From 81c5dc4d32a904eef0a326397e662e4d1b2ed34b Mon Sep 17 00:00:00 2001
From: Lari Hotari <lhotari@apache.org>
Date: Tue, 10 Jan 2023 13:11:27 +0200
Subject: [PATCH 1/4] [fix][build] Upgrade dependency-check-maven plugin to fix
 broken OWASP check

- 7.4.4 includes fix for issue
  https://github.com/jeremylong/DependencyCheck/issues/5220

Error:  org.owasp.dependencycheck.data.nvdcve.DatabaseException: Error updating 'CVE-2020-36569'
org.owasp.dependencycheck.data.update.exception.UpdateException: org.owasp.dependencycheck.data.nvdcve.DatabaseException: Error updating 'CVE-2020-36569'
...
Caused by: org.h2.jdbc.JdbcBatchUpdateException: Value too long for column "VERSIONENDEXCLUDING CHARACTER VARYING(60)": "'0.0.0-20160722212129-ac0cc4484ad4_before_v0.0.0-20200131131040-063a3fb69896' (75)"; SQL statement:
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index db6de83545ff3..61e69f6467efe 100644
--- a/pom.xml
+++ b/pom.xml
@@ -282,7 +282,7 @@ flexible messaging model and an intuitive client API.</description>
     <errorprone-slf4j.version>0.1.4</errorprone-slf4j.version>
     <j2objc-annotations.version>1.3</j2objc-annotations.version>
     <lightproto-maven-plugin.version>0.4</lightproto-maven-plugin.version>
-    <dependency-check-maven.version>7.1.0</dependency-check-maven.version>
+    <dependency-check-maven.version>7.4.4</dependency-check-maven.version>
     <roaringbitmap.version>0.9.15</roaringbitmap.version>
     <extra-enforcer-rules.version>1.6.1</extra-enforcer-rules.version>
     <lombok.plugin.version>1.18.20.0</lombok.plugin.version>

From 507b3c2920896bfa593eff4720d7bc523b244b3d Mon Sep 17 00:00:00 2001
From: Lari Hotari <lhotari@apache.org>
Date: Tue, 10 Jan 2023 13:31:38 +0200
Subject: [PATCH 2/4] Mark CVE-2021-4277 as false positive

---
 src/owasp-dependency-check-false-positives.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/owasp-dependency-check-false-positives.xml b/src/owasp-dependency-check-false-positives.xml
index bda2a8d8c681d..b83df9831d8d9 100644
--- a/src/owasp-dependency-check-false-positives.xml
+++ b/src/owasp-dependency-check-false-positives.xml
@@ -176,4 +176,9 @@
     <notes>commons-net is not used at all and therefore commons-net vulnerability CVE-2021-37533 is a false positive.</notes>
     <cve>CVE-2021-37533</cve>
   </suppress>
+
+  <suppress>
+    <notes>fredsmith utils library is not used at all. CVE-2021-4277 is a false positive.</notes>
+    <cve>CVE-2021-4277</cve>
+  </suppress>
 </suppressions>
\ No newline at end of file

From 03519c2e2988fb4af960710ac2e4652f6c5a1d85 Mon Sep 17 00:00:00 2001
From: Lari Hotari <lhotari@apache.org>
Date: Tue, 10 Jan 2023 13:38:22 +0200
Subject: [PATCH 3/4] Mark yaml_project as false positive

---
 src/owasp-dependency-check-false-positives.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/owasp-dependency-check-false-positives.xml b/src/owasp-dependency-check-false-positives.xml
index b83df9831d8d9..372eed8b67855 100644
--- a/src/owasp-dependency-check-false-positives.xml
+++ b/src/owasp-dependency-check-false-positives.xml
@@ -181,4 +181,9 @@
     <notes>fredsmith utils library is not used at all. CVE-2021-4277 is a false positive.</notes>
     <cve>CVE-2021-4277</cve>
   </suppress>
+
+  <suppress>
+    <notes>yaml_project is not used at all. Any CVEs reported for yaml_project are false positives.</notes>
+    <cpe>cpe:/a:yaml_project:yaml</cpe>
+  </suppress>
 </suppressions>
\ No newline at end of file

From b000cf68e1757aeb035e5b336878a02277314a38 Mon Sep 17 00:00:00 2001
From: Lari Hotari <lhotari@apache.org>
Date: Tue, 10 Jan 2023 19:32:37 +0200
Subject: [PATCH 4/4] Mark flat_project as false positive

---
 src/owasp-dependency-check-false-positives.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/owasp-dependency-check-false-positives.xml b/src/owasp-dependency-check-false-positives.xml
index 372eed8b67855..cdd2216b40f4d 100644
--- a/src/owasp-dependency-check-false-positives.xml
+++ b/src/owasp-dependency-check-false-positives.xml
@@ -186,4 +186,9 @@
     <notes>yaml_project is not used at all. Any CVEs reported for yaml_project are false positives.</notes>
     <cpe>cpe:/a:yaml_project:yaml</cpe>
   </suppress>
+
+  <suppress>
+    <notes>flat_project is not used at all.</notes>
+    <cpe>cpe:/a:flat_project:flat</cpe>
+  </suppress>
 </suppressions>
\ No newline at end of file