added documentation about unused code

dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java

@@ -782,6 +782,8 @@ public class CveDB {
     }
 
     /**
+     * This method is only referenced in unused code.
+     *
      * Deletes unused dictionary entries from the database.
      */
     public void deleteUnusedCpe() {
@@ -797,6 +799,8 @@ public class CveDB {
     }
 
     /**
+     * This method is only referenced in unused code and will likely break on MySQL if ever used due to the MERGE statement.
+     *
      * Merges CPE entries into the database.
      *
      * @param cpe the CPE identifier

dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/CpeUpdater.java

@@ -43,6 +43,9 @@ import org.slf4j.LoggerFactory;
 import org.xml.sax.SAXException;
 
 /**
+ *
+ * This class is currently unused and if enabled will likely not work on MySQL as the MERGE statement is used.
+ *
  * The CpeUpdater is designed to download the CPE data file from NIST and import the data into the database. However, as this
  * currently adds no beneficial data, compared to what is in the CPE data contained in the CVE data files, this class is not
  * currently used. The code is being kept as a future update may utilize more data from the CPE xml files.

dependency-check-core/src/main/resources/data/dbStatements.properties

@@ -35,5 +35,6 @@ INSERT_PROPERTY=INSERT INTO properties (id, value) VALUES (?, ?)
 UPDATE_PROPERTY=UPDATE properties SET value = ? WHERE id = ?
 DELETE_PROPERTY=DELETE FROM properties WHERE id = ?
 
+#the following two statements are unused and are only referenecd in dead code
 DELETE_UNUSED_DICT_CPE=DELETE FROM cpeEntry WHERE dictionaryEntry=true AND id NOT IN (SELECT cpeEntryId FROM software)
 ADD_DICT_CPE=MERGE INTO cpeEntry (cpe, vendor, product, dictionaryEntry) KEY(cpe) VALUES(?,?,?,true)