Removed suppressions

* added scan workflow
* added cisa to workflows

.github/workflows/build-dev-release.yml

@@ -14,4 +14,7 @@ jobs:
       sonatypePassword: ${{ secrets.SONATYPE_NEXUS_PASSWORD }}
       sonatypeSigningKey: ${{ secrets.SONATYPE_GPG_ARMORED_KEY }}
       sonatypeSigningPassword: ${{ secrets.SONATYPE_SIGNING_PASSWORD }}
-      nvd-api-key: ${{ secrets.NVD_APIKEY }}
+      nvd-api-key: ${{ secrets.NVD_APIKEY }}
+      cisa-domain: ${{ secrets.CISA_DOMAIN }}
+      cisa-user: ${{ secrets.CISA_USER }}
+      cisa-password: ${{ secrets.CISA_PWD }}

.github/workflows/build-release.yml

@@ -14,4 +14,7 @@ jobs:
       sonatypePassword: ${{ secrets.SONATYPE_NEXUS_PASSWORD }}
       sonatypeSigningKey: ${{ secrets.SONATYPE_GPG_ARMORED_KEY }}
       sonatypeSigningPassword: ${{ secrets.SONATYPE_SIGNING_PASSWORD }}
-      nvd-api-key: ${{ secrets.NVD_APIKEY }}
+      nvd-api-key: ${{ secrets.NVD_APIKEY }}
+      cisa-domain: ${{ secrets.CISA_DOMAIN }}
+      cisa-user: ${{ secrets.CISA_USER }}
+      cisa-password: ${{ secrets.CISA_PWD }}

.github/workflows/build-sanpshot.yml

@@ -5,7 +5,6 @@ on:
     branches-ignore:
       - master
       - version-*
-      - dependabot*
     paths-ignore:
       - README.md
 
@@ -19,4 +18,7 @@ jobs:
       sonatypePassword: ${{ secrets.SONATYPE_NEXUS_PASSWORD }}
       sonatypeSigningKey: ${{ secrets.SONATYPE_GPG_ARMORED_KEY }}
       sonatypeSigningPassword: ${{ secrets.SONATYPE_SIGNING_PASSWORD }}
-      nvd-api-key: ${{ secrets.NVD_APIKEY }}
+      nvd-api-key: ${{ secrets.NVD_APIKEY }}
+      cisa-domain: ${{ secrets.CISA_DOMAIN }}
+      cisa-user: ${{ secrets.CISA_USER }}
+      cisa-password: ${{ secrets.CISA_PWD }}

.github/workflows/scan.yml

@@ -0,0 +1,15 @@
+name: Scan licenses and vulnerabilities in java project
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 0 * * 1'
+
+jobs:
+  build:
+    uses: th2-net/.github/.github/workflows/compound-java-scan.yml@main
+    secrets:
+      nvd-api-key: ${{ secrets.NVD_APIKEY }}
+      cisa-domain: ${{ secrets.CISA_DOMAIN }}
+      cisa-user: ${{ secrets.CISA_USER }}
+      cisa-password: ${{ secrets.CISA_PWD }}

README.md

@@ -77,10 +77,7 @@ protobuf {
 ### 3.8.0
 
 * Updated libs:
-  * bom: `4.10.0`
-    * Added suppressions:
-      * CVE-2025-25193 - This vulnerability does not affect us because this library don’t use netty for reading environment files.
-      * CVE-2025-24970 - this library doesn’t use SSL.
+  * bom: `4.11.0`
 * Updated plugins:
   * org.owasp.dependencycheck: `12.1.0`
 

suppressions.xml

@@ -1,14 +1,3 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!-- FIXME: find out approach to solve problem when any artifact with grpc word in name is marked as cpe:/a:grpc:grpc -->
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
-    <suppress>
-        <notes><![CDATA[file name: netty-common-4.1.117.Final.jar]]></notes>
-        <packageUrl regex="true">^pkg:maven/io\.netty/netty-common@.*$</packageUrl>
-        <vulnerabilityName>CVE-2025-25193</vulnerabilityName>
-    </suppress>
-    <suppress>
-        <notes><![CDATA[file name: netty-handler-4.1.117.Final.jar]]></notes>
-        <packageUrl regex="true">^pkg:maven/io\.netty/netty-handler@.*$</packageUrl>
-        <vulnerabilityName>CVE-2025-24970</vulnerabilityName>
-    </suppress>
 </suppressions>