From 59ba75ec0f9b205f888fac2f56d5680bfc282dca Mon Sep 17 00:00:00 2001
From: Ravi Singal <ravi.singal@traceable.ai>
Date: Thu, 26 May 2022 13:50:58 +0530
Subject: [PATCH 1/2] add codeql analysis action

---
 .github/workflows/codeql-analysis.yml | 57 +++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 .github/workflows/codeql-analysis.yml

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
new file mode 100644
index 0000000..c93b5a2
--- /dev/null
+++ b/.github/workflows/codeql-analysis.yml
@@ -0,0 +1,57 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: '18 22 * * 6'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'java' ]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: create checksum file
+        uses: hypertrace/github-actions/checksum@main
+
+      - name: create checksum file
+        uses: hypertrace/github-actions/checksum@main
+
+      - name: Cache packages
+        uses: actions/cache@v2
+        with:
+          path: ~/.gradle
+          key: gradle-packages-${{ runner.os }}-${{ github.job }}-${{ hashFiles('**/checksum.txt') }}
+          restore-keys: |
+            gradle-packages-${{ runner.os }}-${{ github.job }}
+            gradle-packages-${{ runner.os }}
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ matrix.language }}
+
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2

From a91ce787089dfd69c82a491e898a5acdbddabd1a Mon Sep 17 00:00:00 2001
From: Ravi Singal <ravi.singal@traceable.ai>
Date: Fri, 27 May 2022 11:47:23 +0530
Subject: [PATCH 2/2] fix snyk failures

---
 kafka-streams-framework/build.gradle.kts | 3 +++
 kafka-streams-serdes/build.gradle.kts    | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/kafka-streams-framework/build.gradle.kts b/kafka-streams-framework/build.gradle.kts
index 0977a3b..33588dc 100644
--- a/kafka-streams-framework/build.gradle.kts
+++ b/kafka-streams-framework/build.gradle.kts
@@ -24,6 +24,9 @@ dependencies {
     api("org.glassfish.jersey.core:jersey-common:2.34") {
       because("https://snyk.io/vuln/SNYK-JAVA-ORGGLASSFISHJERSEYCORE-1255637")
     }
+    implementation("com.fasterxml.jackson.core:jackson-databind:2.13.3") {
+      because("https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-2421244")
+    }
   }
 
   testImplementation("org.apache.kafka:kafka-streams-test-utils:6.0.1-ccs")
diff --git a/kafka-streams-serdes/build.gradle.kts b/kafka-streams-serdes/build.gradle.kts
index 6fea640..193e16e 100644
--- a/kafka-streams-serdes/build.gradle.kts
+++ b/kafka-streams-serdes/build.gradle.kts
@@ -16,7 +16,7 @@ dependencies {
   implementation("org.apache.kafka:kafka-clients:6.0.1-ccs")
   testImplementation("org.junit.jupiter:junit-jupiter:5.7.0")
   constraints {
-    api("com.fasterxml.jackson.core:jackson-databind:2.12.6") {
+    api("com.fasterxml.jackson.core:jackson-databind:2.13.3") {
       because("Denial of Service (DoS) [Medium Severity][https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-2326698] in com.fasterxml.jackson.core:jackson-databind@2.12.2\n" +
               "    introduced by org.apache.avro:avro@1.10.2 > com.fasterxml.jackson.core:jackson-databind@2.12.2 and 2 other path(s)")
     }