All pull requests

Pull requests

• security: SNYK-JAVA-ORGYAML-3152153: pin core-dates 1.4.1 to fix snakeyaml CVE-2022-1471 without changing FIX wire format

  cve-2026-82329-response
  #85·devin-ai-integration[bot] opened Oct 26, 2026Bot·

  ·
  1

  

• security: SNYK-JAVA-ORGAPACHECOMMONS-6254296: bump commons-compress 1.24.0 to 1.26.0 in custody-gateway (CVE-2024-25710)

  cve-2026-82329-response
  #84·devin-ai-integration[bot] opened Oct 26, 2026Bot·

  ·
  1

  

• security: SNYK-SECRET-ARDEN-0418: remove hard-coded Artifactory token, move CI to ci-shared-workflows@v4 OIDC

  cve-2026-82329-response
  #83·devin-ai-integration[bot] opened Oct 26, 2026Bot·

  ·
  1

  

• feature: SETTLE-4471 T+1 tranche 1 — iso20022-fix-messages

  #82·devin-ai-integration[bot] opened Oct 26, 2026Bot·

  ·
  3

  

• feature: SETTLE-4471 T+1 tranche 1 — settlement-instruction-service

  #81·devin-ai-integration[bot] opened Oct 26, 2026Bot·

  ·
  1

  

• feature: SETTLE-4471 T+1 tranche 1 — core-dates 1.4.2 (trade-date gated cycle)

  #80·devin-ai-integration[bot] opened Oct 26, 2026Bot·

  ·
  5

  

• [demo example, always open] SNYK-JAVA-ORGAPACHECOMMONS-6254296: bump commons-compress to 1.26.0 in custody-gateway (CVE-2024-25710)

  #79·devin-ai-integration[bot] opened Oct 26, 2026Bot·

  ·
  1

  

• [demo example, always open] SNYK-SECRET-ARDEN-0418: remove hard-coded Artifactory token, move CI to ci-shared-workflows@v4 OIDC

  #78·devin-ai-integration[bot] opened Oct 26, 2026Bot·

  ·
  1

  

• [demo example, always open] SNYK-JAVA-ORGYAML-3152153: pin core-dates 1.4.1 to fix embedded snakeyaml CVE-2022-1471

  #77·devin-ai-integration[bot] opened Oct 26, 2026Bot·

  ·
  1

  

• swarm example (RACE-1): Replayed or duplicate settlement instruction settles the same trade twice

  #61·devin-ai-integration[bot] opened Oct 23, 2026Bot·

  ·
  2

• Quarterly PCI rescan tooling: diff vs prior quarter, risk routing, evidence pack

  #36·GarretAnd opened Oct 13, 2026·

  ·
  14

  

• swarm(SUPPLY-4): Kafka consumer decodes LZ4 with archived lz4-java 1.8.0 (CVE-2025-12183/66566)

  #35·GarretAnd opened Oct 12, 2026·

  ·
  1

  

• swarm(SUPPLY-3): spring-kafka 3.3.2 header mapper trusts JDK subpackages on listener path (CVE-2026-41731)

  #34·GarretAnd opened Oct 12, 2026·

  ·
  1

  

• swarm(SUPPLY-1): Tomcat 10.1.34 multipart part-flood DoS reachable on all routes (CVE-2025-48988)

  #33·GarretAnd opened Oct 12, 2026·

  ·
  1

  

• swarm(INJECT-4): Second-order injection: markup, control characters and formulas in symbol are published to Kafka and persisted

  #32·GarretAnd opened Oct 12, 2026·

  ·
  1

  

• swarm(RACE-4): park trades that exhaust retries on a dead-letter topic

  #31·GarretAnd opened Oct 12, 2026·

  ·
  4

  

• swarm(INJECT-3): Kafka header injection: producer-supplied __TypeId__ chooses the type the consumer deserializes

  #30·GarretAnd opened Oct 12, 2026·

  ·
  1

  

• swarm(RACE-3): only acknowledge a trade after the broker confirms the send

  #29·GarretAnd opened Oct 12, 2026·

  ·
  8

  

• swarm(INJECT-2): Log forging: CR/LF in trade fields injects fake lines into the consumer log

  #28·GarretAnd opened Oct 12, 2026·

  ·
  4

  

• swarm(RACE-2): honor Idempotency-Key so retried submissions book one trade

  #27·GarretAnd opened Oct 12, 2026·

  ·
  6

  

• swarm(INJECT-1): Reflected script injection: symbol echoed into a text/html response by /api/trade/sendTrade

  #26·GarretAnd opened Oct 12, 2026·

  ·
  1

  

• swarm(RACE-1): make the trade consumer idempotent under Kafka redelivery

  #25·GarretAnd opened Oct 12, 2026·

  ·
  1

  

• swarm(LOGIC-6): Malformed, oversized, or whitespace-padded symbols booked as distinct instruments

  #24·GarretAnd opened Oct 12, 2026·

  ·
  6

  

• swarm(LOGIC-5): Sub-tick and denormal prices (4.9E-324, 1e-8, 9 decimals) accepted

  #23·GarretAnd opened Oct 12, 2026·

  ·
  6

  

• swarm(LOGIC-4): Consumer persists unvalidated trades from the topic (negative quantity, zero/NaN price, null symbol/tradeId)

  #22·GarretAnd opened Oct 12, 2026·

  ·
  4