From 997df104af32e5d1370ebb34bf712a2a82998584 Mon Sep 17 00:00:00 2001
From: Usman Saleem <usman@usmans.info>
Date: Thu, 17 Oct 2024 14:14:11 +1000
Subject: [PATCH] Add false positive supression for dependency check

 -- CVE-2024-43591 is not applicable
 -- Update azure libraries
---
 gradle/owasp-suppression.xml | 11 +++++++++++
 gradle/versions.gradle       |  6 +++---
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/gradle/owasp-suppression.xml b/gradle/owasp-suppression.xml
index e77466cdc..e9600b426 100644
--- a/gradle/owasp-suppression.xml
+++ b/gradle/owasp-suppression.xml
@@ -1,6 +1,17 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
     <!-- See https://jeremylong.github.io/DependencyCheck/general/suppression.html for examples -->
+    <suppress>
+        <notes><![CDATA[
+          FALSE POSITIVE
+          file name: azure-json-1.1.0.jar
+          As per https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43591
+          this vulnerability is applicable on Azure Service Connector and Azure CLI.
+          We are not using these libraries in our code.
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/com\.azure/azure-json@.*$</packageUrl>
+        <cve>CVE-2024-43591</cve>
+    </suppress>
     <suppress>
         <notes><![CDATA[
           file name: azure-identity-1.13.1.jar
diff --git a/gradle/versions.gradle b/gradle/versions.gradle
index 793b99cab..d8190614e 100644
--- a/gradle/versions.gradle
+++ b/gradle/versions.gradle
@@ -128,9 +128,9 @@ dependencyManagement {
     dependency 'com.github.arteam:simple-json-rpc-server:1.3'
     dependency 'com.github.arteam:simple-json-rpc-client:1.3'
 
-    dependency 'com.azure:azure-security-keyvault-secrets:4.8.4'
-    dependency 'com.azure:azure-security-keyvault-keys:4.8.5'
-    dependency 'com.azure:azure-identity:1.13.1'
+    dependency 'com.azure:azure-security-keyvault-secrets:4.8.7'
+    dependency 'com.azure:azure-security-keyvault-keys:4.8.8'
+    dependency 'com.azure:azure-identity:1.14.0'
 
     dependency 'com.zaxxer:HikariCP:5.1.0'
     dependency 'org.postgresql:postgresql:42.7.3'