From 9ee1c25b69d903d4ffa9fbf06c69d35c0cd80913 Mon Sep 17 00:00:00 2001
From: patchwork01 <110390516+patchwork01@users.noreply.github.com>
Date: Mon, 2 Feb 2026 09:51:39 +0000
Subject: [PATCH 01/11] 6481 Re-enable dependency checks

---
 .github/workflows/dependency-check.yaml | 77 ++++++++++++-------------
 1 file changed, 38 insertions(+), 39 deletions(-)

diff --git a/.github/workflows/dependency-check.yaml b/.github/workflows/dependency-check.yaml
index 501a190c6f5..d63aba519cd 100644
--- a/.github/workflows/dependency-check.yaml
+++ b/.github/workflows/dependency-check.yaml
@@ -15,42 +15,41 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - run: echo "Disabled dependency checks temporarily, see https://github.com/gchq/sleeper/issues/6481"
-      # - uses: actions/checkout@v3
-      # - uses: actions/setup-java@v3
-      #   with:
-      #     java-version: '17'
-      #     distribution: 'corretto'
-      # - name: Get current date
-      #   id: date
-      #   run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
-      # - name: Restore cache of Maven dependencies & CVEs database
-      #   uses: actions/cache/restore@v5
-      #   id: restore-cache
-      #   with:
-      #     path: ${{ runner.temp }}/.m2/repository
-      #     key: ${{ runner.os }}-dependency-check-${{ steps.date.outputs.date }}
-      #     fail-on-cache-miss: ${{ inputs.failOnCacheMiss }}
-      #     restore-keys: |
-      #       ${{ runner.os }}-dependency-check-
-      # - name: Resolve dependencies
-      #   run: mvn de.qaware.maven:go-offline-maven-plugin:resolve-dependencies -Dmaven.repo.local=${{ runner.temp }}/.m2/repository
-      #   working-directory: ./java
-      # - name: Update CVEs database
-      #   run: mvn --batch-mode dependency-check:update-only -Dmaven.repo.local=${{ runner.temp }}/.m2/repository
-      #   working-directory: ./java
-      # - name: Build with Maven
-      #   run: mvn --batch-mode verify dependency-check:aggregate -Pquick,skipShade -DskipRust -Dmaven.repo.local=${{ runner.temp }}/.m2/repository
-      #   working-directory: ./java
-      # - name: Cache Maven dependencies & CVEs database
-      #   uses: actions/cache/save@v5
-      #   if: ${{ always() && inputs.writeCache }}
-      #   with:
-      #     path: ${{ runner.temp }}/.m2/repository
-      #     key: ${{ steps.restore-cache.outputs.cache-primary-key }}
-      # - name: Upload dependency check report
-      #   if: ${{ always() }}
-      #   uses: actions/upload-artifact@v5
-      #   with:
-      #     name: Dependency check report
-      #     path: java/target/dependency-check-report.html
+      - uses: actions/checkout@v3
+      - uses: actions/setup-java@v3
+        with:
+          java-version: '17'
+          distribution: 'corretto'
+      - name: Get current date
+        id: date
+        run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
+      - name: Restore cache of Maven dependencies & CVEs database
+        uses: actions/cache/restore@v5
+        id: restore-cache
+        with:
+          path: ${{ runner.temp }}/.m2/repository
+          key: ${{ runner.os }}-dependency-check-${{ steps.date.outputs.date }}
+          fail-on-cache-miss: ${{ inputs.failOnCacheMiss }}
+          restore-keys: |
+            ${{ runner.os }}-dependency-check-
+      - name: Resolve dependencies
+        run: mvn de.qaware.maven:go-offline-maven-plugin:resolve-dependencies -Dmaven.repo.local=${{ runner.temp }}/.m2/repository
+        working-directory: ./java
+      - name: Update CVEs database
+        run: mvn --batch-mode dependency-check:update-only -Dmaven.repo.local=${{ runner.temp }}/.m2/repository
+        working-directory: ./java
+      - name: Build with Maven
+        run: mvn --batch-mode verify dependency-check:aggregate -Pquick,skipShade -DskipRust -Dmaven.repo.local=${{ runner.temp }}/.m2/repository
+        working-directory: ./java
+      - name: Cache Maven dependencies & CVEs database
+        uses: actions/cache/save@v5
+        if: ${{ always() && inputs.writeCache }}
+        with:
+          path: ${{ runner.temp }}/.m2/repository
+          key: ${{ steps.restore-cache.outputs.cache-primary-key }}
+      - name: Upload dependency check report
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v5
+        with:
+          name: Dependency check report
+          path: java/target/dependency-check-report.html

