From 783cd4e971d78f0b01773e957473680947bd382a Mon Sep 17 00:00:00 2001
From: Angel Eduardo Hincho Jove <ahincho@unsa.edu.pe>
Date: Wed, 30 Sep 2026 18:04:36 -0500
Subject: [PATCH] build: scan only what the library ships with OWASP

---
 build.gradle.kts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/build.gradle.kts b/build.gradle.kts
index 7378043..2b97d70 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -69,6 +69,9 @@ dependencyCheck {
     // and an empty NVD key (slower updates, acceptable for local dev).
     failBuildOnCVSS = (System.getenv("NOVA_OWASP_FAIL_ON_CVSS") ?: "11").toFloat()
     nvd.apiKey = System.getenv("NVD_API_KEY") ?: ""
+    // Solo lo que recibe el consumidor, como en el toolchain de Nova (ADR-044): Checkstyle, PIT y las
+    // pruebas no viajan con la librería.
+    scanConfigurations.set(listOf("compileClasspath", "runtimeClasspath"))
 }
 
 pitest {