Port OWASP CVE remediations to 26.3: httpcore5-h2 5.4.3, pg driver 42.7.12

Ports the httpcore5-h2 and pgjdbc fixes from develop (fb_owasp_cves_20260709) onto the 26.3 release branch. Force org.apache.httpcomponents.core5:httpcore5-h2 to httpcore5Version (5.4.3) so the transitive 5.3.6 is upgraded past the vulnerable 5.4.2 ceiling, clearing CVE-2026-54399 (HTTP/1.1 parser DoS) and CVE-2026-54428 (HTTP/2 HPACK decoder DoS). Bump postgresqlDriverVersion 42.7.11 -> 42.7.12 for CVE-2026-54291, a channel-binding downgrade in pgjdbc 42.7.4-42.7.11 that silently drops SCRAM-SHA-256-PLUS MITM protection (fixed in 42.7.12). Suppress the CVE-2026-54428 false positive on the classic httpcore 4.x artifact, which has no HTTP/2 module and is not affected.

Shaded copies of these libraries originate from labkey-api-jdbc and are addressed separately.

Author: labkey-willm

build.gradle

@@ -245,6 +245,8 @@ allprojects {
                     // force version for cloud, docker, fileTransfer, googledrive, tcrb, wnprc_ehr
                     force "org.apache.httpcomponents:httpcore:${httpcoreVersion}"
                     force "org.apache.httpcomponents.core5:httpcore5:${httpcore5Version}"
+                    // align httpcore5-h2 with httpcore5; the transitive 5.3.6 is exposed to CVE-2026-54399/CVE-2026-54428 (fixed in 5.4.3)
+                    force "org.apache.httpcomponents.core5:httpcore5-h2:${httpcore5Version}"
                     // force version for cloud, docker, fileTransfer, googledrive, tcrb, wnprc_ehr
                     force "org.apache.httpcomponents:httpclient:${httpclientVersion}"
                     force "org.apache.httpcomponents.client5:httpclient5:${httpclient5Version}"

dependencyCheckSuppression.xml

@@ -328,14 +328,14 @@
         <cve>CVE-2026-53914</cve>
     </suppress>
     <!--
-    CVE-2026-54399 is scoped to Apache HttpComponents Core 5.x only. The classic httpcore 4.x line (org.apache.httpcomponents:httpcore) is EOL, is not listed as affected, and has no fixed 4.4.x release. False positive for the 4.x artifact.
-    -->
+    CVE-2026-54399 (httpcore5 HTTP/1.1 parser) and CVE-2026-54428 (httpcore5-h2 HTTP/2 HPACK decoder) are both scoped to Apache HttpComponents Core 5.x only. The classic httpcore 4.x line (org.apache.httpcomponents:httpcore) is EOL, has no HTTP/2 module, is not listed as affected, and has no fixed 4.4.x release. False positives for the 4.x artifact.    -->
     <suppress>
         <notes><![CDATA[
-    file name: httpcore-4.4.16.jar (classic 4.x, not affected by the 5.x-scoped CVE)
+    file name: httpcore-4.4.16.jar (classic 4.x, not affected by the 5.x-scoped CVEs)
     ]]></notes>
         <packageUrl regex="true">^pkg:maven/org\.apache\.httpcomponents/httpcore@.*$</packageUrl>
         <cve>CVE-2026-54399</cve>
+        <cve>CVE-2026-54428</cve>
     </suppress>
     <!--
     CVE-2026-53914 is an unsafe-deserialization flaw in Kotlin build-cache metadata (build tooling); JetBrains (the CNA) scores it 6.7 MEDIUM (AV:L/AC:H/PR:H), not NVD's auto-assigned 9.8, and the advisory names no runtime package. The shipped Kotlin runtime jars (kotlin-stdlib, kotlin-reflect, etc.) do not execute the affected code, and no stable fixed release exists yet (only 2.4.20-Beta1). False positive for the runtime artifacts.

gradle.properties

@@ -268,7 +268,7 @@ poiVersion=5.4.0
 
 pollingWatchVersion=0.2.0
 
-postgresqlDriverVersion=42.7.11
+postgresqlDriverVersion=42.7.12
 
 quartzVersion=2.5.2