From a5a5a860e0da3efd01e3db6341f509a712ef8219 Mon Sep 17 00:00:00 2001
From: patchwork01 <110390516+patchwork01@users.noreply.github.com>
Date: Mon, 2 Feb 2026 13:05:55 +0000
Subject: [PATCH 02/11] 6481 Temporarily run workflow changes workflow without
 cache

---
 .github/workflows/dependency-check-workflow-changes.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependency-check-workflow-changes.yaml b/.github/workflows/dependency-check-workflow-changes.yaml
index de577bedda8..4e503d31a96 100644
--- a/.github/workflows/dependency-check-workflow-changes.yaml
+++ b/.github/workflows/dependency-check-workflow-changes.yaml
@@ -9,4 +9,4 @@ jobs:
   check:
     uses: ./.github/workflows/dependency-check.yaml
     with:
-      failOnCacheMiss: true
+      failOnCacheMiss: false

From 4e7e7bd7ca5145a0b39005cb67bfc50f723cb776 Mon Sep 17 00:00:00 2001
From: patchwork01 <110390516+patchwork01@users.noreply.github.com>
Date: Mon, 2 Feb 2026 13:54:55 +0000
Subject: [PATCH 03/11] 6481 Set back failOnCacheMiss flag

---
 .github/workflows/dependency-check-workflow-changes.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependency-check-workflow-changes.yaml b/.github/workflows/dependency-check-workflow-changes.yaml
index 4e503d31a96..de577bedda8 100644
--- a/.github/workflows/dependency-check-workflow-changes.yaml
+++ b/.github/workflows/dependency-check-workflow-changes.yaml
@@ -9,4 +9,4 @@ jobs:
   check:
     uses: ./.github/workflows/dependency-check.yaml
     with:
-      failOnCacheMiss: false
+      failOnCacheMiss: true

From c14daface6c26ed53ba8ee82456a392033239ce7 Mon Sep 17 00:00:00 2001
From: patchwork01 <110390516+patchwork01@users.noreply.github.com>
Date: Wed, 4 Feb 2026 09:56:32 +0000
Subject: [PATCH 04/11] 6481 Suppress vulnerability in Jetty http2-client

---
 code-style/dependency-check-suppressions.xml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/code-style/dependency-check-suppressions.xml b/code-style/dependency-check-suppressions.xml
index 4720cf4e516..4350774c71e 100644
--- a/code-style/dependency-check-suppressions.xml
+++ b/code-style/dependency-check-suppressions.xml
@@ -159,6 +159,15 @@
         <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.http2/http2-common@.*$</packageUrl>
         <vulnerabilityName>CVE-2025-5115</vulnerabilityName>
     </suppress>
+    <suppress>
+        <notes><![CDATA[
+        This dependency is brought in through Trino, and our Trino plugin is currently experimental. To upgrade Trino
+        we also need to upgrade Java. AWS EMR does not yet support using Apache Spark with versions of Java beyond 17,
+        so we are not currently able to upgrade.
+        ]]>        </notes>
+        <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.http2/http2-client@.*$</packageUrl>
+        <cve>CVE-2025-5115</cve>
+    </suppress>
     <suppress>
         <notes><![CDATA[
         DOMPurify is only used by WireMock, which is only used for tests. We're not able to upgrade to a later version

From 2abcdbf7fc3eec0648884fb8add7cd77c7ff05c1 Mon Sep 17 00:00:00 2001
From: patchwork01 <110390516+patchwork01@users.noreply.github.com>
Date: Wed, 4 Feb 2026 09:59:23 +0000
Subject: [PATCH 05/11] 6481 Run dependency check without cache (will revert
 this)

