diff --git a/app/build.gradle b/app/build.gradle
index 4b685885b2..e4caae5ceb 100644
--- a/app/build.gradle
+++ b/app/build.gradle
@@ -16,7 +16,7 @@ import org.gradle.internal.jvm.Jvm
 buildscript {
     dependencies {
         classpath "com.android.tools.build:gradle:$androidPluginVersion"
-        classpath 'com.github.spotbugs.snom:spotbugs-gradle-plugin:6.0.16'
+        classpath 'com.github.spotbugs.snom:spotbugs-gradle-plugin:6.0.18'
         classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlin_version"
         classpath "io.gitlab.arturbosch.detekt:detekt-gradle-plugin:1.23.6"
         classpath "commons-httpclient:commons-httpclient:3.1@jar" // remove after entire switch to lib v2
diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml
index a2065b953d..a645ca32e4 100644
--- a/gradle/verification-metadata.xml
+++ b/gradle/verification-metadata.xml
@@ -5718,20 +5718,15 @@
       </component>
       <component group="com.github.bitfireAT" name="dav4jvm" version="2.2.1">
          <artifact name="dav4jvm-2.2.1.jar">
-            <sha256 value="5ce40389fc7ba0b630f07cbd2a573a507db616aed0ffdc744fb78000d8835815" origin="Generated by Gradle" reason="Artifact is not signed"/>
+            <sha256 value="5ce40389fc7ba0b630f07cbd2a573a507db616aed0ffdc744fb78000d8835815" origin="Generated by Gradle" reason="Artifact is not signed">
+               <also-trust value="e6b8a9ff7ada0841198b18de2d6fd935f1f8754d3c84b8e8e3dc1840648d595d"/>
+            </sha256>
+         </artifact>
+         <artifact name="dav4jvm-2.2.1.module">
+            <sha256 value="977a16e0c70ee01139463fd4cbd9efd7d7a767c0c8b3e72941b69cbdd2f085d3" origin="Generated by Gradle" reason="Artifact is not signed">
+               <also-trust value="65cc7897f3737bd56ac9ec404a3c6878a01037803e3ab0b04e6b8cfbb1952153"/>
+            </sha256>
          </artifact>
-          <artifact name="dav4jvm-2.2.1.jar">
-              <sha256 value="e6b8a9ff7ada0841198b18de2d6fd935f1f8754d3c84b8e8e3dc1840648d595d"
-                  origin="Generated by Gradle" reason="Artifact is not signed" />
-          </artifact>
-          <artifact name="dav4jvm-2.2.1.module">
-              <sha256 value="977a16e0c70ee01139463fd4cbd9efd7d7a767c0c8b3e72941b69cbdd2f085d3"
-                  origin="Generated by Gradle" reason="Artifact is not signed" />
-          </artifact>
-          <artifact name="dav4jvm-2.2.1.module">
-              <sha256 value="65cc7897f3737bd56ac9ec404a3c6878a01037803e3ab0b04e6b8cfbb1952153"
-                  origin="Generated by Gradle" reason="Artifact is not signed" />
-          </artifact>
       </component>
       <component group="com.github.bumptech.glide" name="glide" version="3.8.0">
          <artifact name="glide-3.8.0.jar">