Merge pull request #1587 from lesserwhirls/deps

Update dependencies

Author: lesserwhirls

gradle/ncj.libs.versions.toml

@@ -4,14 +4,14 @@ netcdf-java = "5.11.0-SNAPSHOT"
 unidata-doc-theme = "0.1.1"
 
 # 3rd party dependencies
-awssdk = "2.46.17"
+awssdk = "2.48.4"
 awssdkv1 = "1.12.797"
 commons-math3 = "3.6.1"
 bounce = "0.18"
 grpc = "1.82.1"
 guava = "33.6.0-jre"
 httpcomponents = "4.5.14"
-jackson = "2.22.0"
+jackson = "2.22.1"
 jcommander = "1.82"
 jdom2 = "2.0.6.1"
 jfree-jcommon = "1.0.24"

project-files/owasp-dependency-check/dependency-check-suppression.xml

@@ -34,4 +34,24 @@
     <vulnerabilityName>CVE-2024-22949</vulnerabilityName>
     <vulnerabilityName>CVE-2023-52070</vulnerabilityName>
   </suppress>
+  <suppress>
+    <notes><![CDATA[
+      file name: httpcore-4.4.16.jar
+      reason: CVE-2026-54399, CVE-2026-54428 are only valid for org.apache.httpcomponents.core5:httpcore5,
+      not org.apache.httpcomponents:httpcore
+    ]]></notes>
+    <packageUrl regex="true">^pkg:maven/org\.apache\.httpcomponents/httpcore@.*$</packageUrl>
+    <cve>CVE-2026-54399</cve>
+    <cve>CVE-2026-54428</cve>
+  </suppress>
+  <suppress>
+    <notes><![CDATA[
+      file name: httpcore5-h2-5.4.jar
+      reason: CVE-2026-54399, CVE-2026-54428 are only valid for org.apache.httpcomponents.core5:httpcore5,
+      not org.apache.httpcomponents.core5:httpcore5-h2
+    ]]></notes>
+    <packageUrl regex="true">^pkg:maven/org\.apache\.httpcomponents\.core5/httpcore5-h2@.*$</packageUrl>
+    <cve>CVE-2026-54399</cve>
+    <cve>CVE-2026-54428</cve>
+  </suppress>
 </suppressions>