---
 .github/workflows/dependency-check-workflow-changes.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependency-check-workflow-changes.yaml b/.github/workflows/dependency-check-workflow-changes.yaml
index de577bedda8..4e503d31a96 100644
--- a/.github/workflows/dependency-check-workflow-changes.yaml
+++ b/.github/workflows/dependency-check-workflow-changes.yaml
@@ -9,4 +9,4 @@ jobs:
   check:
     uses: ./.github/workflows/dependency-check.yaml
     with:
-      failOnCacheMiss: true
+      failOnCacheMiss: false

From 7bf6410010e6df21adb0b9777965d8b463dbb62a Mon Sep 17 00:00:00 2001
From: patchwork01 <110390516+patchwork01@users.noreply.github.com>
Date: Fri, 20 Mar 2026 10:19:27 +0000
Subject: [PATCH 06/11] 6481 Fix dependency-check-changes.yaml config

---
 .github/workflows/dependency-check-changes.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/dependency-check-changes.yaml b/.github/workflows/dependency-check-changes.yaml
index 0aa57d3697e..7091933861a 100644
--- a/.github/workflows/dependency-check-changes.yaml
+++ b/.github/workflows/dependency-check-changes.yaml
@@ -4,6 +4,9 @@ on:
     paths:
       - 'code-style/dependency-check-suppressions.xml'
       - 'java/**/pom.xml'
+    paths-ignore:
+      - '.github/workflows/dependency-check.yaml'
+      - '.github/workflows/dependency-check-workflow-changes.yaml'
 
 jobs:
   check:

From 6796c05f0ee0eda3803a36d42dbb80988903ed53 Mon Sep 17 00:00:00 2001
From: rtjd6554 <rtjd6554@proton.me>
Date: Tue, 21 Apr 2026 06:45:25 +0000
Subject: [PATCH 07/11] 6481: Update dependency suppressions

---
 code-style/dependency-check-suppressions.xml | 138 +++++++++++++++++++
 1 file changed, 138 insertions(+)

