dependency-check-maven 9.0.4 cannot fetch our suppressions XML

[gbrinkmann]

Describe the bug

dependency-check-maven 9.0.4 cannot fetch our suppressions XML

Log with mvn -X (the <url to our xml in our bitbucket> is the raw bitbucket file URL like in .../dependency-check-maven/raw/dependency-excludes.xml)

...
[DEBUG] Loading suppression rules from 'https://<url to our xml in our bitbucket>'
[DEBUG] Attempting retrieval of https://<url to our xml in our bitbucket>
[DEBUG] Available Protocols:
[DEBUG] SSLv2Hello
[DEBUG] SSLv3
[DEBUG] TLSv1
[DEBUG] TLSv1.1
[DEBUG] TLSv1.2
[DEBUG] TLSv1.3
[DEBUG] Attempting retrieval of https://<url to our xml in our bitbucket>
[WARNING] Unable to fetch the configured suppression file 'https://<url to our xml in our bitbucket>'
[DEBUG]
org.owasp.dependencycheck.utils.DownloadFailedException: Download failed, unable to copy 'https://<url to our xml in our bitbucket>' to 'C:\TEMP\dctempeb0ca8be-9fbe-49fa-b153-75e835aa350a\suppression942f87d8-db46-441c-90ae-e3885e0db92a.xml'; Error downloading file https://<url to our xml in our bitbucket>; unable to connect.
    at org.owasp.dependencycheck.utils.Downloader.fetchFile (Downloader.java:136)
...
Caused by: org.owasp.dependencycheck.utils.DownloadFailedException: Error downloading file https://<url to our xml in our bitbucket>; unable to connect.
    at org.owasp.dependencycheck.utils.HttpResourceConnection.obtainConnection (HttpResourceConnection.java:267)
...
Caused by: java.io.IOException: Unable to tunnel through proxy. Proxy returns "HTTP/1.1 503 Service Unavailable"
    at sun.net.www.protocol.http.HttpURLConnection.doTunneling0 (HttpURLConnection.java:2271)
    at sun.net.www.protocol.http.HttpURLConnection.doTunneling (HttpURLConnection.java:2143)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect (AbstractDelegateHttpsURLConnection.java:185)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect (HttpsURLConnectionImpl.java:141)
    at org.owasp.dependencycheck.utils.HttpResourceConnection.obtainConnection (HttpResourceConnection.java:206)
...

Notes:

• when I disable the proxy in settings.xml (active=false) it works.
• the Maven proxy settings in settings.xml include nonProxyHosts, which contain the domain of the XML URL.
• a Firefox HEAD request test for the XML URL results in HTTP 200 OK.
• I also tested with mavenSettingsProxyId (https://jeremylong.github.io/DependencyCheck/dependency-check-maven/configuration.html) and with -Ddownloader.quick.query.timestamp=false (https://jeremylong.github.io/DependencyCheck/data/proxy.html)

Version of dependency-check used
dependency-check-maven 9.0.4

Log file
see above

To Reproduce

n/a

Expected behavior
Successful usage of our suppressions XML.

Additional context

n/a

[jeremylong]

This should hopefully be fixed wiith 9.0.5 - which should be released in a day or two.

[gbrinkmann]

Test feedback: it works

...
[INFO] --- dependency-check:9.0.5:aggregate (default) @ myproject ---
...
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
...
[INFO] Suppression Rule had zero matches: (some of these log messages)
...
[INFO] BUILD SUCCESS