From 09dd25c6069a5445876ce688ffbba248a8bdcad8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Apr 2026 18:21:02 +0000
Subject: [PATCH 1/4] Bump quarkus.version from 3.34.1 to 3.34.2

Bumps `quarkus.version` from 3.34.1 to 3.34.2.

Updates `io.quarkus.platform:quarkus-bom` from 3.34.1 to 3.34.2
- [Commits](https://github.com/quarkusio/quarkus-platform/compare/3.34.1...3.34.2)

Updates `io.quarkus.platform:quarkus-maven-plugin` from 3.34.1 to 3.34.2
- [Commits](https://github.com/quarkusio/quarkus-platform/compare/3.34.1...3.34.2)

---
updated-dependencies:
- dependency-name: io.quarkus.platform:quarkus-bom
  dependency-version: 3.34.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: io.quarkus.platform:quarkus-maven-plugin
  dependency-version: 3.34.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 examples/cli/pom.xml    | 2 +-
 examples/webapp/pom.xml | 2 +-
 pom.xml                 | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/examples/cli/pom.xml b/examples/cli/pom.xml
index 4a85aced11..c679f103e9 100644
--- a/examples/cli/pom.xml
+++ b/examples/cli/pom.xml
@@ -18,7 +18,7 @@
   <properties>
     <maven.compiler.release>17</maven.compiler.release>
 
-    <quarkus.version>3.34.1</quarkus.version>
+    <quarkus.version>3.34.2</quarkus.version>
   </properties>
 
   <dependencyManagement>
diff --git a/examples/webapp/pom.xml b/examples/webapp/pom.xml
index 9c9917cb22..9fe4e55278 100644
--- a/examples/webapp/pom.xml
+++ b/examples/webapp/pom.xml
@@ -18,7 +18,7 @@
   <properties>
     <maven.compiler.release>17</maven.compiler.release>
 
-    <quarkus.version>3.34.1</quarkus.version>
+    <quarkus.version>3.34.2</quarkus.version>
   </properties>
 
   <dependencyManagement>
diff --git a/pom.xml b/pom.xml
index 419c336d02..6c4eb980a6 100644
--- a/pom.xml
+++ b/pom.xml
@@ -32,7 +32,7 @@
     <jose4j.version>0.9.6</jose4j.version>
     <json.bind.version>3.0.1</json.bind.version>
     <okhttp.version>5.3.2</okhttp.version>
-    <quarkus.version>3.34.1</quarkus.version>
+    <quarkus.version>3.34.2</quarkus.version>
     <slf4j.version>2.0.17</slf4j.version>
     <!-- pinning to Spring 5.x for Java 11 support -->
     <spring.security.version>5.8.14</spring.security.version>

From 26c71c013cfadd682f53c7131bb838145fbce89c Mon Sep 17 00:00:00 2001
From: Aaron Coburn <aaronc@inrupt.com>
Date: Mon, 6 Apr 2026 13:33:01 -0500
Subject: [PATCH 2/4] Remove owasp checks

---
 .github/workflows/ci-config.yml    | 31 --------------
 .github/workflows/nvd-cache.yml    | 55 -------------------------
 build-tools/owasp/suppressions.xml | 66 ------------------------------
 pom.xml                            | 63 ----------------------------
 4 files changed, 215 deletions(-)
 delete mode 100644 .github/workflows/nvd-cache.yml
 delete mode 100644 build-tools/owasp/suppressions.xml

diff --git a/.github/workflows/ci-config.yml b/.github/workflows/ci-config.yml
index 764a22250b..41f30add87 100644
--- a/.github/workflows/ci-config.yml
+++ b/.github/workflows/ci-config.yml
@@ -96,37 +96,6 @@ jobs:
       - name: Build the code with Maven
         run: mvn -B -ntp verify -Pwebsite javadoc:javadoc
 