diff --git a/code-style/dependency-check-suppressions.xml b/code-style/dependency-check-suppressions.xml
index c649f8ea592..1a5c51823ba 100644
--- a/code-style/dependency-check-suppressions.xml
+++ b/code-style/dependency-check-suppressions.xml
@@ -186,4 +186,142 @@
         <packageUrl regex="true">^pkg:maven/org\.xmlunit/xmlunit-core@.*$</packageUrl>
         <cve>CVE-2024-9410</cve>
     </suppress>
+    <suppress>
+        <notes><![CDATA[
+	file name: jetty-io-11.0.25.jar
+	file name: jetty-alpn-java-client-11.0.25.jar
+	file name: jetty-xml-11.0.25.jar
+    file name: jetty-server-11.0.25.jar
+    file name: http2-client-11.0.25.jar
+    file name: http2-http-client-transport-11.0.25.jar
+    file name: http2-server-11.0.25.jar
+    file name: jetty-alpn-server-11.0.25.jar
+    file name: jetty-util-11.0.25.jar
+    file name: jetty-http-11.0.25.jar
+    file name: http2-common-11.0.25.jar
+    file name: jetty-client-11.0.25.jar
+    file name: jetty-alpn-java-server-11.0.25.jar
+    file name: jetty-webapp-11.0.25.jar
+    file name: jetty-servlet-11.0.25.jar
+	file name: jetty-security-11.0.25.jar
+	file name: jetty-servlets-11.0.25.jar
+	file name: jetty-alpn-client-11.0.25.jar
+    ]]>        </notes>
+        <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty/jetty-*$|^pkg:maven/org\.eclipse\.jetty\.http2/http2-*$</packageUrl>
+        <cpe>cpe:/a:eclipse:jetty</cpe>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+	file name: jetty-io-11.0.25.jar
+	file name: jetty-alpn-java-client-11.0.25.jar
+	file name: jetty-xml-11.0.25.jar
+    file name: jetty-server-11.0.25.jar
+    file name: http2-client-11.0.25.jar
+    file name: http2-http-client-transport-11.0.25.jar
+    file name: http2-server-11.0.25.jar
+    file name: jetty-alpn-server-11.0.25.jar
+    file name: jetty-util-11.0.25.jar
+    file name: jetty-http-11.0.25.jar
+    file name: http2-common-11.0.25.jar
+    file name: jetty-client-11.0.25.jar
+    file name: jetty-alpn-java-server-11.0.25.jar
+    file name: jetty-webapp-11.0.25.jar
+    file name: jetty-servlet-11.0.25.jar
+	file name: jetty-security-11.0.25.jar
+	file name: jetty-servlets-11.0.25.jar
+	file name: jetty-alpn-client-11.0.25.jar
+    ]]>        </notes>
+        <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty/jetty-*$|^pkg:maven/org\.eclipse\.jetty\.http2/http2-*$</packageUrl>
+        <cpe>cpe:/a:jetty:jetty</cpe>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+	file name: jetty-io-11.0.25.jar
+	file name: jetty-alpn-java-client-11.0.25.jar
+	file name: jetty-xml-11.0.25.jar
+    file name: jetty-server-11.0.25.jar
+    file name: http2-client-11.0.25.jar
+    file name: http2-http-client-transport-11.0.25.jar
+    file name: http2-server-11.0.25.jar
+    file name: jetty-alpn-server-11.0.25.jar
+    file name: jetty-util-11.0.25.jar
+    file name: jetty-http-11.0.25.jar
+    file name: http2-common-11.0.25.jar
+    file name: jetty-client-11.0.25.jar
+    file name: jetty-alpn-java-server-11.0.25.jar
+    file name: jetty-webapp-11.0.25.jar
+    file name: jetty-servlet-11.0.25.jar
+	file name: jetty-security-11.0.25.jar
+	file name: jetty-servlets-11.0.25.jar
+	file name: jetty-alpn-client-11.0.25.jar
+    ]]>        </notes>
+        <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty/jetty-*$|^pkg:maven/org\.eclipse\.jetty\.http2/http2-*$</packageUrl>
+        <cpe>cpe:/a:mortbay_jetty:jetty</cpe>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+    file name: jetty-alpn-server-11.0.25.jar
+	file name: jetty-alpn-java-server-11.0.25.jar
+	file name: jetty-server-11.0.25.jar
+	file name: http2-server-11.0.25.jar
+    ]]>        </notes>
+        <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty/jetty-*$|^pkg:maven/org\.eclipse\.jetty\.http2/http2-server@.*$</packageUrl>
+        <cpe>cpe:/a:jetty:jetty_http_server</cpe>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+    file name: opentelemetry-semconv-1.21.0-alpha.jar
+    ]]>        </notes>
+        <packageUrl regex="true">^pkg:maven/io\.opentelemetry\.semconv/opentelemetry-semconv@.*$</packageUrl>
+        <cpe>cpe:/a:opentelemetry:opentelemetry</cpe>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+    file name: jib-build-plan-0.4.0.jar
+    ]]>        </notes>
+        <packageUrl regex="true">^pkg:maven/com\.google\.cloud\.tools/jib-build-plan@.*$</packageUrl>
+        <cpe>cpe:/a:google:cloud_build</cpe>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+    file name: cdk-asset-awscli-v1-2.2.273.jar: asset-awscli-v1@2.2.273.jsii.tgz: asset-awscli-v1@2.2.273.jsii.tar: layer.zip: endpoint-rule-set-1.json.gz
+    ]]>        </notes>
+        <sha1>50270e2a59c8c6328db1af2d7854bc734db0c64e</sha1>
+        <cpe>cpe:/a:json_project:json</cpe>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+    file name: cdk-asset-awscli-v1-2.2.273.jar: asset-awscli-v1@2.2.273.jsii.tgz: asset-awscli-v1@2.2.273.jsii.tar: layer.zip: endpoint-rule-set-1.json.gz
+    ]]>        </notes>
+        <sha1>50270e2a59c8c6328db1af2d7854bc734db0c64e</sha1>
+        <cpe>cpe:/a:set_project:set</cpe>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+    file name: jetty-http-11.0.25.jar
+    ]]>        </notes>
+        <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty/jetty-http@.*$</packageUrl>
+        <cve>CVE-2025-5115</cve>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+    file name: handlebars-4.5.0.jar: handlebars-v4.7.7.js
+    ]]>        </notes>
+        <packageUrl regex="true">^pkg:javascript/handlebars@.*$</packageUrl>
+        <cve>CVE-2026-33937</cve>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+    file name: wiremock-3.13.2.jar: swagger-ui-bundle.js
+    ]]>        </notes>
+        <packageUrl regex="true">^pkg:javascript/DOMPurify@.*$</packageUrl>
+        <cve>CVE-2026-0540</cve>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+    file name: wiremock-3.13.2.jar: swagger-ui-es-bundle.js
+    ]]>        </notes>
+        <packageUrl regex="true">^pkg:javascript/DOMPurify@.*$</packageUrl>
+        <cve>CVE-2026-0540</cve>
+    </suppress>
 </suppressions>

