From 6b04722b29c2fae72f9deb17249eec4835ccdb58 Mon Sep 17 00:00:00 2001
From: labkey-tchad <tchad@labkey.com>
Date: Wed, 12 Aug 2026 13:13:24 -0700
Subject: [PATCH 1/4] Update tika

---
 gradle.properties | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/gradle.properties b/gradle.properties
index b1007a2d38..7c49a878e1 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -103,7 +103,7 @@ apacheTomcatVersion=11.0.24
 # (mothership) -> json-path -> json-smart -> accessor-smart
 # (core) -> graalvm
 # tika
-asmVersion=9.10
+asmVersion=9.10.1
 
 awsSdkVersion=2.29.50
 
@@ -114,8 +114,8 @@ azureIdentityVersion=1.18.4
 batikVersion=1.19
 
 # sync with Tika version (or later)
-bouncycastlePgpVersion=1.84
-bouncycastleVersion=1.84
+bouncycastlePgpVersion=1.85
+bouncycastleVersion=1.85
 
 cglibNodepVersion=2.2.3
 
@@ -272,7 +272,7 @@ opencsvVersion=2.3
 openTracingVersion=0.33.0
 
 # sync with version Tika ships
-pdfboxVersion=3.0.7
+pdfboxVersion=3.0.8
 
 # sync with version Tika ships
 poiVersion=5.5.1

From 048ea8d23d8ba72ed99b6543049bd4c8000cdc9a Mon Sep 17 00:00:00 2001
From: labkey-tchad <tchad@labkey.com>
Date: Wed, 12 Aug 2026 13:19:40 -0700
Subject: [PATCH 2/4] Actually update tika

---
 gradle.properties | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gradle.properties b/gradle.properties
index 7c49a878e1..6eb3bde09b 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -315,7 +315,7 @@ stax2ApiVersion=4.2.2
 thumbnailatorVersion=0.4.21
 
 # used for tika-core in API and tika-parsers in search
-tikaVersion=3.3.1
+tikaVersion=3.3.2
 
 # sync with Tika
 tukaaniXZVersion=1.12

From 22bee3b1a2a9d8cf17a649c4c57680a392d4dcf2 Mon Sep 17 00:00:00 2001
From: labkey-tchad <tchad@labkey.com>
Date: Wed, 12 Aug 2026 13:27:29 -0700
Subject: [PATCH 3/4] Suppress CVE from Tomcat example code

---
 dependencyCheckSuppression.xml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/dependencyCheckSuppression.xml b/dependencyCheckSuppression.xml
index 86150a3244..f366a8a786 100644
--- a/dependencyCheckSuppression.xml
+++ b/dependencyCheckSuppression.xml
@@ -469,4 +469,16 @@
         <packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/.*@.*$</packageUrl>
         <cve>CVE-2026-53914</cve>
     </suppress>
+
+    <!--
+    CVE in example code. New version not yet available.
+    -->
+    <suppress>
+        <notes><![CDATA[
+    file name: tomcat-*-11.0.24.jar
+    ]]></notes>
+        <packageUrl regex="true">^pkg:maven/org\.apache\.tomcat/tomcat-.*@.*$</packageUrl>
+        <cve>CVE-2026-66299</cve>
+    </suppress>
+
 </suppressions>

From 5dca1dc4905383fe264686c2de7f5e92a88f488d Mon Sep 17 00:00:00 2001
From: labkey-tchad <tchad@labkey.com>
Date: Wed, 12 Aug 2026 14:30:37 -0700
Subject: [PATCH 4/4] Suppress for tomcat-embed also

---
 dependencyCheckSuppression.xml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/dependencyCheckSuppression.xml b/dependencyCheckSuppression.xml
index f366a8a786..e8926bd673 100644
--- a/dependencyCheckSuppression.xml
+++ b/dependencyCheckSuppression.xml
@@ -480,5 +480,12 @@
         <packageUrl regex="true">^pkg:maven/org\.apache\.tomcat/tomcat-.*@.*$</packageUrl>
         <cve>CVE-2026-66299</cve>
     </suppress>
+    <suppress>
+        <notes><![CDATA[
+    file name: tomcat-embed-*-11.0.24.jar
+    ]]></notes>
+        <packageUrl regex="true">^pkg:maven/org\.apache\.tomcat\.embed/tomcat-embed-.*@.*$</packageUrl>
+        <cve>CVE-2026-66299</cve>
+    </suppress>
 
 </suppressions>