From 072783b60ca0a1943aeca42752d9eb5c8ca0f343 Mon Sep 17 00:00:00 2001
From: Sean Arms <67096+lesserwhirls@users.noreply.github.com>
Date: Tue, 21 Jul 2026 10:29:18 -0600
Subject: [PATCH] Update dependencies

---
 gradle/ncj.libs.versions.toml                 |  4 ++--
 .../dependency-check-suppression.xml          | 20 +++++++++++++++++++
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/gradle/ncj.libs.versions.toml b/gradle/ncj.libs.versions.toml
index ae0f0dd338..3b478b3ca5 100644
--- a/gradle/ncj.libs.versions.toml
+++ b/gradle/ncj.libs.versions.toml
@@ -4,14 +4,14 @@ netcdf-java = "5.11.0-SNAPSHOT"
 unidata-doc-theme = "0.1.1"
 
 # 3rd party dependencies
-awssdk = "2.46.17"
+awssdk = "2.48.4"
 awssdkv1 = "1.12.797"
 commons-math3 = "3.6.1"
 bounce = "0.18"
 grpc = "1.82.1"
 guava = "33.6.0-jre"
 httpcomponents = "4.5.14"
-jackson = "2.22.0"
+jackson = "2.22.1"
 jcommander = "1.82"
 jdom2 = "2.0.6.1"
 jfree-jcommon = "1.0.24"
diff --git a/project-files/owasp-dependency-check/dependency-check-suppression.xml b/project-files/owasp-dependency-check/dependency-check-suppression.xml
index 550aa5617f..d3e6d3d346 100644
--- a/project-files/owasp-dependency-check/dependency-check-suppression.xml
+++ b/project-files/owasp-dependency-check/dependency-check-suppression.xml
@@ -34,4 +34,24 @@
     <vulnerabilityName>CVE-2024-22949</vulnerabilityName>
     <vulnerabilityName>CVE-2023-52070</vulnerabilityName>
   </suppress>
+  <suppress>
+    <notes><![CDATA[
+      file name: httpcore-4.4.16.jar
+      reason: CVE-2026-54399, CVE-2026-54428 are only valid for org.apache.httpcomponents.core5:httpcore5,
+      not org.apache.httpcomponents:httpcore
+    ]]></notes>
+    <packageUrl regex="true">^pkg:maven/org\.apache\.httpcomponents/httpcore@.*$</packageUrl>
+    <cve>CVE-2026-54399</cve>
+    <cve>CVE-2026-54428</cve>
+  </suppress>
+  <suppress>
+    <notes><![CDATA[
+      file name: httpcore5-h2-5.4.jar
+      reason: CVE-2026-54399, CVE-2026-54428 are only valid for org.apache.httpcomponents.core5:httpcore5,
+      not org.apache.httpcomponents.core5:httpcore5-h2
+    ]]></notes>
+    <packageUrl regex="true">^pkg:maven/org\.apache\.httpcomponents\.core5/httpcore5-h2@.*$</packageUrl>
+    <cve>CVE-2026-54399</cve>
+    <cve>CVE-2026-54428</cve>
+  </suppress>
 </suppressions>