From b57e29f7973dbd7f7a41606d2b454d5d43a62a29 Mon Sep 17 00:00:00 2001
From: rtjd6554 <rtjd6554@proton.me>
Date: Tue, 21 Apr 2026 12:02:26 +0000
Subject: [PATCH 08/11] 6841; awscli suppression

---
 code-style/dependency-check-suppressions.xml | 136 +------------------
 1 file changed, 3 insertions(+), 133 deletions(-)

diff --git a/code-style/dependency-check-suppressions.xml b/code-style/dependency-check-suppressions.xml
index 1a5c51823ba..29ae8409262 100644
--- a/code-style/dependency-check-suppressions.xml
+++ b/code-style/dependency-check-suppressions.xml
@@ -188,140 +188,10 @@
     </suppress>
     <suppress>
         <notes><![CDATA[
-	file name: jetty-io-11.0.25.jar
-	file name: jetty-alpn-java-client-11.0.25.jar
-	file name: jetty-xml-11.0.25.jar
-    file name: jetty-server-11.0.25.jar
-    file name: http2-client-11.0.25.jar
-    file name: http2-http-client-transport-11.0.25.jar
-    file name: http2-server-11.0.25.jar
-    file name: jetty-alpn-server-11.0.25.jar
-    file name: jetty-util-11.0.25.jar
-    file name: jetty-http-11.0.25.jar
-    file name: http2-common-11.0.25.jar
-    file name: jetty-client-11.0.25.jar
-    file name: jetty-alpn-java-server-11.0.25.jar
-    file name: jetty-webapp-11.0.25.jar
-    file name: jetty-servlet-11.0.25.jar
-	file name: jetty-security-11.0.25.jar
-	file name: jetty-servlets-11.0.25.jar
-	file name: jetty-alpn-client-11.0.25.jar
-    ]]>        </notes>
-        <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty/jetty-*$|^pkg:maven/org\.eclipse\.jetty\.http2/http2-*$</packageUrl>
-        <cpe>cpe:/a:eclipse:jetty</cpe>
-    </suppress>
-    <suppress>
-        <notes><![CDATA[
-	file name: jetty-io-11.0.25.jar
-	file name: jetty-alpn-java-client-11.0.25.jar
-	file name: jetty-xml-11.0.25.jar
-    file name: jetty-server-11.0.25.jar
-    file name: http2-client-11.0.25.jar
-    file name: http2-http-client-transport-11.0.25.jar
-    file name: http2-server-11.0.25.jar
-    file name: jetty-alpn-server-11.0.25.jar
-    file name: jetty-util-11.0.25.jar
-    file name: jetty-http-11.0.25.jar
-    file name: http2-common-11.0.25.jar
-    file name: jetty-client-11.0.25.jar
-    file name: jetty-alpn-java-server-11.0.25.jar
-    file name: jetty-webapp-11.0.25.jar
-    file name: jetty-servlet-11.0.25.jar
-	file name: jetty-security-11.0.25.jar
-	file name: jetty-servlets-11.0.25.jar
-	file name: jetty-alpn-client-11.0.25.jar
-    ]]>        </notes>
-        <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty/jetty-*$|^pkg:maven/org\.eclipse\.jetty\.http2/http2-*$</packageUrl>
-        <cpe>cpe:/a:jetty:jetty</cpe>
-    </suppress>
-    <suppress>
-        <notes><![CDATA[
-	file name: jetty-io-11.0.25.jar
-	file name: jetty-alpn-java-client-11.0.25.jar
-	file name: jetty-xml-11.0.25.jar
-    file name: jetty-server-11.0.25.jar
-    file name: http2-client-11.0.25.jar
-    file name: http2-http-client-transport-11.0.25.jar
-    file name: http2-server-11.0.25.jar
-    file name: jetty-alpn-server-11.0.25.jar
-    file name: jetty-util-11.0.25.jar
-    file name: jetty-http-11.0.25.jar
-    file name: http2-common-11.0.25.jar
-    file name: jetty-client-11.0.25.jar
-    file name: jetty-alpn-java-server-11.0.25.jar
-    file name: jetty-webapp-11.0.25.jar
