Bump nettyVersion from 4.1.135.Final to 4.2.17.Final - #227
Bump nettyVersion from 4.1.135.Final to 4.2.17.Final#227dependabot[bot] wants to merge 1 commit into
Conversation
Bumps `nettyVersion` from 4.1.135.Final to 4.2.17.Final. Updates `io.netty:netty-codec-http2` from 4.1.135.Final to 4.2.17.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.135.Final...netty-4.2.17.Final) Updates `io.netty:netty-handler-proxy` from 4.1.135.Final to 4.2.17.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.135.Final...netty-4.2.17.Final) Updates `io.netty:netty-transport-native-unix-common` from 4.1.135.Final to 4.2.17.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.135.Final...netty-4.2.17.Final) --- updated-dependencies: - dependency-name: io.netty:netty-codec-http2 dependency-version: 4.2.17.Final dependency-type: direct:production - dependency-name: io.netty:netty-handler-proxy dependency-version: 4.2.17.Final dependency-type: direct:production - dependency-name: io.netty:netty-transport-native-unix-common dependency-version: 4.2.17.Final dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 2f1e9ae. Configure here.
| // to CVE-2025-24970). grpc-netty does not pin a patched Netty even in recent releases, so we | ||
| // pin Netty directly here. Bump alongside grpc when grpc itself ships a patched Netty. | ||
| def nettyVersion = '4.1.135.Final' | ||
| def nettyVersion = '4.2.17.Final' |
There was a problem hiding this comment.
Incompatible Netty major version bump
High Severity
nettyVersion jumps from 4.1.135.Final to 4.2.17.Final while grpc-netty stays at 1.60.2, which targets Netty 4.1 and uses unstable Netty HTTP/2 APIs. That mismatch can cause runtime failures such as NoSuchMethodError. These modules are also api deps, so consumers are forced onto Netty 4.2, which cannot coexist with 4.1. A safer pin (for example 4.1.137.Final) remains available; Netty 4.2 support landed in grpc-java 1.83.0.
Triggered by project rule: Code Review Guidance
Reviewed by Cursor Bugbot for commit 2f1e9ae. Configure here.
|
Closing in favor of #229, which supersedes this. #229 bumps Netty to #229 also covers the jackson-databind and (build-time) log4j alerts, and is green across all 13 checks including both integration-test legs. For the record, the integration-test failures on this PR were not caused by the Netty bump — they're a secrets-scoping artifact. Dependabot-triggered runs don't read Actions secrets, so |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
… log4j 2.25.5) (#229) Clears all 14 open Dependabot alerts on this repo. Three distinct root causes, split across two commits. ## Netty 4.1.135 → 4.1.136.Final — 10 alerts, 5 high | Module | CVEs | |---|---| | `netty-codec` | CVE-2026-59901 (high) | | `netty-codec-http` | CVE-2026-55831, CVE-2026-55833, CVE-2026-56745 (high); CVE-2026-56746, CVE-2026-59898, CVE-2026-59899, CVE-2026-59921 | | `netty-codec-http2` | CVE-2026-56819 (high), CVE-2026-59900 | Only `netty-codec-http2` is declared directly; `netty-codec` and `netty-codec-http` resolve transitively beneath it, so the single `nettyVersion` bump covers all three modules. Confirmed via `gradlew dependencies` that every resolved Netty artifact is now `4.1.136.Final`. **Deliberately not taking Dependabot's suggested 4.2.17.Final** (#227). grpc-netty 1.60.2 is built against Netty 4.1, and 4.2 reworked the buffer allocator and `IoHandler` APIs that grpc-netty binds to. 4.1.136 clears every Netty alert without that compatibility risk. #227 becomes redundant once this lands and should be closed. ## jackson-databind 2.21.4 → 2.21.5 — 3 medium alerts Includes CVE-2026-54515 and CVE-2026-59889. `jackson-core` moved in lockstep to keep the bom aligned. ## log4j 2.20.0 → 2.25.5 — 1 medium alert CVE-2026-49844. This one is **not in the published artifact**: Shadow 8.1.1 drags `log4j-core:2.20.0` (→ `log4j-api:2.20.0`) onto the *buildscript* classpath. Pinned in the existing `resolutionStrategy` block alongside the commons-io / plexus-utils pins added in dc1e213, so the fix follows the established pattern. ## Verification - `gradle clean build compileIntegrationTestJava` on Temurin 17 — **BUILD SUCCESSFUL, 90/90 tests pass** - Shaded jar builds and still contains the relocated Netty classes, so the `META-INF/versions/21` exclusion still holds with jackson 2.21.5 - `integrationTest` **not** run locally — needs `PINECONE_API_KEY` and hits live infrastructure; CI will cover it - Only JDK 17 is installed locally, so the Java 8/11/16 CI matrix legs are unverified here. No language or dependency baseline changed, so no trouble expected. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Patch-level dependency version updates for known CVEs; grpc-netty compatibility is explicitly preserved by avoiding Netty 4.2. > > **Overview** > **Security-only dependency bumps in `build.gradle`** to clear 14 Dependabot alerts—no application code changes. > > **Netty** stays on **4.1.136.Final** (not 4.2.x) so grpc-netty 1.60.2 compatibility is preserved; the single `nettyVersion` bump covers transitive `netty-codec` / `netty-codec-http` modules. **Jackson** `databind` and `core` move together to **2.21.5** (implementation and test). **Log4j** **2.25.5** is **forced** on the Shadow plugin **buildscript** classpath only (not the published client). > > Comments document CVE fixes and the rationale for remaining on Netty 4.1. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 4b723bc. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
1 participant
Bumps
nettyVersionfrom 4.1.135.Final to 4.2.17.Final.Updates
io.netty:netty-codec-http2from 4.1.135.Final to 4.2.17.FinalRelease notes
Sourced from io.netty:netty-codec-http2's releases.
