Skip to content

Commit f51a536

Browse files
gbuissongbuisson
committed
Bump most safe dependencies
1 parent 748fe1a commit f51a536

File tree

3 files changed

+74
-47
lines changed

3 files changed

+74
-47
lines changed

‎project.clj‎

Lines changed: 51 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
(def cheshire-version "5.11.0")
1+
(def cheshire-version "6.1.0")
22
(def clj-http-fake-version "1.0.3")
3-
(def clj-version "1.12.0")
4-
(def jackson-version "2.15.2")
5-
(def jackson-databind-version "2.15.2")
3+
(def clj-version "1.12.3")
4+
(def jackson-version "2.20.0")
5+
(def jackson-databind-version "2.20.0")
66
(def logback-version "1.5.16")
77
(def metrics-clojure-version "2.10.0")
88
(def netty-version "4.1.125.Final")
@@ -11,7 +11,7 @@
1111
(def slf4j-version "2.0.16")
1212
(def schema-generators-version "0.1.5")
1313
(def test-check-version "1.1.1")
14-
(def test-chuck-version "0.2.13")
14+
(def test-chuck-version "0.2.15")
1515
(def trapperkeeper-version "3.2.0")
1616

1717
;; TODO we could add -dev here when it works
@@ -61,66 +61,70 @@
6161
:jvm-opts ["-Djava.awt.headless=true"
6262
"-Dlog.console.threshold=INFO"
6363
"-server"]
64-
:exclusions [log4j/log4j ;; handled by org.slf4j/log4j-over-slf4j
64+
:exclusions [log4j/log4j ;; handled by org.slf4j/log4j-over-slf4j
6565
io.netty/netty ;; moved to io.netty/netty-all
6666
org.slf4j/slf4j-log4j12
6767
org.slf4j/slf4j-nop] ;; Removed in favor of logback
6868
;; use `lein pom; mvn dependency:tree -Dverbose -Dexcludes=org.clojure:clojure`
6969
;; to inspect conflicts.
7070

71+
:managed-dependencies [[potemkin "0.4.7"]
72+
[org.tukaani/xz "1.9"]]
73+
7174
:dependencies [[org.clojure/clojure ~clj-version]
7275
[clj-time "0.15.2"]
73-
[org.threeten/threeten-extra "1.2"]
74-
[clojure.java-time "1.1.0"]
75-
[org.clojure/core.async "1.5.648"]
76-
[org.clojure/core.memoize "1.0.257"]
77-
[org.clojure/tools.logging "1.2.4"]
78-
[org.clojure/tools.cli "1.0.194"]
79-
[pandect "0.6.1"]
80-
[org.clojure/math.combinatorics "0.1.6"]
81-
[version-clj "2.0.1"]
76+
[org.threeten/threeten-extra "1.8.0"]
77+
[clojure.java-time "1.4.3"]
78+
[org.clojure/core.async "1.8.741"]
79+
[org.clojure/core.memoize "1.1.266"]
80+
[org.clojure/tools.logging "1.3.0"]
81+
[org.clojure/tools.cli "1.2.245"]
82+
[pandect "1.0.2"]
83+
[org.clojure/math.combinatorics "0.3.0"]
84+
[version-clj "2.0.3"]
85+
8286

8387
;; Trapperkeeper
8488
[puppetlabs/trapperkeeper ~trapperkeeper-version]
8589
[puppetlabs/kitchensink ~trapperkeeper-version]
86-
[prismatic/plumbing "0.5.5"] ;; upgrade puppetlabs/trapperkeeper
87-
[clj-commons/clj-yaml "1.0.26"] ;; upgrade snakeyaml dep
90+
[prismatic/plumbing "0.6.0"] ;; upgrade puppetlabs/trapperkeeper
91+
[clj-commons/clj-yaml "1.0.29"] ;; upgrade snakeyaml dep
8892

8993
;; Schemas
9094
[prismatic/schema "1.4.1"]
9195
[metosin/schema-tools "0.13.1"]
92-
[threatgrid/flanders "1.0.2"]
93-
[threatgrid/ctim "1.3.26"]
94-
[instaparse "1.4.10"] ;; com.gfredericks/test.chuck > threatgrid/ctim
95-
[threatgrid/clj-momo "0.3.5"]
96+
[threatgrid/flanders "1.1.0"]
97+
[threatgrid/ctim "1.3.27"]
98+
[instaparse "1.5.0"] ;; com.gfredericks/test.chuck > threatgrid/ctim
99+
[threatgrid/clj-momo "0.4.1"]
96100
[threatgrid/ductile "0.5.0"]
97101

