xsd 2.0 not up to date

[thib3113]

Describe the bug
Npm source add a new xml node, not documented on https://jeremylong.github.io/DependencyCheck/dependency-check.2.0.xsd .

Exemple :

<vulnerability source="NPM">
    <name>786</name>
    <severity>low</severity>
    <cwes/>
    <description>
        Versions of `braces` prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.
    </description>
    <references>
        <reference>
            <source>Advisory 786: Regular Expression Denial of Service</source>
            <name>
                - [GitHub Commit](https://github.com/micromatch/braces/commit/abdafb0cae1e0c00f184abbadc692f4eaa98f451)
            </name>
        </reference>
    </references>
    <vulnerableSoftware>
        <software>cpe:2.3:a:*:braces:\&lt;2.3.1:*:*:*:*:*:*:*</software>
    </vulnerableSoftware>
</vulnerability>

here, severity is not valid here

** Version of dependency-check used **
The problem occurs using version 5.0.0-SNAPSHOT ( cloned from git, on the commit c747bac )

To Reproduce
Steps to reproduce the behavior:

1. Run the test ReportGeneratorIT.testGenerateReport with adding a nodejs test ( pull request is coming )

Expected behavior
Update the xsd

[jeremylong]

Sorry -we have done a poor job of publishing things during the long journey of the 5.0.0 release. The field has already been added to the dev branch:

DependencyCheck/core/src/main/resources/schema/dependency-check.2.0.xsd

Line 141 in c747bac

<xs:element name="severity" type="xs:string" minOccurs="0" maxOccurs="1"/>

We are hoping to be complete with the 5.0.0 release soon.

[thib3113]

Oh sorry ... jetbrains doesn't see it and use the web version . So ... good if you support it :D . But maybe did you need to update xsd version to 2.1 ? ( I know the sonaqube plugin alreay check the 2.0 version, but will not support the severity )

[jeremylong]

Regarding the 2.0 vs 2.1 - the only thing on the DC side that uses the 2.0 schema are pre-release version (milestone releases). However, I suppose you are right - others have been using the milestone releases in production so we probably should update the schema version.