... (truncated)
Commits
e0789d3[maven-release-plugin] prepare release netty-4.2.17.Final1b5abc6Merge changes from forks (#17213)36fbf57Update surefire plugin to latest version (#17210)a96226cAdd.editorconfigto enforce consistent coding style (#17052)14a4e6aOpenSSL: Allow to obtain used named group via OpenSslSession (#17058)26255b1Weakly reference engines from the OpenSSL engine map (#17199)ae41417HttpServerCodec: do not consume the method queue for 1xx interim responses ...41f1db5Do not write WebSocket handshake response to the tail of the pipeline (#17192)035d76eUpdate compress-lzf to 1.2.1 (#17194)7681affFix JdkZlibDecompressor losing the tail of highly compressible streams (#17191)Updates
io.netty:netty-handler-proxyfrom 4.1.135.Final to 4.2.17.FinalRelease notes
Sourced from io.netty:netty-handler-proxy's releases.
... (truncated)
Commits
e0789d3[maven-release-plugin] prepare release netty-4.2.17.Final1b5abc6Merge changes from forks (#17213)36fbf57Update surefire plugin to latest version (#17210)a96226cAdd.editorconfigto enforce consistent coding style (#17052)14a4e6aOpenSSL: Allow to obtain used named group via OpenSslSession (#17058)26255b1Weakly reference engines from the OpenSSL engine map (#17199)ae41417HttpServerCodec: do not consume the method queue for 1xx interim responses ...41f1db5Do not write WebSocket handshake response to the tail of the pipeline (#17192)035d76eUpdate compress-lzf to 1.2.1 (#17194)7681affFix JdkZlibDecompressor losing the tail of highly compressible streams (#17191)Updates
io.netty:netty-transport-native-unix-commonfrom 4.1.135.Final to 4.2.17.FinalRelease notes
Sourced from io.netty:netty-transport-native-unix-common's releases.
... (truncated)
Commits
e0789d3[maven-release-plugin] prepare release netty-4.2.17.Final1b5abc6Merge changes from forks (#17213)36fbf57Update surefire plugin to latest version (#17210)a96226cAdd.editorconfigto enforce consistent coding style (#17052)14a4e6aOpenSSL: Allow to obtain used named group via OpenSslSession (#17058)26255b1Weakly reference engines from the OpenSSL engine map (#17199)ae41417HttpServerCodec: do not consume the method queue for 1xx interim responses ...41f1db5Do not write WebSocket handshake response to the tail of the pipeline (#17192)035d76eUpdate compress-lzf to 1.2.1 (#17194)7681affFix JdkZlibDecompressor losing the tail of highly compressible streams (#17191)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Medium Risk
Netty 4.1→4.2 affects gRPC networking/SSL paths for all library consumers; scope is dependency-only but behavior changes in the transport stack warrant regression testing.
Overview
Updates the pinned
nettyVersioninbuild.gradlefrom 4.1.135.Final to 4.2.17.Final, so all existing direct Nettyapipins (netty-codec-http2,netty-handler-proxy,netty-transport-native-unix-common) resolve to the newer line instead of 4.1.x.This keeps the intentional override of gRPC’s transitive Netty (still on grpc 1.60.2) while moving published/consumed Netty artifacts to a newer release that includes additional security and bug fixes beyond the prior 4.1 pin.
Reviewed by Cursor Bugbot for commit 2f1e9ae. Bugbot is set up for automated code reviews on this repo. Configure here.