Merge 717d22b into 05dd5ab

.github/workflows/ci.yml

@@ -55,8 +55,9 @@ jobs:
           java-version: 11
       - name: Get the latest Databricks JDBC driver
         run: |
-          curl https://databricks-bi-artifacts.s3.us-east-2.amazonaws.com/simbaspark-drivers/jdbc/2.6.33/DatabricksJDBC42-2.6.33.1055.zip --output DatabricksJDBC42.jar.zip
+          curl https://databricks-bi-artifacts.s3.us-east-2.amazonaws.com/simbaspark-drivers/jdbc/2.6.34/DatabricksJDBC42-2.6.34.1058.zip --output DatabricksJDBC42.jar.zip
           unzip DatabricksJDBC42.jar.zip
+          cp ./*/DatabricksJDBC42.jar . # 2.6.34 download changes directory structure - grab the jar from nested directory (which has entropy in its name)
       - name: Docker login
         uses: docker/login-action@v1
         with:

CHANGELOG

@@ -1,3 +1,9 @@
+Version 5.7.5 (2023-12-04)
+--------------------------
+Fix transformer CVEs (#1325)
+Fix loader CVEs (#1325)
+Use databricks JDBC 2.6.34 (#1325)
+
 Version 5.7.4 (2023-10-10)
 --------------------------
 Bump snappy-java to 1.1.10.4 (#1313)

README.md

@@ -65,7 +65,7 @@ Licensed under the [Snowplow Community License](https://docs.snowplow.io/communi
 [build-image]: https://github.com/snowplow/snowplow-rdb-loader/workflows/CI/badge.svg
 [build]: https://github.com/snowplow/snowplow-rdb-loader/actions/workflows/ci.yml
 
-[release-image]: https://img.shields.io/badge/release-5.7.4-blue.svg?style=flat
+[release-image]: https://img.shields.io/badge/release-5.7.5-blue.svg?style=flat
 [releases]: https://github.com/snowplow/snowplow-rdb-loader/releases
 
 [license]: https://docs.snowplow.io/docs/contributing/community-license-faq/

project/Dependencies.scala

@@ -61,13 +61,16 @@ object Dependencies {
     val snowflakeJdbc    = "3.13.30"
     val enumeratum       = "1.7.0"
     val aws              = "1.12.261"
-    val aws2             = "2.18.8"
+    val aws2             = "2.21.33"
     val jSch             = "0.2.1"
     val sentry           = "1.7.30"
     val protobuf         = "3.21.7" // Fix CVE
     val kinesisClient    = "2.4.3"
     val nettyCodec       = "4.1.86.Final" // Fix CVE
     val jettison         = "1.5.4" // Fix CVE
+    val reactorNetty     = "1.0.39" // Fix CVE
+    val jettyHttp        = "9.4.53.v20231009" // Fix CVE
+    val zookeeper        = "3.7.2" // Fix CVE
 
     // Scala (test only)
     val specs2           = "4.17.0"
@@ -171,6 +174,8 @@ object Dependencies {
   val snowflakeJdbc     = "net.snowflake"         % "snowflake-jdbc"            % V.snowflakeJdbc
   val enumeratum        = "com.beachape"          %% "enumeratum"               % V.enumeratum
   val jettison          = "org.codehaus.jettison" % "jettison"                  % V.jettison
+  val reactorNetty      = "io.projectreactor.netty" % "reactor-netty-http"      % V.reactorNetty
+  val jettyHttp         = "org.eclipse.jetty" % "jetty-http" % V.jettyHttp
 
   // Java (Shredder)
   val dynamodb          = "com.amazonaws"         % "aws-java-sdk-dynamodb"     % V.aws
@@ -190,6 +195,7 @@ object Dependencies {
   val aws2sts           = "software.amazon.awssdk" % "sts"                      % V.aws2        % Runtime
   val protobuf          = "com.google.protobuf"    % "protobuf-java"            % V.protobuf
   val nettyCodec        = "io.netty"               % "netty-codec"              % V.nettyCodec
+  val zookeeper         = "org.apache.zookeeper"   % "zookeeper"                % V.zookeeper
 
   // Scala (test only)
   val specs2            = "org.specs2"                 %% "specs2-core"                   % V.specs2            % Test
@@ -231,7 +237,9 @@ object Dependencies {
     azureKeyVault,
     fs2Kafka,
     hadoopCommon,
-    hadoopAzure
+    hadoopAzure,
+    reactorNetty,
+    jettyHttp
   )
 
   val commonDependencies = Seq(
@@ -262,7 +270,8 @@ object Dependencies {
     scalaTrackerEmit,
     http4sClient,
     slf4jApi,
-    sentry
+    sentry,
+    zookeeper
   )
 
   val loaderDependencies = Seq(