98102
[com.arohner/uri "0.1.2"]
99103

100104
;; Web server
101-
[metosin/compojure-api "1.1.13"]
102-
[ring-middleware-format "0.7.4"]
105+
[metosin/compojure-api "1.1.14"]
106+
[ring-middleware-format "0.7.5"]
103107
;; optional ring-middleware-format dep (Note: ring-middleware-format is also a transitive dep for compojure-api)
104108
;; see: https://github.com/ngrunwald/ring-middleware-format/issues/74
105-
[com.ibm.icu/icu4j "65.1"]
109+
[com.ibm.icu/icu4j "77.1"]
106110
[metosin/ring-swagger "1.0.0"]
107111
[metosin/ring-swagger-ui "3.24.3"]
108112
[ring/ring-core ~ring-version] ;ring/ring-jetty-adapter > metosin/ring-swagger
109113
[ring/ring-jetty-adapter ~ring-version]
110114
[ring/ring-devel ~ring-version]
111115
[ring-cors "0.1.13"]
112-
[commons-codec "1.15"] ;ring/ring* > threatgrid/ctim, threatgrid/clj-momo, clj-http
113-
[ring/ring-codec "1.1.3"]
114-
[threatgrid/clj-jwt "0.5.0"]
116+
[commons-codec "1.19.0"] ;ring/ring* > threatgrid/ctim, threatgrid/clj-momo, clj-http
117+
[ring/ring-codec "1.3.0"]
118+
[threatgrid/clj-jwt "0.5.1"]
115119
[threatgrid/ring-turnstile-middleware "0.1.1"]
116120
[threatgrid/ring-jwt-middleware "1.1.7"]
117-
[org.clojure/data.json "1.0.0"] ;; threatgrid/ring-jwt-middleware > threatgrid/ctim
118-
[scopula "0.1.4"]
119-
[org.clojure/tools.reader "1.3.6"] ;; org.clojure/tools.namespace > ring-middleware-format
121+
[org.clojure/data.json "2.5.1"] ;; threatgrid/ring-jwt-middleware > threatgrid/ctim
122+
[scopula "0.2.0"]
123+
[org.clojure/tools.reader "1.5.2"] ;; org.clojure/tools.namespace > ring-middleware-format
120124

121125
;; clients
122-
[clj-http "3.12.3"]
123-
[com.taoensso/carmine "2.19.1" #_"2.20.0-RC1"]
126+
[clj-http "3.13.1"]
127+
[com.taoensso/carmine "3.4.1" #_"2.20.0-RC1"]
124128
[cheshire ~cheshire-version] ;; upgrade threatgrid/ring-jwt-middleware, puppetlabs/kitchensink (+ a dozen others)
125129

126130
;; Metrics
@@ -133,14 +137,14 @@
133137
[io.netty/netty-all ~netty-version] ;bump org.onyxplatform/onyx-kafka, metrics-clojure-riemann, zookeeper-clj
134138
[io.netty/netty-codec ~netty-version] ;bump org.apache.zookeeper/zookeeper, riemann-clojure-client
135139
[io.netty/netty-resolver ~netty-version] ;bump riemann-clojure-client, org.apache.zookeeper/zookeeper
136-
[com.google.protobuf/protobuf-java "3.25.5"] ;; address CVE-2024-7254
137-
[riemann-clojure-client "0.5.1"]
140+
[com.google.protobuf/protobuf-java "4.32.1"]
141+
[riemann-clojure-client "0.5.4"]
138142
;; https://stackoverflow.com/a/43574427
139-
[jakarta.xml.bind/jakarta.xml.bind-api "2.3.2"]
143+
[jakarta.xml.bind/jakarta.xml.bind-api "4.0.4"]
140144

141145
;; Docs
142-
[markdown-clj "1.10.1"]
143-
[hiccup "2.0.0-alpha2"]
146+
[markdown-clj "1.12.4"]
147+
[hiccup "2.0.0"]
144148

145149
;; Encryption
146150
[lock-key "1.5.0"]
@@ -149,8 +153,8 @@
149153
[threatgrid/redismq "0.1.1"]
150154

151155
[org.apache.zookeeper/zookeeper "3.8.4"] ; override zookeeper-clj, org.onyxplatform/onyx-kafka
152-
[commons-io "2.14.0"] ;; address CVE-2024-47554
153-
[args4j "2.33"] ;bump org.onyxplatform/onyx-kafka, threatgrid/ctim
156+
[commons-io "2.20.0"]
157+
[args4j "2.37"] ;bump org.onyxplatform/onyx-kafka, threatgrid/ctim
154158
[com.stuartsierra/component "1.1.0"] ;org.onyxplatform/onyx-kafka internal override
155159
[org.onyxplatform/onyx-kafka "0.14.5.0"]
156160
;; Notes on jackson-databind:
@@ -164,7 +168,7 @@
164168
[zookeeper-clj "0.9.4"]
165169

