diff --git a/argus/build.gradle b/argus/build.gradle
index fe9861f14..59f143848 100644
--- a/argus/build.gradle
+++ b/argus/build.gradle
@@ -42,7 +42,6 @@ dependencies {
     implementation 'org.opencadc:cadc-vosi:[1.4.12,2.0)'
     implementation 'org.opencadc:cadc-dali:[1.2.28,)'
     implementation 'org.opencadc:cadc-dali-pg:[0.4.0,)'
-    implementation 'org.opencadc:cadc-dali-parquet:[0.5.3,)'
     implementation 'org.opencadc:cadc-cdp:[1.4.0,)'
     implementation 'org.opencadc:cadc-gms:[1.0.0,)'
     runtimeOnly 'org.opencadc:cadc-access-control-identity:[1.1.0,2.0)'
@@ -56,7 +55,11 @@ dependencies {
     runtimeOnly 'com.nimbusds:nimbus-jose-jwt:[9.37.4,)'
     // this breaks CI build on gradle 6 because of library variants 
     //runtimeOnly 'com.google.guava:guava:33.5.0-jre'
- 
+
+    // parquet support currently disabled because of CVEs but needed for test code compile
+    //implementation 'org.opencadc:cadc-dali-parquet:[0.5.3,)'
+    testImplementation 'org.opencadc:cadc-dali-parquet:[0.5.3,)'
+
     testImplementation 'org.opencadc:cadc-tap:[1.0,)'
     testImplementation 'junit:junit:[4.1,5.0)'
     testImplementation 'org.postgresql:postgresql:[42.0,)'
diff --git a/argus/src/intTest/java/org/opencadc/argus/ParquetOutputTest.java b/argus/src/intTest/java/org/opencadc/argus/ParquetOutputTest.java
index b4cfb1ce0..4892e1450 100644
--- a/argus/src/intTest/java/org/opencadc/argus/ParquetOutputTest.java
+++ b/argus/src/intTest/java/org/opencadc/argus/ParquetOutputTest.java
@@ -85,6 +85,7 @@
 import org.apache.log4j.Level;
 import org.apache.log4j.Logger;
 import org.junit.Assert;
+import org.junit.Ignore;
 import org.junit.Test;
 import static org.opencadc.argus.AuthQueryTest.syncURL;
 import org.opencadc.tap.TapClient;
@@ -104,9 +105,10 @@ public ParquetOutputTest() {
     }
     
     @Test
+    @Ignore // disabled: see build.gradle comment
     public void testParquetOutput() throws Exception {
         TapClient tap = new TapClient(Constants.RESOURCE_ID);
-        final URL tapURL = tap.getSyncURL(Standards.SECURITY_METHOD_CERT);
+        final URL tapURL = tap.getSyncURL(Standards.SECURITY_METHOD_ANON);
         log.info(" sync: " + syncURL);
         
         // hits duplicate column name bug in ParquetWriter:
diff --git a/argus/src/main/webapp/capabilities.xml b/argus/src/main/webapp/capabilities.xml
index 7af55c8d5..1862a141c 100644
--- a/argus/src/main/webapp/capabilities.xml
+++ b/argus/src/main/webapp/capabilities.xml
@@ -113,10 +113,12 @@
         <alias>tsv</alias>
     </outputFormat>
 
+<!--
     <outputFormat>
         <mime>application/vnd.apache.parquet</mime>
         <alias>parquet</alias>
     </outputFormat>
+-->
 
     <uploadMethod ivo-id="ivo://ivoa.net/std/TAPRegExt#upload-inline"/>
     <uploadMethod ivo-id="ivo://ivoa.net/std/TAPRegExt#upload-http"/>