-  dependencies:
-    name: Dependency Check
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        java: [ 17 ]
-
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Set up JDK ${{ matrix.java }}
-        uses: actions/setup-java@v5
-        with:
-          distribution: 'temurin'
-          java-version: ${{ matrix.java }}
-          cache: 'maven'
-
-      - name: Generate Cache Name
-        shell: bash
-        run: echo "CACHE_NAME=$(date '+%y.%j')" >> $GITHUB_ENV
-
-      - name: Restore NVD data cache
-        uses: actions/cache@v5
-        with:
-          key: nvd-data-${{ env.CACHE_NAME }}
-          restore-keys: nvd-data-
-          path: ./data/cache
-
-      - name: Verify dependencies
-        run: mvn -B -ntp verify -Pdependencies -Dnvd.api.datafeed="file:${GITHUB_WORKSPACE}/data/cache/nvdcve-{0}.json.gz"
-
   sonar:
     name: Sonar Scan
     runs-on: ubuntu-latest
diff --git a/.github/workflows/nvd-cache.yml b/.github/workflows/nvd-cache.yml
deleted file mode 100644
index 5167d55512..0000000000
--- a/.github/workflows/nvd-cache.yml
+++ /dev/null
@@ -1,55 +0,0 @@
-name: NVD Data Workflow Schedule
-
-on:
-  schedule:
-    - cron: '0 5 * * 1,2,3,4,5'
-  workflow_dispatch: { }
-
-jobs:
-  build:
-    name: Build and collect data
-    runs-on: ubuntu-latest
-    if: ${{ github.actor != 'dependabot[bot]' }}
-
-    steps:
-    - name: Checkout OVP repository
-      uses: actions/checkout@v6
-      with:
-        repository: jeremylong/Open-Vulnerability-Project
-        path: ovp
-        ref: v7.0.2
-
-    - name: Set up JDK 17
-      uses: actions/setup-java@v5
-      with:
-        distribution: 'temurin'
-        java-version: 17
-        cache: 'gradle'
-
-    - name: Build the OVP code with Gradle
-      working-directory: ./ovp
-      run: ./gradlew build -x test
-
-    - uses: actions/checkout@v6
-      with:
-        path: data
-
-    - name: Generate Cache Name
-      shell: bash
-      run: echo "CACHE_NAME=$(date '+%y.%j')" >> $GITHUB_ENV
-
-    - name: Rename artifact
-      run: find ./ovp/vulnz/build/libs -type f -regex './ovp/vulnz/build/libs/vulnz-[0-9].[0-9].[0-9].jar' -exec mv {} ./data/vulnz.jar ';'
-
-    - name: Generate data
-      working-directory: ./data
-      run: ./vulnz.jar cve --cache --directory ./cache --delay=10000 --maxRetry=20
-      env:
-        NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
-        JAVA_OPTS: "-Xmx4g"
-
-    - name: Cache NVD data
-      uses: actions/cache@v5
-      with:
-        key: nvd-data-${{ env.CACHE_NAME }}
-        path: ./data/cache
diff --git a/build-tools/owasp/suppressions.xml b/build-tools/owasp/suppressions.xml
deleted file mode 100644
index 1ab819bc29..0000000000
--- a/build-tools/owasp/suppressions.xml
+++ /dev/null
@@ -1,66 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
-  <!-- False positive matches of non-dependencies. These do not need monthly review. -->
-  <suppress>
-    <notes><![CDATA[
-        This suppresses a false positive CPE match
-    ]]></notes>
-    <packageUrl regex="true">^pkg:maven/com\.inrupt\.client/inrupt\-client\-openid@.*$</packageUrl>
-    <cpe>cpe:/a:openid:openid</cpe>
-  </suppress>
-  <suppress>
