From 0f7929b30f28842bf12e805c9ffa2f2e298cf9a8 Mon Sep 17 00:00:00 2001
From: Trey Chadick <tchad@labkey.com>
Date: Tue, 25 Aug 2026 11:35:16 -0700
Subject: [PATCH 1/2] Suppress false-positive for pgvector (#1489)

https://github.com/dependency-check/DependencyCheck/issues/8769
---
 dependencyCheckSuppression.xml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/dependencyCheckSuppression.xml b/dependencyCheckSuppression.xml
index e8926bd673..eb6c6bab29 100644
--- a/dependencyCheckSuppression.xml
+++ b/dependencyCheckSuppression.xml
@@ -488,4 +488,16 @@
         <cve>CVE-2026-66299</cve>
     </suppress>
 
+    <!--
+    [FP]: pgvector java library matching CPE for pgvector postgres extension
+    https://github.com/dependency-check/DependencyCheck/issues/8769
+    -->
+    <suppress>
+        <notes><![CDATA[
+    file name: pgvector-0.1.6.jar
+    ]]></notes>
+        <packageUrl regex="true">^pkg:maven/com\.pgvector/pgvector@.*$</packageUrl>
+        <cpe>cpe:/a:pgvector_project:pgvector</cpe>
+    </suppress>
+
 </suppressions>

From 28c128b2ce6f3cd89ec53f9d4ccb677f1f6f99c1 Mon Sep 17 00:00:00 2001
From: Trey Chadick <tchad@labkey.com>
Date: Fri, 28 Aug 2026 21:08:22 -0700
Subject: [PATCH 2/2] Update dependencies and CVE suppressions (#1494)

---
 dependencyCheckSuppression.xml | 37 ++++++++++++++++++++--------------
 gradle.properties              |  6 +++---
 2 files changed, 25 insertions(+), 18 deletions(-)

diff --git a/dependencyCheckSuppression.xml b/dependencyCheckSuppression.xml
index eb6c6bab29..1cab9c8187 100644
--- a/dependencyCheckSuppression.xml
+++ b/dependencyCheckSuppression.xml
@@ -471,33 +471,40 @@
     </suppress>
 
     <!--
-    CVE in example code. New version not yet available.
+    [FP]: pgvector java library matching CPE for pgvector postgres extension
+    https://github.com/dependency-check/DependencyCheck/issues/8769
     -->
     <suppress>
         <notes><![CDATA[
-    file name: tomcat-*-11.0.24.jar
+    file name: pgvector-0.1.6.jar
     ]]></notes>
-        <packageUrl regex="true">^pkg:maven/org\.apache\.tomcat/tomcat-.*@.*$</packageUrl>
-        <cve>CVE-2026-66299</cve>
+        <packageUrl regex="true">^pkg:maven/com\.pgvector/pgvector@.*$</packageUrl>
+        <cpe>cpe:/a:pgvector_project:pgvector</cpe>
     </suppress>
+
+    <!--
+    [FP]: opentelemetry-js is the OpenTelemetry JavaScript Client, not the Java client we pull in.
+    -->
     <suppress>
         <notes><![CDATA[
-    file name: tomcat-embed-*-11.0.24.jar
+    file name: opentelemetry-api-1.60.1.jar
     ]]></notes>
-        <packageUrl regex="true">^pkg:maven/org\.apache\.tomcat\.embed/tomcat-embed-.*@.*$</packageUrl>
-        <cve>CVE-2026-66299</cve>
+        <packageUrl regex="true">^pkg:maven/io\.opentelemetry/opentelemetry-api@.*$</packageUrl>
+        <cpe>cpe:/a:opentelemetry:opentelemetry</cpe>
     </suppress>
-
-    <!--
-    [FP]: pgvector java library matching CPE for pgvector postgres extension
-    https://github.com/dependency-check/DependencyCheck/issues/8769
-    -->
     <suppress>
         <notes><![CDATA[
-    file name: pgvector-0.1.6.jar
+    file name: opentelemetry-common-1.60.1.jar
     ]]></notes>
-        <packageUrl regex="true">^pkg:maven/com\.pgvector/pgvector@.*$</packageUrl>
-        <cpe>cpe:/a:pgvector_project:pgvector</cpe>
+        <packageUrl regex="true">^pkg:maven/io\.opentelemetry/opentelemetry-common@.*$</packageUrl>
+        <cpe>cpe:/a:opentelemetry:opentelemetry</cpe>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+    file name: opentelemetry-context-1.60.1.jar
+    ]]></notes>
+        <packageUrl regex="true">^pkg:maven/io\.opentelemetry/opentelemetry-context@.*$</packageUrl>
+        <cpe>cpe:/a:opentelemetry:opentelemetry</cpe>
     </suppress>
 
 </suppressions>
diff --git a/gradle.properties b/gradle.properties
index 33a92cd693..05bf3be47c 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -98,7 +98,7 @@ apacheDirectoryVersion=2.1.8
 apacheMinaVersion=2.2.9
 
 # Usually matches the version specified as a Spring Boot dependency (see springBootVersion below)
-apacheTomcatVersion=11.0.24
+apacheTomcatVersion=11.0.25
 
 # (mothership) -> json-path -> json-smart -> accessor-smart
 # (core) -> graalvm
@@ -260,8 +260,8 @@ microsoftGraphVersion=6.65.0
 
 mssqlJdbcVersion=13.4.0.jre11
 
-# Netty - transitive dependency via azure-core-http-netty; force for CVE-2026-33871, CVE-2026-33870, CVE-2026-45674, CVE-2026-47691 (and 20 related) fixed in 4.2.15.Final, plus CVE-2026-44891, CVE-2026-55831, CVE-2026-55833 fixed in 4.2.16.Final
-nettyVersion=4.2.16.Final
+# Netty - transitive dependency via azure-core-http-netty; force for CVE fixes
+nettyVersion=4.2.17.Final
 # Reactor - transitive dependency via azure-core; force for version consistency across modules
 reactorCoreVersion=3.8.1