From 1736e2838a956e4812f6af764bce3721047b56e8 Mon Sep 17 00:00:00 2001
From: labkey-tchad <tchad@labkey.com>
Date: Fri, 31 Oct 2025 11:40:29 -0700
Subject: [PATCH] Suppress bzip CVE false positives

---
 dependencyCheckSuppression.xml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/dependencyCheckSuppression.xml b/dependencyCheckSuppression.xml
index b6207e62cd..800b8ef002 100644
--- a/dependencyCheckSuppression.xml
+++ b/dependencyCheckSuppression.xml
@@ -164,4 +164,22 @@
         <packageUrl regex="true">^pkg:maven/org\.labkey\.api/labkey-api-jdbc@.*$</packageUrl>
         <cpe>cpe:/a:labkey:labkey_server</cpe>
     </suppress>
+
+    <!--
+    False positives from CVEs in the bzip2 Debian package
+    -->
+    <suppress>
+        <notes><![CDATA[
+        file name: bzip2-0.9.1.jar
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/org\.itadaki/bzip2@.*$</packageUrl>
+        <cpe>cpe:/a:bzip:bzip2</cpe>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+        file name: bzip2-0.9.1.jar
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/org\.itadaki/bzip2@.*$</packageUrl>
+        <cpe>cpe:/a:bzip2_project:bzip2</cpe>
+    </suppress>
 </suppressions>