src/etc/project-suppression.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
  Licensed to the Apache Software Foundation (ASF) under one
  or more contributor license agreements.  See the NOTICE file
  distributed with this work for additional information
  regarding copyright ownership.  The ASF licenses this file
  to you under the Apache License, Version 2.0 (the
  "License"); you may not use this file except in compliance
  with the License.  You may obtain a copy of the License at

   http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing,
  software distributed under the License is distributed on an
  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
  KIND, either express or implied.  See the License for the
  specific language governing permissions and limitations
  under the License.
-->
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
    <suppress>
        <notes><![CDATA[
    file name: jasperreports-*.jar
    https://community.jaspersoft.com/knowledgebase/faq/update-details-about-the-java-vulnerability-r4897/
    One way to prevent such an attack would be to make sure the parent Java application runs on Java 17 or later, where this type of attack is blocked by some changes made to the Java platform itself.
    ]]></notes>
        <cve>CVE-2025-10492</cve>
    </suppress>
    <suppress>
        <notes><![CDATA[false positive due to naming to close to apache tiles
        cpe:2.3:a:apache:tiles:*:*:*:*:*:*:*:* versions from (including) 2.0]]></notes>
        <cve>CVE-2023-49735</cve>
        <cpe>cpe:/a:apache:struts</cpe>
    </suppress>
    <suppress>
        <notes><![CDATA[apps showcase demos with jquery-2.1.4.min.js]]></notes>
        <packageUrl regex="true">^pkg:javascript/jquery@.*$</packageUrl>
        <cve>CVE-2020-11022</cve>
        <cve>CVE-2020-11023</cve>
        <cve>CVE-2015-9251</cve>
        <cve>CVE-2019-11358</cve>
        <vulnerabilityName>jquery issue: 11974</vulnerabilityName>
        <vulnerabilityName>jquery issue: 162</vulnerabilityName>
    </suppress>
    <suppress>
        <notes><![CDATA[apps showcase demos with Bootstrap v3.3.4]]></notes>
<!--        <packageUrl regex="true">^pkg:javascript/bootstrap@.*$</packageUrl>-->
        <sha1>253711c6d825de55a8360552573be950da180614</sha1>
        <cve>CVE-2016-10735</cve>
        <cve>CVE-2018-14040</cve>
        <cve>CVE-2018-14041</cve>
        <cve>CVE-2018-14042</cve>
        <cve>CVE-2018-20676</cve>
        <cve>CVE-2018-20677</cve>
        <cve>CVE-2019-8331</cve>
        <cve>CVE-2024-6485</cve>
        <vulnerabilityName>Bootstrap before 4.0.0 is end-of-life and no longer maintained.</vulnerabilityName>
    </suppress>
    <suppress>
        <notes><![CDATA[
    file name: httpcore-4.4.16.jar
    ]]></notes>
        <packageUrl regex="true">^pkg:maven/org\.apache\.httpcomponents/httpcore@.*$</packageUrl>
        <cve>CVE-2026-54399</cve>
    </suppress>
    <suppress>
        <notes><![CDATA[
    file name: httpcore-4.4.16.jar
    ]]></notes>
        <packageUrl regex="true">^pkg:maven/org\.apache\.httpcomponents/httpcore@.*$</packageUrl>
        <cve>CVE-2026-54428</cve>
    </suppress>
</suppressions>