terrymanu commented on PR #40131: URL: https://github.com/apache/shardingsphere/pull/40131#issuecomment-6094605682
### Result **Review Result: Mergeable** Fixed three categories of OWASP false positives, consolidated into one PR scope. Only one XML file was changed, adding three suppression rules. ### Evidence - [Suppression rules](/Users/zhangliang/IdeaProjects/shardingsphere/src/resources/dependency-check-suppression.xml:42) target the actual ElasticJob, Kotlin stdlib, and OpenTelemetry Java packages, their current versions, and specific CVEs. Protobuf requires no additional rule. - The full scan passed using official NVD data dated 2026-10-10: 348 dependency nodes, 396 artifacts, zero unsuppressed findings, and zero analysis exceptions. - The new suppressions cover exactly the 15 verified package/CVE pairs. All existing suppressions were preserved, and artifact inventories and checksums remained unchanged. - All 114 positive and negative cases using the actual parser, Checkstyle, RAT, diff checks, and independent review passed. ### Coverage The local candidate is based on `7cf1c001013`. All 15 added XML lines were reviewed. Root cause, impact, verification, and final convergence reviews are complete, with no unresolved findings. Unrelated workflow commits were excluded. The CVSS 7 threshold and existing scan scope remain unchanged. Spotless does not cover this XML file. OSS Index was not covered because credentials were not configured. This conclusion applies only to the local code changes; remote CI was not reviewed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