-    file name: jetty-servlet-11.0.25.jar
-	file name: jetty-security-11.0.25.jar
-	file name: jetty-servlets-11.0.25.jar
-	file name: jetty-alpn-client-11.0.25.jar
-    ]]>        </notes>
-        <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty/jetty-*$|^pkg:maven/org\.eclipse\.jetty\.http2/http2-*$</packageUrl>
-        <cpe>cpe:/a:mortbay_jetty:jetty</cpe>
-    </suppress>
-    <suppress>
-        <notes><![CDATA[
-    file name: jetty-alpn-server-11.0.25.jar
-	file name: jetty-alpn-java-server-11.0.25.jar
-	file name: jetty-server-11.0.25.jar
-	file name: http2-server-11.0.25.jar
-    ]]>        </notes>
-        <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty/jetty-*$|^pkg:maven/org\.eclipse\.jetty\.http2/http2-server@.*$</packageUrl>
-        <cpe>cpe:/a:jetty:jetty_http_server</cpe>
-    </suppress>
-    <suppress>
-        <notes><![CDATA[
-    file name: opentelemetry-semconv-1.21.0-alpha.jar
-    ]]>        </notes>
-        <packageUrl regex="true">^pkg:maven/io\.opentelemetry\.semconv/opentelemetry-semconv@.*$</packageUrl>
-        <cpe>cpe:/a:opentelemetry:opentelemetry</cpe>
-    </suppress>
-    <suppress>
-        <notes><![CDATA[
-    file name: jib-build-plan-0.4.0.jar
-    ]]>        </notes>
-        <packageUrl regex="true">^pkg:maven/com\.google\.cloud\.tools/jib-build-plan@.*$</packageUrl>
-        <cpe>cpe:/a:google:cloud_build</cpe>
-    </suppress>
-    <suppress>
-        <notes><![CDATA[
-    file name: cdk-asset-awscli-v1-2.2.273.jar: asset-awscli-v1@2.2.273.jsii.tgz: asset-awscli-v1@2.2.273.jsii.tar: layer.zip: endpoint-rule-set-1.json.gz
-    ]]>        </notes>
-        <sha1>50270e2a59c8c6328db1af2d7854bc734db0c64e</sha1>
-        <cpe>cpe:/a:json_project:json</cpe>
-    </suppress>
-    <suppress>
-        <notes><![CDATA[
+         The AWS CDK uses a vulnerable Ruby gem. Once there's a version of the CDK that doesn't, we can use that instead.
+
     file name: cdk-asset-awscli-v1-2.2.273.jar: asset-awscli-v1@2.2.273.jsii.tgz: asset-awscli-v1@2.2.273.jsii.tar: layer.zip: endpoint-rule-set-1.json.gz
     ]]>        </notes>
-        <sha1>50270e2a59c8c6328db1af2d7854bc734db0c64e</sha1>
-        <cpe>cpe:/a:set_project:set</cpe>
-    </suppress>
-    <suppress>
-        <notes><![CDATA[
-    file name: jetty-http-11.0.25.jar
-    ]]>        </notes>
-        <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty/jetty-http@.*$</packageUrl>
-        <cve>CVE-2025-5115</cve>
-    </suppress>
-    <suppress>
-        <notes><![CDATA[
-    file name: handlebars-4.5.0.jar: handlebars-v4.7.7.js
-    ]]>        </notes>
-        <packageUrl regex="true">^pkg:javascript/handlebars@.*$</packageUrl>
-        <cve>CVE-2026-33937</cve>
-    </suppress>
-    <suppress>
-        <notes><![CDATA[
-    file name: wiremock-3.13.2.jar: swagger-ui-bundle.js
-    ]]>        </notes>
-        <packageUrl regex="true">^pkg:javascript/DOMPurify@.*$</packageUrl>
-        <cve>CVE-2026-0540</cve>
-    </suppress>
-    <suppress>
-        <notes><![CDATA[
-    file name: wiremock-3.13.2.jar: swagger-ui-es-bundle.js
-    ]]>        </notes>
-        <packageUrl regex="true">^pkg:javascript/DOMPurify@.*$</packageUrl>
-        <cve>CVE-2026-0540</cve>
+        <cve>CVE-2020-28267</cve>
     </suppress>
 </suppressions>

