(zookeeper) branch master updated: ZOOKEEPER-5087: Suppress false positive OpenTelemetry CVE-s in OWASP dependency check

[andor]

This is an automated email from the ASF dual-hosted git repository.

anmolnar pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/zookeeper.git


The following commit(s) were added to refs/heads/master by this push:
     new 33770c45a ZOOKEEPER-5087: Suppress false positive OpenTelemetry CVE-s 
in OWASP dependency check
33770c45a is described below

commit 33770c45ac4a975491a6076662446d8a408f8c06
Author: Dávid Paksy <paksyda...@gmail.com>
AuthorDate: Tue Sep 15 20:34:36 2026 +0200

    ZOOKEEPER-5087: Suppress false positive OpenTelemetry CVE-s in OWASP 
dependency check
    
    Reviewers: anmolnar
    Author: PDavid
    Closes #2453 from PDavid/ZOOKEEPER-5087
---
 owaspSuppressions.xml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/owaspSuppressions.xml b/owaspSuppressions.xml
index 4fbe204fe..d0876764a 100644
--- a/owaspSuppressions.xml
+++ b/owaspSuppressions.xml
@@ -18,6 +18,24 @@
 -->
 
 <suppressions 
xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.2.xsd";>
+   <suppress>
+      <notes>False positive: it affects only opentelemetry-js: the 
OpenTelemetry JavaScript Client</notes>
+      <cve>CVE-2026-54285</cve>
+   </suppress>
+   <suppress>
+      <notes>False positive: it affects only OpenTelemetry dotnet 
library</notes>
+      <cve>CVE-2026-41078</cve>
+      <cve>CVE-2026-40894</cve>
+   </suppress>
+   <suppress>
+      <notes>False positive: it affects only OpenTelemetry-Go: the Go 
implementation of OpenTelemetry</notes>
+      <cve>CVE-2026-39882</cve>
+      <cve>CVE-2026-41178</cve>
+   </suppress>
+   <suppress>
+      <notes>False positive: it affects only OpenTelemetry-cpp: the C++ 
implementation of OpenTelemetry</notes>
+      <cve>CVE-2026-44967</cve>
+   </suppress>
    <suppress>
       <!-- ZOOKEEPER-3217 -->
       <cve>CVE-2018-8088</cve>