diff --git a/.trivyignore b/.trivyignore
index f4b7512e4..9fb1f05e4 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -53,3 +53,11 @@ CVE-2026-66046 exp:2026-12-02
 # binding; runs java -jar
 # See: UID2-7801
 CVE-2026-76641 exp:2026-12-02
+
+# libexpat is an Alpine OS package; this is a Java/Vert.x service that parses XML via JAXP/Xerces, not libexpat — no native/JNI path reaches it
+# See: UID2-7849
+CVE-2026-76956 exp:2026-10-10
+
+# libexpat is an Alpine OS package; this is a Java/Vert.x service that parses XML via JAXP/Xerces, not libexpat — no native/JNI path reaches it
+# See: UID2-7849
+CVE-2026-76957 exp:2026-10-10
diff --git a/pom.xml b/pom.xml
index 5ea519973..26fea1f7c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -28,7 +28,7 @@
         <maven.compiler.source>21</maven.compiler.source>
         <maven.compiler.target>21</maven.compiler.target>
         <java.version>21</java.version>
-        <netty.version>4.1.136.Final</netty.version>
+        <netty.version>4.1.137.Final</netty.version>
         <jackson.version>2.21.4</jackson.version>
     </properties>