Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update README.md #1

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Update README.md #1

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
25805d1
Update README.md
BrittanyIstenes Aug 9, 2023
be91e93
Merge branch 'main' into BrittanyIstenes-patch-1
BrittanyIstenes Jun 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@

The Clean Dependency Project is Fannie Mae’s first open source project with a clear vision to provide clean OSS libraries to the products that we care about.

We started the Cleand Dependency Project to solve the problem of open source dependencies reporting a high and/or critical vulnerabilities, with a CVSS score of 9+ and no pubished fixes that patches these vulneralbilties. As our first step, we want to change these libraries to reduce the vulnerability surface area and second publish these patches publically so that others can benefit from the community work as well as contribute patches of their own.

There is an immediate concern with the consumption of OSS libraries that we rely on with no clear upgrade path. The main goal is to clean these dependencies and vulnerabilities with patch management with the most recent versions to push back upstream into our projects as well as the external community.

Some of the projects and dependencies we will be working on cleaning are:
Expand All @@ -12,11 +14,9 @@ Some of the projects and dependencies we will be working on cleaning are:
* Pandas
* snakeyaml

Versions that need updating:

* spring-framework : 5.3.x
* pandas : 1.5.2
* snakeyaml : 1.33

If you would like to give back to this project, please read our [contributing guide](https://github.com/Clean-Dependency-Project/clean-dependency-project/blob/main/CONTRIBUTING.md) and visit our open issues to get started.
If you would like to give back to this project, please read our [contributing guide](https://github.com/Clean-Dependency-Project/clean-dependency-project/blob/main/CONTRIBUTING.md) and visit our open issues to get started.

If you would like to file an enhancement request or your own issues, please read through our [CODE OF CONDUCT](https://github.com/Clean-Dependency-Project/clean-dependency-project/blob/main/CODE_OF_CONDUCT.md) and file an issued based on type [here](https://github.com/Clean-Dependency-Project/clean-dependency-project/issues).