-    <notes><![CDATA[
-        This suppresses a false positive CPE match
-    ]]></notes>
-    <packageUrl regex="true">^pkg:maven/org\.roaringbitmap/RoaringBitmap@.*$</packageUrl>
-    <cpe>cpe:/a:bitmap_project:bitmap</cpe>
-  </suppress>
-  <suppress>
-    <notes><![CDATA[
-        The json-java artifact is not a dependency of this project.
-    ]]></notes>
-    <packageUrl regex="true">^pkg:maven/(com\.inrupt\.client/inrupt\-client\-jsonb|com\.github\.jsonld\-java/jsonld\-java|net\.javacrumbs\.json\-unit/json\-unit\-core)@.*$</packageUrl>
-    <cve>CVE-2023-5072</cve>
-  </suppress>
-  <suppress>
-    <notes><![CDATA[
-        The json-java artifact is not a dependency of this project.
-    ]]></notes>
-    <packageUrl regex="true">^pkg:maven/(com\.inrupt\.client/inrupt\-client\-jsonb|com\.github\.jsonld\-java/jsonld\-java|net\.javacrumbs\.json\-unit/json\-unit\-core)@.*$</packageUrl>
-    <cve>CVE-2022-45688</cve>
-  </suppress>
-
-  <!-- Suppressed vulnerabilities. These need monthly review. -->
-  <suppress until="2025-11-10Z">
-    <notes><![CDATA[
-        This vulnerability affects a transitive dependency of the test module but is not relevant
-        for how it is used in the context of the Java Client Libraries.
-    ]]></notes>
-    <packageUrl regex="true">^pkg:maven/net\.minidev/json-smart@.*$</packageUrl>
-    <vulnerabilityName>CVE-2024-57699</vulnerabilityName>
-  </suppress>
-  <suppress until="2025-11-10Z">
-    <notes><![CDATA[
-        This vulnerability affects a transitive dependency of the test module but is not relevant
-        for how it is used in the context of the Java Client Libraries.
-    ]]></notes>
-    <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.http2/http2-common@.*$</packageUrl>
-    <cve>CVE-2024-6763</cve>
-  </suppress>
-  <suppress until="2025-11-10Z">
-    <notes><![CDATA[
-        This vulnerability affects a transitive dependency of the test module but is not relevant
-        for how it is used in the context of the Java Client Libraries.
-    ]]></notes>
-    <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.http2/http2-common@.*$</packageUrl>
-    <cve>CVE-2025-1948</cve>
-  </suppress>
-  <suppress until="2025-11-10Z">
-    <notes><![CDATA[
-        This vulnerability affects a transitive dependency of the test module but is not relevant
-        for how it is used in the context of the Java Client Libraries.
-    ]]></notes>
-    <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.http2/http2-common@.*$</packageUrl>
-    <cve>CVE-2025-5115</cve>
-  </suppress>
-</suppressions>
diff --git a/pom.xml b/pom.xml
index 6c4eb980a6..14268c05cc 100644
--- a/pom.xml
+++ b/pom.xml
@@ -56,7 +56,6 @@
     <jar.plugin.version>3.5.0</jar.plugin.version>
     <javadoc.plugin.version>3.12.0</javadoc.plugin.version>
     <license.plugin.version>5.0.0</license.plugin.version>
-    <owasp.plugin.version>12.2.0</owasp.plugin.version>
     <projectinfo.plugin.version>3.9.0</projectinfo.plugin.version>
     <pmd.plugin.version>3.28.0</pmd.plugin.version>
     <site.plugin.version>3.21.0</site.plugin.version>
@@ -81,10 +80,7 @@
     <wiremock.version>3.13.2</wiremock.version>
 
