ISSUE: #49 - Update math libraries

[brendanarnold]

Addresses issue #49

docker scan polis-math:latest now results in 2 low severity issues in the Alpine Docker base image and 1 low in polis-math

• Move metasaurus/oz to a developer dependency (removes vulnerable protobuf-java, netty-codec, jetty-http in ring, soup, snakeyaml from production code)
• Remove AWS housekeeping code and vulnerable amazonica and other AWS libraries (removes vulnerable guava, nippy, httpclient)
• Updated postgresql library to 42.5.1
• Update semantic-csv already at latest (uses vulnerable gson and protobuf-java)
• Update korma already at latest (uses vulnerable c3p0)
• Update commons/collection to 3.2.2
• Update cli-excel (uses vulnerable poi)
• Update ring (uses vulnerable jetty-http)
• Update clj-http to 3.12.3 (uses vulnerable commons-codec)
• Update clojure/tools
• Included MATH_ENV variable in template - necessary for data export
• Update docs to reflect not needing to install all the dependencies before running math

[metasoarous]

You may have done this because the default ubuntu base has become problematic (I ran into this recently). I have a preference for sticking with a debian base, for familiarity sake as much as anything, but this is something we can discuss.

[brendanarnold]

Yes its because Debian and Ubuntu both have a huge amount of dependencies that are considered vulnerable in our governance tests - I'd like to keep our production system using Alpine becuase of this minimal approach.

[metasoarous]

I don't think these are needed any more and can be deleted. This was for when the server directly made web requests to an the darwin server, which ran from the math codebase (but wasn't the same as the polling process). Now, export requests are handled through messasges sent through the postgres db.

[metasoarous]

@brendanarnold FYI: A similar update has been merged into the edge branch at #compdemocracy/polis. Will probably be doing some additional work soon to pull out some libraries that aren't being used anymore.

Thanks!

[brendanarnold]

@brendanarnold FYI: A similar update has been merged into the edge branch at #compdemocracy/polis. Will probably be doing some additional work soon to pull out some libraries that aren't being used anymore.

Thanks @metasoarous good to know - there are a couple of vulnerabilities that are from semantic-csv that would be good to squash - I've put an issue against that repo here metasoarous/semantic-csv#75 it looks like a version bump on clojurescript should do it.