From 4fdbe8aa15560bda7c9009b6258c64cfe36f71e2 Mon Sep 17 00:00:00 2001
From: rtjd6554 <rtjd6554@proton.me>
Date: Tue, 21 Apr 2026 12:28:02 +0000
Subject: [PATCH 09/11] 6841: Handlebars suppressions

---
 code-style/dependency-check-suppressions.xml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/code-style/dependency-check-suppressions.xml b/code-style/dependency-check-suppressions.xml
index 29ae8409262..19e1b729f6f 100644
--- a/code-style/dependency-check-suppressions.xml
+++ b/code-style/dependency-check-suppressions.xml
@@ -194,4 +194,14 @@
     ]]>        </notes>
         <cve>CVE-2020-28267</cve>
     </suppress>
+    <suppress>
+        <notes><![CDATA[
+        Vulnerability exists as part of latest version of library. Once a newer version is available, suppression can
+        be removed.
+
+    file name: handlebars-4.5.0.jar: handlebars-v4.7.7.js
+    ]]>        </notes>
+        <packageUrl regex="true">^pkg:javascript/handlebars@.*$</packageUrl>
+        <vulnerabilityName regex="true">CVE-2026-33937|CVE-2026-33938|CVE-2026-33940|CVE-2026-33939|CVE-2026-33916|CVE-2026-33941</vulnerabilityName>
+    </suppress>
 </suppressions>

From cebe9beafc5bc263befb264fb68816c2fab76153 Mon Sep 17 00:00:00 2001
From: rtjd6554 <rtjd6554@proton.me>
Date: Tue, 21 Apr 2026 13:37:45 +0000
Subject: [PATCH 10/11] 6841: Update for opentelemtry suppressions.

---
 code-style/dependency-check-suppressions.xml | 49 +++++++++++++++++++-
 1 file changed, 47 insertions(+), 2 deletions(-)

diff --git a/code-style/dependency-check-suppressions.xml b/code-style/dependency-check-suppressions.xml
index 19e1b729f6f..4eab993da8b 100644
--- a/code-style/dependency-check-suppressions.xml
+++ b/code-style/dependency-check-suppressions.xml
@@ -199,9 +199,54 @@
         Vulnerability exists as part of latest version of library. Once a newer version is available, suppression can
         be removed.
 
