This is an automated email from the ASF dual-hosted git repository.
terrymanu pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/shardingsphere.git
The following commit(s) were added to refs/heads/master by this push:
new 2d0e414aee8 Suppress confirmed OWASP dependency false positives
(#40131)
2d0e414aee8 is described below
commit 2d0e414aee8f18fe8c530cdc01285a3f94122086
Author: Liang Zhang <[email protected]>
AuthorDate: Sat Oct 10 14:22:05 2026 +0800
Suppress confirmed OWASP dependency false positives (#40131)
* Merge nightly checks and reports into one daily workflow
* Suppress confirmed OWASP dependency false positives
---
src/resources/dependency-check-suppression.xml | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/src/resources/dependency-check-suppression.xml
b/src/resources/dependency-check-suppression.xml
index 85bbcc6d265..c0221ad72d3 100644
--- a/src/resources/dependency-check-suppression.xml
+++ b/src/resources/dependency-check-suppression.xml
@@ -39,4 +39,19 @@
<notes>Elasticjob was incorrectly identified as Apache
ZooKeeper</notes>
<cve>CVE-2016-5017</cve>
</suppress>
+ <suppress>
+ <notes>ElasticJob was incorrectly identified as Apache
ZooKeeper</notes>
+
<packageUrl>pkg:maven/org.apache.shardingsphere.elasticjob/[email protected]</packageUrl>
+ <cve>CVE-2019-0201</cve>
+ </suppress>
+ <suppress>
+ <notes>The affected cache deserialization implementation belongs to
KAPT, not kotlin-stdlib.</notes>
+ <packageUrl
regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib(-jdk7|-jdk8)?@2\.2\.21$</packageUrl>
+ <cve>CVE-2026-53914</cve>
+ </suppress>
+ <suppress>
+ <notes>The affected W3C Baggage propagation implementation belongs to
@opentelemetry/core for JavaScript, not the OpenTelemetry Java
libraries.</notes>
+ <packageUrl
regex="true">^pkg:maven/io\.opentelemetry/opentelemetry-(api|common|context|exporter-otlp|sdk|sdk-common|sdk-extension-autoconfigure|sdk-extension-autoconfigure-spi|sdk-logs|sdk-metrics|sdk-trace)@1\.58\.0$</packageUrl>
+ <cve>CVE-2026-54285</cve>
+ </suppress>
</suppressions>
