From b95162bb04e09c7faa0676e22ef2c2b83f879930 Mon Sep 17 00:00:00 2001
From: Matt Collins <matt.collins@thetradedesk.com>
Date: Thu, 10 Sep 2026 01:37:36 +0000
Subject: [PATCH] UID2-7849 UID2-7850: Suppress libexpat CVEs, upgrade
 netty-handler to 4.1.137.Final

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .trivyignore | 8 ++++++++
 pom.xml      | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/.trivyignore b/.trivyignore
index f4b7512e4..9fb1f05e4 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -53,3 +53,11 @@ CVE-2026-66046 exp:2026-12-02
 # binding; runs java -jar
 # See: UID2-7801
 CVE-2026-76641 exp:2026-12-02
+
+# libexpat is an Alpine OS package; this is a Java/Vert.x service that parses XML via JAXP/Xerces, not libexpat — no native/JNI path reaches it
+# See: UID2-7849
+CVE-2026-76956 exp:2026-10-10
+
+# libexpat is an Alpine OS package; this is a Java/Vert.x service that parses XML via JAXP/Xerces, not libexpat — no native/JNI path reaches it
+# See: UID2-7849
+CVE-2026-76957 exp:2026-10-10
diff --git a/pom.xml b/pom.xml
index 5ea519973..26fea1f7c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -28,7 +28,7 @@
         <maven.compiler.source>21</maven.compiler.source>
         <maven.compiler.target>21</maven.compiler.target>
         <java.version>21</java.version>
-        <netty.version>4.1.136.Final</netty.version>
+        <netty.version>4.1.137.Final</netty.version>
         <jackson.version>2.21.4</jackson.version>
     </properties>