RHEcosystemAppEng · tmihalac · Apr 14, 2026 · Mar 10, 2026 · Mar 11, 2026 · Mar 15, 2026
diff --git a/.tekton/on-cm-runner.yaml b/.tekton/on-cm-runner.yaml
@@ -120,11 +120,11 @@ spec:
               resources:
                 requests:
                   cpu: "1000m"      # CPU request (1 core)
-                  memory: "8Gi"     # Memory request (8 gigabytes)
+                  memory: "12Gi"     # Memory request (8 gigabytes)
                 limits:
                   cpu: "2000m"      # CPU limit (2 cores)
-                  memory: "16Gi"    # Memory limit (16 gigabytes)
-              
+                  memory: "32Gi"    # Memory limit (16 gigabytes)
+
               volumeMounts:
               - name: google-creds-volume
                 mountPath: /etc/secrets/google
@@ -142,7 +142,7 @@ spec:
                     name: server-model-config
                 - secretRef:
                     name: redhat-app-creds
-              
+
               env:
                 - name: GOTOOLCHAIN
                   value: "auto"
@@ -180,7 +180,9 @@ spec:
                   value: cve_agent
                 - name: OTEL_TRACES_ENDPOINT
                   value: http://localhost:4318/v1/traces
-
+                - name: JAVA_MAVEN_DEFAULT_SETTINGS_FILE_PATH
+                  value: $(workspaces.source.path)/kustomize/base/settings.xml
+
               script: |
                 #!/bin/sh
                 set -e
@@ -274,7 +276,7 @@ spec:
                 initialDelaySeconds: 5
 
             - name: otel-collector
-              image: otel/opentelemetry-collector-contrib:latest
+              image: otel/opentelemetry-collector-contrib:0.148.0
               # Mount your otel-config.yaml here via a ConfigMap
               volumeMounts:
                 - name: otel-config-volume

diff --git a/.tekton/on-pull-request.yaml b/.tekton/on-pull-request.yaml
@@ -164,6 +164,8 @@ spec:
               env:
                 - name: TARGET_BRANCH_NAME
                   value: "{{target_branch}}"
+                - name: JAVA_MAVEN_DEFAULT_SETTINGS_FILE_PATH
+                  value: $(workspaces.source.path)/kustomize/base/settings.xml
               image: registry.access.redhat.com/ubi9/python-312:9.6
               workingDir: $(workspaces.source.path)
               script: |
@@ -184,12 +186,15 @@ spec:
                 source .venv/bin/activate
 
                 print_banner "INSTALLING DEPENDENCIES"
+                # Add the current directory to git's safe directories before uv sync,
+                # because setuptools-scm needs git access for version introspection.
+                git config --global --add safe.directory /workspace/source
                 uv sync
 
                 # Install Java
                 JAVA_ARCH="x64"
-                JDK_URL="https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.2%2B9/OpenJDK22U-jdk_${JAVA_ARCH}_linux_hotspot_22.0.2_9.tar.gz"
-                JDK_DIR="jdk-22.0.2+9"
+                JDK_URL="https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.18%2B8/OpenJDK17U-jdk_${JAVA_ARCH}_linux_hotspot_17.0.18_8.tar.gz"
+                JDK_DIR="jdk-17.0.18+8"
 
                 echo ">> Downloading $JDK_URL"
                 mkdir -p /tekton/home/jdk
@@ -245,7 +250,6 @@ spec:
                 # This is handled in the Makefile's lint-pr target and should be reverted after migration.
                 make lint-pr TARGET_BRANCH=$TARGET_BRANCH_NAME
 
-
                 print_banner "RUNNING UNIT TESTS"
                 make test-unit PYTEST_OPTS="--log-cli-level=DEBUG"
 

diff --git a/Dockerfile b/Dockerfile
@@ -66,8 +66,8 @@ ENV PATH="/opt/nodejs/bin:${PATH}"
 RUN node --version && npm --version
 
 # --- Temurin JDK 22 (amd64/x86_64) ---
-ARG JDK_URL="https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.2%2B9/OpenJDK22U-jdk_x64_linux_hotspot_22.0.2_9.tar.gz"
-ARG JDK_DIR="jdk-22.0.2+9"
+ARG JDK_URL="https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.18%2B8/OpenJDK17U-jdk_x64_linux_hotspot_17.0.18_8.tar.gz"
+ARG JDK_DIR="jdk-17.0.18+8"
 RUN mkdir -p /opt/jdk \
  && curl -fsSL -o /tmp/jdk.tgz "${JDK_URL}" \
  && tar -C /opt/jdk -xzf /tmp/jdk.tgz \
@@ -128,4 +128,4 @@ RUN --mount=type=cache,id=uv_cache,target=/root/.cache/uv,sharing=locked \
     source /workspace/.venv/bin/activate
 
