rell/dependencies-suppression.xml at dev · ChromiaProject/rell · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (C) 2026 ChromaWay AB. See LICENSE for license information.
  -->

<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
    <suppress>
        <notes><![CDATA[
        False positive. This is actually a problem with json-java which we do not use.
        file name: jackson-core-2.15.0.jar
        ]]></notes>
        <cve>CVE-2022-45688</cve>
    </suppress>
    <suppress>
        <notes><![CDATA[
        Vulnerability in Guava if using com.google.common.io.Files.createTempDir. No version exists
        without this vulnerability but the function is marked as deprecated in version 30+
        We do not use this function in the code so handled as false positive.
        file name: guava-31.1-jre.jar
        ]]></notes>
        <cve>CVE-2020-8908</cve>
        <cve>CVE-2023-2976</cve>
    </suppress>
    <suppress>
        <notes><![CDATA[
        kotlin-faker 1.x bundles jackson-databind 2.21.1 inside its own jar and no fixed 1.x
        release exists (2.0.0 is still RC and restructures the API). Faker is only used by the
        rell-toolbox seeder to generate fake test data; the bundled Jackson never deserializes
        attacker-controlled input. Re-evaluate when kotlin-faker 2.0.0 goes stable.
        file name: kotlin-faker-1.16.1.jar (shaded: com.fasterxml.jackson.core:jackson-databind:2.21.1)
        ]]></notes>
        <filePath regex="true">.*kotlin-faker-.*\.jar.*jackson-databind.*</filePath>
        <cve>CVE-2026-54512</cve>
        <cve>CVE-2026-54513</cve>
        <cve>CVE-2026-54514</cve>
        <cve>CVE-2026-54516</cve>
        <cve>CVE-2026-54517</cve>
        <cve>CVE-2026-54518</cve>
    </suppress>
    <suppress>
        <notes><![CDATA[
        False positive. kotlinx-benchmark-runtime is matched against cpe:/a:jetbrains:runtime,
        which is the JetBrains Runtime (JBR); CVE-2025-29903 is fixed in JBR 21.0.6b872.80 and
        has nothing to do with the benchmark library.
        file name: kotlinx-benchmark-runtime-jvm-0.4.17.jar
        ]]></notes>
        <packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlinx/kotlinx-benchmark-runtime.*$</packageUrl>
        <cpe>cpe:/a:jetbrains:runtime</cpe>
    </suppress>
</suppressions>