From 9d5db68cfee16671ec3b1f6b00a5fd652deade3a Mon Sep 17 00:00:00 2001
From: Chad Wilson <29788154+chadlwilson@users.noreply.github.com>
Date: Fri, 12 Jun 2026 12:36:15 +0800
Subject: [PATCH] fix(fp): consolidate suppressions for Eclipse/Oracle
 Glassfish server

Extends the hand-curated suppression to suppress for all Maven artifacts except those in `org.glassfish.main` or `org.glassfish.core`
(rather than only suppressing for `org.glasshfish.xyz`, and not suppression other Java artifacts under other groups).

Signed-off-by: Chad Wilson <29788154+chadlwilson@users.noreply.github.com>
---
 generatedSuppressions.xml | 31 ++++++++-----------------------
 1 file changed, 8 insertions(+), 23 deletions(-)

diff --git a/generatedSuppressions.xml b/generatedSuppressions.xml
index 5db97b236f..e6bca1dd1d 100644
--- a/generatedSuppressions.xml
+++ b/generatedSuppressions.xml
@@ -947,10 +947,15 @@
 </suppress>
 <suppress base="true">
     <notes><![CDATA[
-    hand-curated better suppression for FP per issues #6626, #7015, #7019, #7020, #7021, #7022
+    hand-curated better suppression for FP per issues #6626, #7015, #7019, #7020, #7021, #7022, #7028, #7034, #8374, #8588
+    >= 4.x - .main: published and versioned together under here
+    < 4.x  - .core: published and versioned together under .core and other adjacent groups, simplified here to just .core
+                    since this is 2011-era code likely to catch everything for NVD-only CVEs predating PURL and not maintained at package level.
     ]]></notes>
-    <packageUrl regex="true">^pkg:maven/org\.glassfish(?!\.main).*$</packageUrl>
+    <packageUrl regex="true">^pkg:maven/(?!org\.glassfish\.(main|core)).*$</packageUrl>
     <cpe regex="true">cpe:/a:eclipse:glassfish(:.*)?$</cpe>
+    <cpe regex="true">cpe:/a:oracle:glassfish(:.*)?$</cpe>
+    <cpe regex="true">cpe:/a:oracle:glassfish_server(:.*)?$</cpe>
 </suppress>
 <suppress base="true">
     <notes><![CDATA[
@@ -1163,20 +1168,7 @@
     <packageUrl regex="true">^pkg:maven/fi\.solita\.clamav/clamav-client@.*$</packageUrl>
     <cpe regex="true">cpe:/a:clamav:clamav(:.*)?$</cpe>
 </suppress>
-<suppress base="true">
-    <notes><![CDATA[
-    FP per issue #7034
-    ]]></notes>
-    <packageUrl regex="true">^pkg:maven/jakarta\.json/jakarta\.json-api@.*$</packageUrl>
-    <cpe regex="true">cpe:/a:eclipse:glassfish(:.*)?$</cpe>
-</suppress>
-<suppress base="true">
-    <notes><![CDATA[
-    FP per issue #7028
-    ]]></notes>
-    <packageUrl regex="true">^pkg:maven/org\.glassfish\.jaxb/jaxb-runtime@.*$</packageUrl>
-    <cpe regex="true">cpe:/a:eclipse:glassfish(:.*)?$</cpe>
-</suppress>
+
 <suppress base="true">
     <notes><![CDATA[
     FP per issue #7026
@@ -1966,13 +1958,6 @@
     <packageUrl regex="true">^pkg:maven/org\.springframework\.boot/spring-boot-batch@.*$</packageUrl>
     <cpe regex="true">cpe:/a:pivotal_software:spring_batch(:.*)?$</cpe>
 </suppress>
-<suppress base="true">
-    <notes><![CDATA[
-    FP per issue #8374
-    ]]></notes>
-    <packageUrl regex="true">^pkg:maven/com\.sun\.xml\.bind/jaxb-impl@.*$</packageUrl>
-    <cpe regex="true">cpe:/a:eclipse:glassfish(:.*)?$</cpe>
-</suppress>
 <suppress base="true">
     <notes><![CDATA[
     FP per issue #8395