fix(deps): snakeyaml 2.4 (CVE-2022-1471 RCE) and aws-sdk 1.12.797 (removes ion-java)

[bpalermo]

Summary

Clears the last fixable Dependabot alerts (follow-up to #21/#22):

Change	Fixes	Why
snakeyaml 1.33 → 2.4 (core, http, thrift)	#113, #149, #164 — CVE-2022-1471 Constructor RCE (high)	Fixed only in the 2.x line. util-security's YAML usage survives the 2.x API change — validated by the test suites.
aws-java-sdk-s3/core 1.12.261 → 1.12.797 (thrift dev profile)	#170 — ion-java CVE-2024-21634 (high)	1.12.261 pulls software.amazon.ion:ion-java, whose coordinates are abandoned (no patched release exists — the fix lives under com.amazon.ion). 1.12.797 dropped ion-java entirely, so the vulnerable artifact leaves the tree.

Validation

• Midje suites pass: core 114, http 34, thrift 13 checks.
• The thrift suite performs the real S3 keystore download via tls-extensions, exercising aws-sdk 1.12.797 end-to-end.
• lein classpath confirms snakeyaml 2.4 resolves in all three modules and ion-java is gone from thrift.

After this merges, every remaining open alert is a justified dismissal (jackson CVE-2026-54515 with no patched release; libthrift capped at 0.12.0 by scrooge codegen compatibility, with the vulnerable TSSLTransport path unused since finagle-thrift does TLS via Netty).

🤖 Generated with Claude Code

[bookworm-app]

Hi. 👋

I'm bookworm and I'll help you merge your change.

You can post a comment on this PR with one of the following commands:

bookworm/release-it

1. Add exactly one of the following labels to this PR: major, minor, patch.

2. Fill the Changelog: section of the PR description.

3. Wait until the checks have passed (except for the Bookworm check, which will be completed once the release is done).

4. Ensure someone has approved the PR.

5. Comment bookworm/release-it on this PR.

I'll take care of updating CHANGELOG.md, bumping project.clj and merging this PR.

Note: a stable version will be generated (that is Bumpito will update to it).

bookworm/release-beta

1. Add exactly one of the following labels to this PR: major, minor, patch.

2. Comment bookworm/release-beta on this PR.

I'll take care of generating a beta version based on these changes and
when it finishes I'll post a comment with the version that was generated.

bookworm/skip-release

This command should be used if you are changing something other than production code or docstrings that engineers can
see in their IDEs (e.g. README, CHANGELOG, tests, etc).

1. Wait until all the checks have passed and someone has approved the PR.

2. Comment bookworm/skip-release on this PR.

I'll take care of merging this PR.

---

If you have any problem, please reach my creators at #shared-libraries-and-tools

[Copilot]

Pull request overview

This PR updates dependency pins across the finagle-clojure modules to resolve remaining fixable Dependabot security alerts, primarily by moving SnakeYAML to the 2.x line (for CVE-2022-1471) and updating the AWS Java SDK used by the thrift dev profile to remove the vulnerable ion-java artifact from the dependency tree.

Changes:

• Bump org.yaml/snakeyaml from 1.33 → 2.4 in core, http, and thrift.
• Bump com.amazonaws/aws-java-sdk-s3 and com.amazonaws/aws-java-sdk-core from 1.12.261 → 1.12.797 in the thrift dev profile.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
core/project.clj	Pins SnakeYAML to 2.4 to address CVE-2022-1471 in the core module dependency tree.
http/project.clj	Pins SnakeYAML to 2.4 to address CVE-2022-1471 in the HTTP module dependency tree.
thrift/project.clj	Pins SnakeYAML to 2.4 and bumps AWS SDK S3/Core to 1.12.797 in the dev profile to eliminate ion-java.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.