UID2-7849 UID2-7850: Suppress libexpat CVEs, upgrade netty-handler to 4.1.137.Final (#431)

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: mcollins-ttd

.trivyignore

@@ -43,3 +43,16 @@ CVE-2026-66046 exp:2026-12-02
 # usage; no loadLibrary/JNI in source
 # See: UID2-7801
 CVE-2026-76641 exp:2026-12-02
+
+# CVE-2026-76956 — libexpat (Alpine base-image OS library) (HIGH), DoS via hash flooding
+# attack with crafted XML.
+# Not exploitable here: this is a Java/Vert.x service that parses XML via JAXP/Xerces, not
+# libexpat; no JNI/native/subprocess path reaches it.
+# See: UID2-7849
+CVE-2026-76956 exp:2026-10-10
+
+# CVE-2026-76957 — libexpat (Alpine base-image OS library) (HIGH), memory corruption allowing
+# arbitrary code execution or DoS.
+# Not exploitable here: same reasoning as CVE-2026-76956 above.
+# See: UID2-7849
+CVE-2026-76957 exp:2026-10-10

pom.xml

@@ -25,7 +25,7 @@
         <launcher.class>io.vertx.core.Launcher</launcher.class>
 
         <uid2-shared.version>11.6.0</uid2-shared.version>
-        <netty.version>4.1.136.Final</netty.version>
+        <netty.version>4.1.137.Final</netty.version>
         <jackson.version>2.21.4</jackson.version>
         <image.version>${project.version}</image.version>
     </properties>