     <!-- disable by default (enabled by profile in CI) -->
-    <dependency-check.skip>true</dependency-check.skip>
     <archetype.test.skip>true</archetype.test.skip>
-    <nvd.api.key />
-    <nvd.api.datafeed />
 
     <!-- sonar -->
     <sonar.coverage.jacoco.xmlReportPaths>${maven.multiModuleProjectDirectory}/reports/target/site/jacoco-merged/jacoco.xml</sonar.coverage.jacoco.xmlReportPaths>
@@ -510,11 +506,6 @@
             </execution>
           </executions>
         </plugin>
-        <plugin>
-          <groupId>org.owasp</groupId>
-          <artifactId>dependency-check-maven</artifactId>
-          <version>${owasp.plugin.version}</version>
-        </plugin>
       </plugins>
     </pluginManagement>
 
@@ -615,31 +606,6 @@
           </execution>
         </executions>
       </plugin>
-      <plugin>
-        <groupId>org.owasp</groupId>
-        <artifactId>dependency-check-maven</artifactId>
-        <executions>
-          <execution>
-            <goals>
-              <goal>check</goal>
-            </goals>
-          </execution>
-        </executions>
-        <configuration>
-          <failBuildOnCVSS>7</failBuildOnCVSS>
-          <ossIndexWarnOnlyOnRemoteErrors>true</ossIndexWarnOnlyOnRemoteErrors>
-          <formats>
-            <format>HTML</format>
-            <format>JSON</format>
-            <format>CSV</format>
-          </formats>
-          <suppressionFile>
-              ./build-tools/owasp/suppressions.xml
-          </suppressionFile>
-          <nvdApiKey>${nvd.api.key}</nvdApiKey>
-          <nvdDatafeedUrl>${nvd.api.datafeed}</nvdDatafeedUrl>
-        </configuration>
-      </plugin>
       <plugin>
         <groupId>org.sonatype.central</groupId>
         <artifactId>central-publishing-maven-plugin</artifactId>
@@ -747,23 +713,6 @@
           </reportSet>
         </reportSets>
       </plugin>
-      <plugin>
-        <groupId>org.owasp</groupId>
-        <artifactId>dependency-check-maven</artifactId>
-        <version>${owasp.plugin.version}</version>
-        <reportSets>
-          <reportSet>
-            <reports>
-              <report>aggregate</report>
-            </reports>
-          </reportSet>
-        </reportSets>
-        <configuration>
-          <suppressionFiles>
-            <suppressionFile>./build-tools/owasp/suppressions.xml</suppressionFile>
-          </suppressionFiles>
-        </configuration>
-      </plugin>
     </plugins>
   </reporting>
 
@@ -838,18 +787,6 @@
         <archetype.test.skip>true</archetype.test.skip>
       </properties>
     </profile>
-    <profile>
-      <id>dependencies</id>
-      <properties>
-        <skipTests>true</skipTests>
-        <pmd.skip>true</pmd.skip>
-        <cpd.skip>true</cpd.skip>
-        <dependency-check.skip>false</dependency-check.skip>
-        <jacoco.skip>true</jacoco.skip>
-        <checkstyle.skip>true</checkstyle.skip>
-        <archetype.test.skip>true</archetype.test.skip>
-      </properties>
-    </profile>
     <profile>
       <id>java-21</id>
       <activation>

From a51a3fec49174aaad3ca841fe10c1804f65efdb6 Mon Sep 17 00:00:00 2001
From: Aaron Coburn <aaronc@inrupt.com>
Date: Mon, 6 Apr 2026 13:36:53 -0500
Subject: [PATCH 3/4] Additional owasp reference

---
 examples/pom.xml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/examples/pom.xml b/examples/pom.xml
index 198883c608..a709e3b16d 100644
--- a/examples/pom.xml
+++ b/examples/pom.xml
@@ -16,14 +16,6 @@
 
   <build>
     <plugins>
-      <plugin>
-        <groupId>org.owasp</groupId>
-        <artifactId>dependency-check-maven</artifactId>
-        <version>${owasp.plugin.version}</version>
-        <configuration>
-          <skip>true</skip>
-        </configuration>
-      </plugin>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-deploy-plugin</artifactId>

From 1b68e110030698f5a37a9b4fdc50dc25fab686eb Mon Sep 17 00:00:00 2001
From: Aaron Coburn <aaronc@inrupt.com>
Date: Mon, 6 Apr 2026 13:42:37 -0500
Subject: [PATCH 4/4] Remove owasp reference

---
 archetypes/pom.xml | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/archetypes/pom.xml b/archetypes/pom.xml
index d07b1d5634..2232d65ed0 100644
--- a/archetypes/pom.xml
+++ b/archetypes/pom.xml
@@ -17,16 +17,4 @@
   <modules>
     <module>java</module>
   </modules>
-
-  <build>
-    <plugins>
-      <plugin>
-        <groupId>org.owasp</groupId>
-        <artifactId>dependency-check-maven</artifactId>
-        <configuration>
-          <skip>true</skip>
-        </configuration>
-      </plugin>
-    </plugins>
-  </build>
 </project>