166170
;; firehose
167-
[software.amazon.awssdk/firehose "2.17.232" :exclusions
171+
[software.amazon.awssdk/firehose "2.34.7" :exclusions
168172
[io.netty/netty
169173
io.netty/netty-all
170174
io.netty/netty-buffer
@@ -186,13 +190,13 @@
186190

187191
;; GraphQL
188192
[base64-clj "0.1.1"]
189-
[threatgrid/ring-graphql-ui "0.1.1"]
193+
[threatgrid/ring-graphql-ui "0.1.3"]
190194
[com.graphql-java/graphql-java "24.3"]
191195

192196
;; Logging
193197
[org.slf4j/log4j-over-slf4j ~slf4j-version]
194198
[org.slf4j/slf4j-api ~slf4j-version]
195-
[net.logstash.logback/logstash-logback-encoder "7.4"]
199+
[net.logstash.logback/logstash-logback-encoder "8.1"]
196200
[ch.qos.logback/logback-classic ~logback-version]
197201
[ch.qos.logback/logback-core ~logback-version]]
198202

@@ -224,14 +228,14 @@
224228
[clj-http-fake ~clj-http-fake-version]
225229
[prismatic/schema-generators ~schema-generators-version]
226230
[circleci/circleci.test "0.5.0"]
227-
[org.clojure/math.combinatorics "0.1.6"]
228-
[org.clojure/data.priority-map "1.1.0"]
229-
[org.clojure/tools.namespace "1.2.0"]]
231+
[org.clojure/math.combinatorics "0.3.0"]
232+
[org.clojure/data.priority-map "1.2.0"]
233+
[org.clojure/tools.namespace "1.5.0"]]
230234
:pedantic? :warn
231235
:source-paths ["dev"]}
232236
:ci {:pedantic? :abort
233237
:global-vars {*warn-on-reflection* true}
234-
:jvm-opts [;; actually print stack traces instead of useless
238+
:jvm-opts [ ;; actually print stack traces instead of useless
235239
;; "Full report at: /tmp/clojure-8187773283812483853.edn"
236240
"-Dclojure.main.report=stderr"
237241
"-XX:-OmitStackTraceInFastThrow"]}
@@ -243,7 +247,7 @@
243247
"-Dcom.sun.management.jmxremote.authenticate=false"
244248
"-Dcom.sun.management.jmxremote.ssl=false"]}
245249
:bench {:dependencies [[perforate ~perforate-version]
246-
[criterium "0.4.5"]
250+
[criterium "0.4.6"]
247251
[org.clojure/test.check ~test-check-version]
248252
[com.gfredericks/test.chuck ~test-chuck-version]
249253
[prismatic/schema-generators ~schema-generators-version]]

‎src/ctia/init.clj‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
[ctia.lib.metrics.console :as console]
99
[ctia.lib.utils :as utils]
1010
[ctia.lib.riemann-service :as riemann-svc]
11+
[ctia.lib.json :as json]
1112
[ctia.events-service :as events-svc]
1213
[ctia.features-service :as features-svc]
1314
[ctia.logging :as event-logging]
@@ -95,6 +96,9 @@
9596
Returns the Trapperkeeper app."
9697
([] (start-ctia! {}))
9798
([{:keys [services config]}]
99+
;; Initialize JSON encoders before anything else
100+
(json/init!)
101+
98102
(log/info "starting CTIA version: "
99103
(version/current-version))
100104

‎src/ctia/lib/json.clj‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
(ns ctia.lib.json
2+
"JSON encoding configuration for CTIA."
3+
(:require [cheshire.generate :as generate])
4+
(:import [com.fasterxml.jackson.core JsonGenerator]))
5+
6+
(defn register-charsequence-encoder!
7+
"Register a custom encoder for CharSequence to serialize as strings.
8+
9+
Fixes Jackson 2.18+ treating CharSequence as JavaBeans on Java 15+."
10+
[]
11+
(generate/add-encoder
12+
CharSequence
13+
(fn [^CharSequence obj ^JsonGenerator json-generator]
14+
(.writeString json-generator (.toString obj)))))
15+
16+
(defn init!
17+
"Initialize JSON encoding configuration."
18+
[]
19+
(register-charsequence-encoder!))

0 commit comments

Comments
 (0)