search

cfpb / hmda-platform

The HMDA Submission backend applications.
Creative Commons Zero v1.0 Universal
104 stars 94 forks source link

Fix snake CVE #4837

Closed rkovalik-raft closed 1 month ago

rkovalik-raft commented 3 months ago

Updates Kubernetes api client-java version to 21.0.0-legacy, which fixes CVE issue related to snake.yaml. I chose the 21.0.0-legacy version because we would need to make significant code changes if we used the 21.0.0 version, since that version makes a method we rely on private instead of public.

Compiles and passes unit tests for hmda-platform and check-digit services, working on testing other services.

rkovalik-raft commented 2 months ago

Note that the higher s3mock version requires Java 17, and tests/builds still fail due to cassandra issues

rkovalik-raft commented 2 months ago

Note: to run this with sbt, need to use this command: env JDK_JAVA_OPTIONS="--add-opens java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/sun.nio.ch=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED" sbt

There are still some errors in hmda-platform when running locally, but it passes tests and the docker image builds fine.

Also ratespread-calculator still has cassandra related errors that cause a test to fail.

rkovalik-raft commented 1 month ago

Confirmed with @Michaeldremy that the Cypress DEV tests looked good