Skip to content

8.0.0-dev.13

Choose a tag to compare

View all tags
@ReleaseManagement-BP ReleaseManagement-BP released this 27 Oct 17:02
· 17 commits to master since this release
8.0.0-dev.13
dafe7ba
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Infrastructure - Dependency and CVE Update

Background

This release brings CDM's build and runtime dependencies up to date, including the Rosetta DSL and bundle, FpML as Rune and several Maven and GitHub Actions dependencies. It also fixes a vulnerability flagged by the scheduled CVE scan on master, and fixes a race condition that made test pack expectations non-deterministic.

What is being released?

DSL and Rosetta bundle update

  • rosetta.dsl.version updated from 10.15.1 to 10.15.3
  • rosetta.bundle.version updated from 12.23.0 to 12.25.0

FpML as Rune update

rune-fpml.version updated to 3.13.0, so that the consolidated FpML model covers both FpML 5-13 and 5-14. Version updates include:

  • FpML as Rune 3.13.0 - FpML 5-13 schemas added back beside 5-14, for backwards compatibility
  • FpML as Rune 3.12.0 - FpML schemas updated to 5-14
  • FpML as Rune 3.11.0 - CVE fix, DSL and bundle updates
  • FpML as Rune 3.10.0 - FpML model reimported with descriptions instead of documentation references
  • FpML as Rune 3.9.0 - DSL update

FpML 5-14 widens CalculationPeriodDates.stubPeriodType from a single value to a list of up to two, so that an initial and a final stub period type can be stated on the same calculation period schedule. CDM's own CalculationPeriodDates.stubPeriodType already allows two, so MapSwapCalculationPeriodDates in the cdm.ingest.fpml.confirmation.product.swap namespace now carries both values through.

The two FpML ingest pipeline configs now reference fpml-5-14-confirmation-xml-config.json, and the [ingest XML] annotation on the two ingest functions now names the schema as [ingest fpml.fpml514ConfirmationXML].

CVE fixes

This release updates third-party software libraries to comply with the "Common Vulnerabilities and Exposures" (CVE) standard:

  • body-parser-1.20.9 (website) — CVE-2026-111181 (7.5)
  • The braces-3.0.3 suppression for CVE-2026-93687 has been removed from allow-list.xml. GitHub withdrew the advisory, and the CVE scan no longer reports braces

Dependency updates

  • net.sf.saxon:Saxon-HE 10.6 → 13.1
  • com.opengamma.strata:strata-basics 2.12.75 → 2.12.77
  • ch.qos.logback:logback-classic / logback-core 1.6.4 → 1.6.5
  • org.codehaus.mojo:versions-maven-plugin 2.22.0 → 2.23.0
  • actions/setup-java (GitHub Actions) 4 → 6

Thread-safe code list loading

The CDM's code lists (the sets of valid values for fields such as business centres) were not loaded in a thread-safe way. When several validation checks ran at the same time, they could interfere with each other while loading a list. This made results non-deterministic: for example, a valid code such as GBLO (London) was occasionally reported as invalid when regenerating test pack expectations. Code lists are now loaded in a thread-safe way, and a new automated test guards against the problem returning.

Formatting

  • Formatting updates to Rosetta source files and function output samples. No functional changes

Backwards Compatibility

No breaking changes. There are no CDM type, enumeration or function signature changes, and a message that ingests today produces the same CDM output after this change. FpML 5-13 allowed only one stubPeriodType, so nothing written against it can supply a second value.

For users of the FpML model itself, in the fpml.consolidated namespaces, no type, enumeration or attribute is removed across this version range, and 16 types and 8 enumerations are added.

Review Directions

Changes can be reviewed in PRs: #5243, #5251, #5274, #5293, #5296, #5300, #5307, #5310

Assets 2
Loading