 
-CMD ["jupyter-lab", "--no-browser", "--allow-root", "--ip='*'", "--port=8000", "--NotebookApp.token=''", "--NotebookApp.password=''"]
+CMD ["jupyter-lab", "--no-browser", "--allow-root", "--ip='*'", "--port=8000", "--NotebookApp.token=''", "--NotebookApp.password=''"]
diff --git a/kustomize/base/exploit-iq-config.yml b/kustomize/base/exploit-iq-config.yml
@@ -67,6 +67,8 @@ functions:
     enable_functions_usage_search: true
   Function Locator:
     _type: package_and_function_locator
+  Function Library Version Finder:
+    _type: calling_function_library_version_finder
   Code Semantic Search:
     _type: local_vdb_retriever
     embedder_name: nim_embedder
@@ -98,6 +100,7 @@ functions:
       - Call Chain Analyzer
       - Function Caller Finder
       - Function Locator
+      - Function Library Version Finder
     max_concurrency: null
     max_iterations: 10
     prompt_examples: false

diff --git a/kustomize/base/exploit_iq_service.yaml b/kustomize/base/exploit_iq_service.yaml
@@ -132,13 +132,13 @@ spec:
                   key: credential-encryption-key
             - name: CLIENT_BACKEND_URL
               value: https://exploit-iq-client.$(NAMESPACE).svc.cluster.local:8443
-            - name: NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
+            - name: JAVA_MAVEN_DEFAULT_SETTINGS_FILE_PATH
+              value: /maven-config/settings.xml
           volumeMounts:
             - name: config
               mountPath: /configs
+            - name: maven-settings-config
+              mountPath: /maven-config
             - name: cache
               mountPath: /exploit-iq-data
             - name: package-cache
@@ -150,6 +150,9 @@ spec:
         - name: config
           configMap:
             name: exploit-iq-config
+        - name: maven-settings-config
+          configMap:
+            name: exploit-iq-maven-settings-config
         - name: cache
           persistentVolumeClaim:
             claimName: exploit-iq-data

diff --git a/kustomize/base/kustomization.yaml b/kustomize/base/kustomization.yaml
@@ -69,6 +69,9 @@ configMapGenerator:
     files:
       - excludes.json
       - includes.json
+  - name: exploit-iq-maven-settings-config
+    files:
+      - settings.xml
 
 patches:
   - path: ips-patch.json

diff --git a/kustomize/base/settings.xml b/kustomize/base/settings.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<settings xmlns="http://maven.apache.org/SETTINGS/1.2.0"
+          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.2.0
+                              https://maven.apache.org/xsd/settings-1.2.0.xsd">
+    <profiles>
+        <profile>
+            <id>red-hat</id>
+            <repositories>
+                <repository>
+                    <id>red-hat-ga</id>
+                    <url>https://maven.repository.redhat.com/ga</url>
+                </repository>
+                <repository>
+                    <id>jboss-public-repository-group</id>
+                    <name>JBoss Public Maven Repository Group</name>
+                    <url>https://repository.jboss.org/nexus/content/groups/public/</url>
+                    <layout>default</layout>
+                    <releases>
+                        <enabled>true</enabled>
+                        <updatePolicy>never</updatePolicy>
+                    </releases>
+                    <snapshots>
+                        <enabled>true</enabled>
+                        <updatePolicy>never</updatePolicy>
+                    </snapshots>
+                </repository>
+            </repositories>
+            <pluginRepositories>
+                <pluginRepository>
+                    <id>red-hat-ga</id>
+                    <url>https://maven.repository.redhat.com/ga</url>
+                    <releases>
+                        <enabled>true</enabled>
+                    </releases>
+                    <snapshots>
+                        <enabled>false</enabled>
+                    </snapshots>
+                </pluginRepository>
+            </pluginRepositories>
+        </profile>
+    </profiles>
+    <activeProfiles>
+        <activeProfile>red-hat</activeProfile>
+    </activeProfiles>
+
+    <mirrors>
+        <!-- Override Maven's built-in "maven-default-http-blocker" by reusing the same id,
+             but making it not match external:http:* anymore. -->
+        <mirror>
+            <id>maven-default-http-blocker</id>
+            <name>Disabled default HTTP blocker</name>
+
+            <!-- Make this mirror effectively never apply -->
+            <mirrorOf>__no_such_repo_id__</mirrorOf>
+
+            <!-- URL is irrelevant if mirrorOf never matches, but must be present -->
+            <url>https://repo1.maven.org/maven2</url>
+        </mirror>
+    </mirrors>
+
+</settings>
diff --git a/kustomize/config-http-openai-local.yml b/kustomize/config-http-openai-local.yml
@@ -83,6 +83,8 @@ functions:
      max_retries: 5
   Container Analysis Data:
     _type: container_image_analysis_data
+  Function Library Version Finder:
+    _type: calling_function_library_version_finder
   cve_agent_executor:
     _type: cve_agent_executor
     llm_name: cve_agent_executor_llm
@@ -94,6 +96,7 @@ functions:
       - Call Chain Analyzer
       - Function Caller Finder
       - Function Locator
+      - Function Library Version Finder
     max_concurrency: null
     max_iterations: 10
     prompt_examples: false

diff --git a/otel-config.yaml b/otel-config.yaml
@@ -16,8 +16,9 @@ exporters:
   # 2. Export to Redpanda (Kafka)
   kafka:
     brokers: ["redpanda:29092"] # Use the internal Docker port
-    topic: "otel-traces"
-    encoding: otlp_json # This makes it MUCH easier for your Python script to read
+    traces:
+      topic: "otel-traces"
+      encoding: otlp_json # This makes it MUCH easier for your Python script to read
 
 service:
   pipelines: