<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">

    <suppress>
        <notes>
            <![CDATA[
            We do not look for dependencies in our gradle caches.
            We only rely on what is packaged in the product.   
          ]]>
        </notes>
        <filePath regex="true">/home/jenkins/\.gradle/caches/modules-2/files-2.1/.*?</filePath>
        <cve>CVE-2022-42889</cve>
    </suppress>
    <suppress until="2026-08-01Z">
        <notes>
            <![CDATA[
         file name: remotegui.jar: jquery.min.js - We can not yet upgrade to a newer version due to dependencies.
         We do, however, not directly use the functionality that is being CVEd
      ]]>
        </notes>
        <cve>CVE-2015-9251</cve>
        <cve>CVE-2016-10707</cve>
        <cve>CVE-2019-11358</cve>
        <cve>CVE-2020-11022</cve>
        <cve>CVE-2020-11023</cve>
        <cve>CVE-2024-30875</cve>
    </suppress>
    <suppress>
        <notes>
            <![CDATA[
      Possible false positive, wince the CVE is a year old and it does not match this package and version
      file name: datasource.cassandra.zip: native-protocol.jar
      ]]>
        </notes>
        <packageUrl regex="true">^pkg:maven/com\.datastax\.oss/native\-protocol@.*$</packageUrl>
        <cve>CVE-2020-13946</cve>
    </suppress>

    <suppress until="2026-08-01Z">
        <notes>
            <![CDATA[
      JavaDoc embedded JQuery UI - requires updated Java Version with newer javadoc 
      ]]>
        </notes>
        <filePath regex="true">.*-javadoc\.jar.*jquery-ui.*</filePath>
        <!-- packageUrl regex="true">^pkg:javascript/jquery\-ui@.*$</packageUrl -->
           <cve>CVE-2021-41182</cve>
           <cve>CVE-2021-41183</cve>
           <cve>CVE-2021-41184</cve>
           <cve>CVE-2022-31160</cve>
    </suppress>
    <suppress until="2026-08-01Z">
        <notes><![CDATA[file name: remotegui.zip: jquery.jar]]></notes>
        <packageUrl regex="true">^pkg:javascript/jquery@.*$</packageUrl>
        <vulnerabilityName>jQuery 1.x and 2.x are End-of-Life and no longer receiving security updates</vulnerabilityName>
        <cve>CVE-2020-23064</cve>
    </suppress>
    <suppress until="2026-08-01Z">
       <notes><![CDATA[
       file name: remotegui.zip: jquery.jar
       ]]></notes>
       <packageUrl regex="true">^pkg:javascript/jquery@.*$</packageUrl>
       <vulnerabilityName>jquery issue: 162</vulnerabilityName>
    </suppress>
    <suppress>
        <notes><![CDATA[ false positives, no end date 
        CVE-2008-7271  - This is for the eclipse ide and not for any library from eclipse.
        CVE-2010-4647  - This is for the eclipse ide and not for any library from eclipse.
        CVE-2020-26939 - The BouncyCastle FIPS variant uses same maven package matcher but has different version numbers.
        CVE-2021-4236  - This is for a go project, match on every lib with 'web' in the name
        CVE-2021-4277  - This is for a utils project from fredssmith, match on every lib with 'utils' in the name
        CVE-2022-31548 - This is a CVE for a sample phyton project.
        CVE-2022-43550 - This is a CVE for the jitsi main project and not for any library from jitsi.
        CVE-2022-45688 - This is for hutool-json, matched on every component with 'json' in the name
        CVE-2023-5072  - This is for JSON-java, matched on every component with 'json' in the name
        CVE-2023-33202 - The BouncyCastle FIPS variant uses same maven package matcher but has different version numbers.
        CVE-2023-35116 - DISPUTED
        CVE-2023-36052 - This is for Azure CLI and not for com.azure:azure-core.
        CVE-2023-45161 - This is for 1E-Exchange which we does not use.
        ]]></notes>
        <packageUrl regex="true">^.*$</packageUrl>
        <cve>CVE-2008-7271</cve>
        <cve>CVE-2010-4647</cve>
        <cve>CVE-2020-26939</cve>
        <cve>CVE-2021-4236</cve>
        <cve>CVE-2021-4277</cve>
        <cve>CVE-2022-31548</cve>
        <cve>CVE-2022-43550</cve>
        <cve>CVE-2022-45688</cve>
        <cve>CVE-2023-5072</cve>
        <cve>CVE-2023-33202</cve>
        <cve>CVE-2023-35116</cve>
        <cve>CVE-2023-36052</cve>
        <cve>CVE-2023-45161</cve>
    </suppress>
    <suppress>
        <notes><![CDATA[
        file name: remotegui.zip: angularjs.jar
        We can not yet update to newer Angular Version
        ]]></notes>
        <packageUrl regex="true">^pkg:javascript/angularjs@.*$</packageUrl>
        <vulnerabilityName>End-of-Life: Long term support for AngularJS has been discontinued</vulnerabilityName>
    </suppress>
    <suppress>
        <notes><![CDATA[
        file name: remotegui.zip: angularjs.jar
        We can not yet update to newer Angular Version
        ]]></notes>
        <packageUrl regex="true">^pkg:javascript/angularjs@.*$</packageUrl>
        <vulnerabilityName>End-of-Life: Long term support for AngularJS has been discontinued as of December 31, 2021</vulnerabilityName>
    </suppress>
    <suppress>
        <notes><![CDATA[
        We can not yet update to newer Angular Version
        ]]></notes>
        <packageUrl regex="true">^.*angular.*$</packageUrl>
        <cve>CVE-2021-4231</cve>
        <cve>CVE-2022-25844</cve>
        <cve>CVE-2022-25869</cve>
        <cve>CVE-2023-26116</cve>
        <cve>CVE-2023-26117</cve>
        <cve>CVE-2023-26118</cve>
        <cve>CVE-2024-8372</cve>
        <cve>CVE-2024-8373</cve>
        <cve>CVE-2024-21490</cve>
        <cve>CVE-2025-0716</cve>
        <cve>CVE-2025-2336</cve>
        <cve>CVE-2025-4690</cve>
    </suppress>
    <suppress>
       <notes><![CDATA[
       file name: taskplanner.ftp.zip: taskplanner.ftp.jar
       ]]></notes>
       <filePath regex="true">.*ftp\.(jar|zip).*</filePath>
       <cve>CVE-2023-22551</cve>
    </suppress>
    <suppress>
        <notes><![CDATA[
   Reactor Netty has a different version structure and does not match the general netty CPE
   ]]></notes>
        <filePath regex="true">/home/jenkins/.*?/reactor-netty.*?</filePath>
        <cpe>cpe:/a:netty:netty</cpe>
    </suppress>
    <suppress>
        <notes><![CDATA[
   XML Graphics Common has a false positive match on Apache Commons Net
   ]]></notes>
        <filePath regex="true">/home/jenkins/.*?/xmlgraphics-commons.jar</filePath>
        <cpe>cpe:/a:apache:commons_net</cpe>
    </suppress>
    <suppress>
        <notes><![CDATA[
        file name: docfx.vendor.js
        This is a dependency by a third-party tool DocFX that can not be updated. Used exclusively in the .NET API documentation within the SDK.
        ]]></notes>
        <packageUrl regex="true">^pkg:javascript/bootstrap@.*$</packageUrl>
        <vulnerabilityName>CVE-2024-6484</vulnerabilityName>
        <vulnerabilityName>CVE-2025-1647</vulnerabilityName>
        <vulnerabilityName>Bootstrap before 4.0.0 is end-of-life and no longer maintained.</vulnerabilityName>
    </suppress>
    <suppress>
        <notes><![CDATA[
        file name: mail.zip: bcpg-fips.jar
        ]]></notes>
        <sha1>727e087a843f3a5a8143e4f3a7518c8c3517df18</sha1>
        <cve>CVE-2022-29523</cve>
    </suppress>
    <suppress>
       <notes><![CDATA[
       false positives with jetty-quiche-native.jar, no end date 
       Because the different version schema all Jetty old CVE are matching.
       ]]></notes>
       <packageUrl regex="true">^pkg:maven/org\.mortbay\.jetty\.quiche/jetty-quiche-native@.*$</packageUrl>
       <cve>CVE-2005-3747</cve>
       <cve>CVE-2007-5615</cve>
       <cve>CVE-2009-1523</cve>
       <cve>CVE-2009-1524</cve>
       <cve>CVE-2009-5048</cve>
       <cve>CVE-2009-5049</cve>
       <cve>CVE-2011-4461</cve>
    </suppress>
</suppressions>
