Quesnelia: Upgrade Vertx from 4.5.5 to 4.5.9 fixing Snappy vulns

Description

Upgrade Vert.x from 4.5.5 to 4.5.9.

This indirectly upgrades snappy-java from 1.1.10.0 to 1.1.10.5 fixing these vulnerablities:

CSP Request Details

1. Describe issue impact on business Data loss because Kafka crashes. 2. What institutions are affected? (field “Effected Institutions” in Jira to be populated) All institutions that use loans, requests or check-ins. Attackers don't advertise which institutions they will attack. 3. What is the workaround if exists? None. 4. What areas will be impacted by fix (i.e. what areas need to be retested) Upgrading the Vert.x software library patch version doesn't need any testing beyond existing unit tests. 5. Brief explanation of technical implementation and the level of effort (in workdays) and technical risk (low/medium/high) Low. Bump Vert.x software library patch version. 6. Brief explanation of testing required and level of effort (in workdays). Provide test plan agreed with by QA Manager and PO. None beyond existing unit tests. 7. What is the roll back plan in case the fix does not work? Downgrade to previous mod-circulation-storage patch version.

CSP Rejection Details

None

Potential Workaround

None

Confluence content

mentioned on

Checklist

hide

Activity

Show:

Oleksii Petrenko September 2, 2024 at 3:56 PM

Deployed to QBF

Done

Details

Assignee

Reporter

Priority

Story Points

Sprint

Development Team

Vega

Fix versions

Release

Quesnelia (R1 2024) Service Patch #4

RCA Group

Related dependency upgrade

CSP Approved

Yes

Affected releases

Quesnelia (R1 2024)

TestRail: Cases

Open TestRail: Cases

TestRail: Runs

Open TestRail: Runs
Created August 5, 2024 at 8:29 AM
Updated October 29, 2024 at 1:31 PM
Resolved August 22, 2024 at 1:35 PM
TestRail: Cases
TestRail: Runs

Flag notifications