also suppress a false positive vulnerability detection.

Signed-off-by: Mark S. Lewis <[email protected]>

Author: bestbeforetoday

.github/workflows/vulnerability-scan.yml

@@ -2,7 +2,7 @@ name: "Security vulnerability scan"
 
 on:
   schedule:
-    - cron: "20 23 * * *"
+    - cron: "20 23 * * 0"
 
 jobs:
   scan:

dependency-suppressions.xml

@@ -48,4 +48,11 @@
         <packageUrl regex="true">^pkg:maven/com\.ibm\.cloud/cloudant(-common)?@.*$</packageUrl>
         <cve>CVE-2023-26268</cve>
     </suppress>
+    <suppress>
+        <notes><![CDATA[
+        gRPC Java is not affected by this vulnerability; only gRPC C++, Python and Ruby
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/io\.opentelemetry\.instrumentation/opentelemetry\-grpc\-1\.6@.*$</packageUrl>
+        <cve>CVE-2023-4785</cve>
+    </suppress>
 </suppressions>

pom.xml

@@ -364,7 +364,7 @@
                     <plugin>
                         <groupId>org.owasp</groupId>
                         <artifactId>dependency-check-maven</artifactId>
-                        <version>8.3.1</version>
+                        <version>8.4.0</version>
                         <configuration>
                             <skipProvidedScope>true</skipProvidedScope>
                             <skipTestScope>true</skipTestScope>