fix(deps): clear 14 Dependabot alerts (netty 4.1.136, jackson 2.21.5, log4j 2.25.5)

[jhamon]

Clears all 14 open Dependabot alerts on this repo. Three distinct root causes, split across two commits.

Netty 4.1.135 → 4.1.136.Final — 10 alerts, 5 high

Module	CVEs
netty-codec	CVE-2026-59901 (high)
netty-codec-http	CVE-2026-55831, CVE-2026-55833, CVE-2026-56745 (high); CVE-2026-56746, CVE-2026-59898, CVE-2026-59899, CVE-2026-59921
netty-codec-http2	CVE-2026-56819 (high), CVE-2026-59900

Only netty-codec-http2 is declared directly; netty-codec and netty-codec-http resolve transitively beneath it, so the single nettyVersion bump covers all three modules. Confirmed via gradlew dependencies that every resolved Netty artifact is now 4.1.136.Final.

Deliberately not taking Dependabot's suggested 4.2.17.Final (#227). grpc-netty 1.60.2 is built against Netty 4.1, and 4.2 reworked the buffer allocator and IoHandler APIs that grpc-netty binds to. 4.1.136 clears every Netty alert without that compatibility risk. #227 becomes redundant once this lands and should be closed.

jackson-databind 2.21.4 → 2.21.5 — 3 medium alerts

Includes CVE-2026-54515 and CVE-2026-59889. jackson-core moved in lockstep to keep the bom aligned.

log4j 2.20.0 → 2.25.5 — 1 medium alert

CVE-2026-49844. This one is not in the published artifact: Shadow 8.1.1 drags log4j-core:2.20.0 (→ log4j-api:2.20.0) onto the buildscript classpath. Pinned in the existing resolutionStrategy block alongside the commons-io / plexus-utils pins added in dc1e213, so the fix follows the established pattern.

Verification

• gradle clean build compileIntegrationTestJava on Temurin 17 — BUILD SUCCESSFUL, 90/90 tests pass
• Shaded jar builds and still contains the relocated Netty classes, so the META-INF/versions/21 exclusion still holds with jackson 2.21.5
• integrationTest not run locally — needs PINECONE_API_KEY and hits live infrastructure; CI will cover it
• Only JDK 17 is installed locally, so the Java 8/11/16 CI matrix legs are unverified here. No language or dependency baseline changed, so no trouble expected.

---

Note

Low Risk
Patch-level dependency version updates for known CVEs; grpc-netty compatibility is explicitly preserved by avoiding Netty 4.2.

Overview
Security-only dependency bumps in build.gradle to clear 14 Dependabot alerts—no application code changes.

Netty stays on 4.1.136.Final (not 4.2.x) so grpc-netty 1.60.2 compatibility is preserved; the single nettyVersion bump covers transitive netty-codec / netty-codec-http modules. Jackson databind and core move together to 2.21.5 (implementation and test). Log4j 2.25.5 is forced on the Shadow plugin buildscript classpath only (not the published client).

Comments document CVE fixes and the rationale for remaining on Netty 4.1.

^{Reviewed by Cursor Bugbot for commit 4b723bc. Bugbot is set up for automated code reviews on this repo. Configure here.}