From 1709c612051cbd969d31a23c80f587d324754585 Mon Sep 17 00:00:00 2001
From: Kun Li <kun@moderne.io>
Date: Wed, 6 Sep 2023 11:16:11 -0700
Subject: [PATCH] Extend suppression of guava-31.1-jre and
 jackson-databind-2.15.2

---
 suppressions.xml | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/suppressions.xml b/suppressions.xml
index 5b28e7a4..8768c9bd 100644
--- a/suppressions.xml
+++ b/suppressions.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
-    <suppress until="2023-08-21Z">
+    <suppress until="2023-10-06Z">
         <notes><![CDATA[
             file name: jackson-databind-2.15.2.jar
             This is not a really valid CVE and not really exploitable as Java code needs to be modified: https://github.com/FasterXML/jackson-databind/issues/3972
@@ -8,7 +8,7 @@
         <packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$</packageUrl>
         <cve>CVE-2023-35116</cve>
     </suppress>
-    <suppress until="2023-08-21Z">
+    <suppress until="2023-10-06Z">
         <notes><![CDATA[
             file name: jackson-databind-2.15.2.jar
             The CVE https://nvd.nist.gov/vuln/detail/CVE-2019-3826 does not actually pertain to the Micrometer Prometheus client, but Prometheus itself
@@ -16,7 +16,7 @@
         <packageUrl regex="true">^pkg:maven/io\.micrometer\.prometheus/prometheus\-rsocket\-client@.*$</packageUrl>
         <cve>CVE-2019-3826</cve>
     </suppress>
-    <suppress until="2023-08-28Z">
+    <suppress until="2023-10-06Z">
         <notes><![CDATA[
             file name: guava-31.1-jre.jar
             Reverted in https://github.com/openrewrite/rewrite-python/commit/f487df7dabb8588ae2edb17e31ff7b8ba3ffc133 because Guava 32 introduces gradle module metadata which causes downstream breakage in build plugins.
@@ -24,4 +24,12 @@
         <packageUrl regex="true">^pkg:maven/com\.google\.guava/guava@31.1-jre$</packageUrl>
         <cve>CVE-2023-2976</cve>
     </suppress>
+    <suppress until="2023-10-06Z">
+        <notes><![CDATA[
+            file name: guava-31.1-jre.jar
+            Reverted in https://github.com/openrewrite/rewrite-python/commit/f487df7dabb8588ae2edb17e31ff7b8ba3ffc133 because Guava 32 introduces gradle module metadata which causes downstream breakage in build plugins.
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/com\.google\.guava/guava@.*$</packageUrl>
+        <cve>CVE-2020-8908</cve>
+    </suppress>
 </suppressions>