From e2daa6bbcad1fe0ee0e4c34e6b41e62939c38ee8 Mon Sep 17 00:00:00 2001
From: Adam Rauch <adam@labkey.com>
Date: Thu, 11 Dec 2025 11:30:59 -0800
Subject: [PATCH] Suppress Rhino complaint for now (#1233)

---
 dependencyCheckSuppression.xml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/dependencyCheckSuppression.xml b/dependencyCheckSuppression.xml
index 423ec9f23d..199d8ab5db 100644
--- a/dependencyCheckSuppression.xml
+++ b/dependencyCheckSuppression.xml
@@ -248,4 +248,16 @@
        <packageUrl regex="true">^pkg:maven/com\.google\.code\.gson/gson@.*$</packageUrl>
        <vulnerabilityName>CVE-2025-53864</vulnerabilityName>
     </suppress>
+    
+    <!--
+    Rhino 1.7R3 is getting flagged with a potential DoS issue when toFixed() is called on very small floating point numbers.
+    Upgrading to a fixed version is not trivial. See https://github.com/LabKey/internal-issues/issues/724 for details.
+    -->
+    <suppress>
+       <notes><![CDATA[
+       file name: rhino-1.7R3.jar
+       ]]></notes>
+       <packageUrl regex="true">^pkg:maven/org\.mozilla/rhino@.*$</packageUrl>
+       <vulnerabilityName>CVE-2025-66453</vulnerabilityName>
+    </suppress>
 </suppressions>