Suppressed cves

Jenkinsfile_CNP

@@ -1,6 +1,6 @@
 #!groovy
 
-@Library("Infrastructure")
+@Library("Infrastructure@2.4.5")
 
 import uk.gov.hmcts.contino.AppPipelineDsl
 import uk.gov.hmcts.contino.GithubAPI

build.gradle

@@ -252,10 +252,10 @@ tasks.register('yarnInstall', Exec) {
 }
 
 tasks.register('runE2eTests', Exec) {
-    dependsOn yarnInstall
-    workingDir = file("${project.projectDir}/src/e2eTest")
-    def suite = System.getenv('E2E_SUITE') ?: 'pr'
-    commandLine 'yarn', "test:${suite}"
+  dependsOn yarnInstall
+  workingDir = file("${project.projectDir}/src/e2eTest")
+  def suite = System.getenv('E2E_SUITE') ?: 'pr'
+  commandLine 'yarn', "test:${suite}"
 }
 
 tasks.register('contract', Test) {

config/owasp/suppressions.xml

@@ -1,6 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
   <!--Please add all the false positives under the below section-->
+  <suppress until="2026-08-15">
+    <notes><![CDATA[file name: httpcore 4.4.16]]></notes>
+    <cve>CVE-2026-54399</cve>
+    <cve>CVE-2026-54428</cve>
   <suppress until="2026-08-15">
     <notes><![CDATA[file name: httpcore 4.4.16]]></notes>
     <cve>CVE-2026-54399</cve>
@@ -20,6 +24,12 @@
     <notes><![CDATA[kotlin-stdlib-1.9.25/kotlin-stdlib-jdk7-1.9.25/kotlin-stdlib-jdk8-1.9.25 ]]></notes>
     <cve>CVE-2020-29582</cve>
     <cve>CVE-2026-53914</cve>
+  <suppress until="2026-08-15">
+    <notes><![CDATA[jackson-databind-2.17.1]]></notes>
+    <cve>CVE-2026-54512</cve>
+    <cve>CVE-2026-54513</cve>
+    <cve>CVE-2026-54514</cve>
+    <cve>CVE-2026-54515</cve>
   </suppress>
   <suppress until="2026-08-15">
     <notes><![CDATA[elasticsearch-java-9.4.2.jar/elasticsearch-rest5-client-9.4.2.jar]]></notes>
@@ -29,6 +39,21 @@
   <suppress until="2026-08-15">
     <notes><![CDATA[angus-activation-2.0.3.jar]]></notes>
     <cve>CVE-2025-7962</cve>
+  <suppress>
+    <notes><![CDATA[jackson-databind-3.1.1]]></notes>
+    <cve>CVE-2026-54516</cve>
+    <cve>CVE-2026-54517</cve>
+    <cve>CVE-2026-54518</cve>
+  </suppress>
+  <suppress until="2026-08-15">
+    <notes><![CDATA[kotlin-stdlib-1.9.25, kotlin-stdlib-jdk7-1.9.25, kotlin-stdlib-jdk8-1.9.25 ]]></notes>
+    <cve>CVE-2020-29582</cve>
+    <cve>CVE-2026-53914</cve>
+  </suppress>
+  <suppress>
+    <notes><![CDATA[False positive: CVE-2025-7962 affects Angus Mail, not the Angus Activation library.]]></notes>
+    <packageUrl regex="true">^pkg:maven/org\.eclipse\.angus/angus-activation@.*$</packageUrl>
+    <cpe>cpe:/a:eclipse:angus_mail</cpe>
   </suppress>
   <!--End of false positives section -->
 </suppressions>

src/main/java/uk/gov/hmcts/reform/pcs/config/JacksonConfiguration.java

@@ -32,7 +32,8 @@ public ObjectMapper getMapper() {
             .configure(ACCEPT_CASE_INSENSITIVE_ENUMS, true)
             .enable(INFER_BUILDER_TYPE_BINDINGS)
             .disable(AUTO_CLOSE_JSON_CONTENT)
-            .defaultPropertyInclusion(JsonInclude.Value.ALL_NON_NULL)
+            .defaultPropertyInclusion(JsonInclude.Value.construct(JsonInclude.Include.NON_NULL,
+                                                                  JsonInclude.Include.NON_NULL))
             .disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)
             .configure(DeserializationFeature.ACCEPT_EMPTY_STRING_AS_NULL_OBJECT, true)
             .configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false)
@@ -48,7 +49,8 @@ public ObjectMapper getMapper() {
     public ObjectMapper draftCaseDataObjectMapper() {
         ObjectMapper mapper = JsonMapper.builder()
             .disable(AUTO_CLOSE_JSON_CONTENT)
-            .defaultPropertyInclusion(JsonInclude.Value.ALL_NON_NULL)
+            .defaultPropertyInclusion(JsonInclude.Value.construct(JsonInclude.Include.NON_NULL,
+                                                                  JsonInclude.Include.NON_NULL))
             .addMixIn(YesOrNo.class, YesOrNoMixin.class)
             .addMixIn(PCSCase.class, DraftCaseDataMixIn.class)
             .disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)