Add userMetadata (#874)

* Add userMetadata

* update dependecies

* Fix OWASP dependency check rate-limiting and H2 corruption in CI/CD

* Revert "Fix OWASP dependency check rate-limiting and H2 corruption in CI/CD"

This reverts commit f9100f0.

* test

Author: symphony-enrico

.github/workflows/cve-scanning-gradle.yml

@@ -31,4 +31,6 @@ jobs:
       - name: CVEs
         # Using --no-daemon is a good practice in CI environments
         # It prevents potential conflicts or statefulness between job runs.
+        env:
+          NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
         run: ./gradlew dependencyCheckAggregate --no-daemon -PdependencyCheck.nvd.apiKey=${{ secrets.NVD_API_KEY }}

build.gradle

@@ -61,4 +61,11 @@ repositories {
 dependencyCheck {
     failBuildOnCVSS=5
     suppressionFile="./allow-list.xml"
+    data {
+        directory = "${buildDir}/dependency-check-data"
+    }
+    nvd {
+        apiKey = System.getenv("NVD_API_KEY") ?: (project.findProperty("dependencyCheck.nvd.apiKey") ?: "")
+        delay = apiKey ? 2000 : 16000
+    }
 }

symphony-bdk-bom/build.gradle

@@ -24,7 +24,7 @@ dependencies {
     // import Log4j's BOM
     api platform('org.apache.logging.log4j:log4j-bom:2.26.0')
     // override Netty (Spring Boot 3.5.14 ships 4.1.132 which is still vulnerable to CVE-2026-41417)
-    api platform('io.netty:netty-bom:4.1.133.Final')
+    api platform('io.netty:netty-bom:4.1.134.Final')
 
     // define all our dependencies versions
     constraints {
@@ -45,6 +45,11 @@ dependencies {
 
         // External dependencies
 
+        // override Tomcat (Spring Boot 3.5.14 ships 10.1.54 which is vulnerable to multiple CVEs)
+        api 'org.apache.tomcat.embed:tomcat-embed-core:10.1.55'
+        api 'org.apache.tomcat.embed:tomcat-embed-el:10.1.55'
+        api 'org.apache.tomcat.embed:tomcat-embed-websocket:10.1.55'
+
         api 'org.apiguardian:apiguardian-api:1.1.2'
 
         api 'org.slf4j:slf4j-api:2.0.9'

symphony-bdk-core/build.gradle

@@ -78,7 +78,7 @@ dependencies {
 }
 
 // OpenAPI code generation
-def apiBaseUrl = "https://raw.githubusercontent.com/finos/symphony-api-spec/332b01730c016a26277d89c6525398df20b17613"
+def apiBaseUrl = "https://raw.githubusercontent.com/finos/symphony-api-spec/d369d95254d6df3451d053340b1b25478b95e57b"
 def generatedFolder = "$buildDir/generated/openapi"
 def apisToGenerate = [
         Agent: 'agent/agent-api-public-deprecated.yaml',

symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/user/mapper/UserDetailMapper.java

@@ -22,5 +22,6 @@ public interface UserDetailMapper {
   @Mapping(target = "userAttributes.instrument", ignore = true)
   @Mapping(target = "userAttributes.currentKey", ignore = true)
   @Mapping(target = "userAttributes.previousKey", ignore = true)
+  @Mapping(target = "userAttributes.userMetadata", ignore = true)
   V2UserDetail userDetailToV2UserDetail(UserDetail userDetail);
 }