-    file name: handlebars-4.5.0.jar: handlebars-v4.7.7.js
-    ]]>        </notes>
+        file name: handlebars-4.5.0.jar: handlebars-v4.7.7.js
+        ]]>        </notes>
         <packageUrl regex="true">^pkg:javascript/handlebars@.*$</packageUrl>
         <vulnerabilityName regex="true">CVE-2026-33937|CVE-2026-33938|CVE-2026-33940|CVE-2026-33939|CVE-2026-33916|CVE-2026-33941</vulnerabilityName>
     </suppress>
+    <suppress>
+        <notes><![CDATA[
+        Vulnerability exists as part of packages used within spark. Unable to upgrade as need to align with
+        spark version for AWS EMR.
+
+        file name: http2-client-11.0.25.jar
+        file name: http2-http-client-transport-11.0.25.jar
+        file name: http2-server-11.0.25.jar
+        file name: jetty-io-11.0.25.jar
+        ]]>        </notes>
+        <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.http2/http2-.*$|^pkg:maven/org\.eclipse\.jetty/jetty-.*$</packageUrl>
+        <cve>CVE-2025-11143</cve>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+        Vulnerability exists as part of packages used within spark. Unable to upgrade as need to align with
+        spark version for AWS EMR.
+
+        file name: http2-http-client-transport-11.0.25.jar
+        file name: http2-server-11.0.25.jar
+        file name: jetty-io-11.0.25.jar
+        ]]>        </notes>
+        <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.http2/http2-.*$|^pkg:maven/org\.eclipse\.jetty/jetty-.*$</packageUrl>
+        <cve>CVE-2025-5115</cve>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+        Brought in as part of jib-core. Presently on the latest version, so unable to fix presently. Once a newer
+        version is available, suppression could possibly be removed.
+
+        file name: jib-build-plan-0.4.0.jar
+        ]]>        </notes>
+        <packageUrl regex="true">^pkg:maven/com\.google\.cloud\.tools/jib-build-plan@.*$</packageUrl>
+        <cve>CVE-2026-3136</cve>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+        Versions are contained as part of trino so are unable to be upgraded as we need to maintain version
+        compatibility.
+
+        file name: opentelemetry-semconv-1.21.0-alpha.jar
+        ]]>        </notes>
+        <packageUrl regex="true">^pkg:maven/io\.opentelemetry\.semconv/opentelemetry-semconv@.*$</packageUrl>
+        <vulnerabilityName regex="true">CVE-2026-39883|CVE-2026-39882</vulnerabilityName>
+    </suppress>
 </suppressions>

From 989a644bdfde8743dcfe9d428d205948a07482cb Mon Sep 17 00:00:00 2001
From: rtjd6554 <rtjd6554@proton.me>
Date: Tue, 21 Apr 2026 13:48:54 +0000
Subject: [PATCH 11/11] 6841: Update for Wiremock suppressions

---
 code-style/dependency-check-suppressions.xml | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/code-style/dependency-check-suppressions.xml b/code-style/dependency-check-suppressions.xml
index 4eab993da8b..1788b3d298e 100644
--- a/code-style/dependency-check-suppressions.xml
+++ b/code-style/dependency-check-suppressions.xml
@@ -190,8 +190,9 @@
         <notes><![CDATA[
          The AWS CDK uses a vulnerable Ruby gem. Once there's a version of the CDK that doesn't, we can use that instead.
 
-    file name: cdk-asset-awscli-v1-2.2.273.jar: asset-awscli-v1@2.2.273.jsii.tgz: asset-awscli-v1@2.2.273.jsii.tar: layer.zip: endpoint-rule-set-1.json.gz
-    ]]>        </notes>
+        file name: cdk-asset-awscli-v1-2.2.273.jar: asset-awscli-v1@2.2.273.jsii.tgz: asset-awscli-v1@2.2.273.jsii.tar:
+        layer.zip: endpoint-rule-set-1.json.gz
+        ]]>        </notes>
         <cve>CVE-2020-28267</cve>
     </suppress>
     <suppress>
@@ -249,4 +250,14 @@
         <packageUrl regex="true">^pkg:maven/io\.opentelemetry\.semconv/opentelemetry-semconv@.*$</packageUrl>
         <vulnerabilityName regex="true">CVE-2026-39883|CVE-2026-39882</vulnerabilityName>
     </suppress>
+    <suppress>
+        <notes><![CDATA[
+        This dependency is only used by WireMock, which is only used for tests.
+
+        file name: wiremock-3.13.2.jar: swagger-ui-bundle.js
+        file name: wiremock-3.13.2.jar: swagger-ui-es-bundle.js
+        ]]>        </notes>
+        <packageUrl regex="true">^pkg:javascript/DOMPurify@.*$</packageUrl>
+        <vulnerabilityName regex="true">CVE-2026-0540|CVE-2025-15599</vulnerabilityName>
+    </suppress>
 </suppressions>