Merge branch 'cassandra-3.0' into cassandra-3.11

.build/build-owasp.xml

@@ -17,7 +17,7 @@
   ~ limitations under the License.
   -->
 <project basedir="." name="apache-cassandra-owasp-tasks">
-    <property name="dependency-check.version" value="6.3.2"/>
+    <property name="dependency-check.version" value="8.3.1"/>
     <property name="dependency-check.home" value="${build.dir}/dependency-check-ant-${dependency-check.version}"/>
 
     <condition property="is.dependency.check.jar">

.build/dependency-check-suppressions.xml

@@ -117,6 +117,14 @@
         <cve>CVE-2018-11798</cve>
         <cve>CVE-2019-0205</cve>
     </suppress>
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/com\.thinkaurelius\.thrift/thrift-server@.*$</packageUrl>
+        <cve>CVE-2015-3254</cve>
+        <cve>CVE-2016-5397</cve>
+        <cve>CVE-2018-1320</cve>
+        <cve>CVE-2018-11798</cve>
+        <cve>CVE-2019-0205</cve>
+    </suppress>
 
     <!-- https://issues.apache.org/jira/browse/CASSANDRA-17966 -->
     <suppress>
@@ -124,6 +132,8 @@
         <cve>CVE-2022-42003</cve>
         <cve>CVE-2022-42004</cve>
         <cve>CVE-2023-35116</cve>
+	<cve>CVE-2022-42003</cve>
+	<cve>CVE-2022-42004</cve>
     </suppress>
 
     <!-- https://issues.apache.org/jira/browse/CASSANDRA-18643 -->

CHANGES.txt

@@ -6,6 +6,7 @@
  * Add keyspace and table name to exception message during ColumnSubselection deserialization (CASSANDRA-18346)
  * Remove unnecessary String.format invocation in QueryProcessor when getting a prepared statement from cache (CASSANDRA-17202)
 Merged from 3.0:
+ * Upgrade OWASP to 8.3.1 (CASSANDRA-18650)
  * Suppress CVE-2023-34462 (CASSANDRA-18649)
  * Add support for AWS Ec2 IMDSv2 (CASSANDRA-16555)
  * Suppress CVE-2023-35116 (CASSANDRA-18630)