Bump the netty group across 1 directory with 11 updates by dependabot[bot] · Pull Request #6878 · aws/aws-sdk-java-v2

dependabot · 2026-04-20T16:42:54Z

Bumps the netty group with 11 updates in the / directory:

Package	From	To
io.netty:netty-handler	`4.1.132.Final`	`4.2.13.Final`
io.netty:netty-transport	`4.1.132.Final`	`4.2.13.Final`
io.netty:netty-codec-http	`4.1.132.Final`	`4.2.13.Final`
io.netty:netty-codec-http2	`4.1.132.Final`	`4.2.13.Final`
io.netty:netty-codec	`4.1.132.Final`	`4.2.13.Final`
io.netty:netty-common	`4.1.132.Final`	`4.2.13.Final`
io.netty:netty-buffer	`4.1.132.Final`	`4.2.13.Final`
io.netty:netty-resolver	`4.1.132.Final`	`4.2.13.Final`
io.netty:netty-resolver-dns	`4.1.132.Final`	`4.2.13.Final`
io.netty:netty-transport-classes-epoll	`4.1.132.Final`	`4.2.13.Final`
io.netty:netty-tcnative-boringssl-static	`2.0.75.Final`	`2.0.77.Final`

Updates io.netty:netty-handler from 4.1.132.Final to 4.2.13.Final

Release notes

Sourced from io.netty:netty-handler's releases.

netty-4.2.13.Final

CVEs Fixed

CVE-2026-42586 (netty-codec-redis)

CVE-2026-42578 (netty-handler-proxy)

CVE-2026-42577 (netty-transport-native-epoll)

CVE-2026-42587 (netty-codec-http, netty-codec-http2)

CVE-2026-41417 (netty-codec-http)

CVE-2026-42581 (netty-codec-http)

CVE-2026-42580 (netty-codec-http)

CVE-2026-42585 (netty-codec-http)

CVE-2026-42579 (netty-codec-dns)

CVE-2026-42582 (netty-codec-http3)

CVE-2026-42583 (netty-codec, netty-codec-compression)

CVE-2026-42584 (netty-codec-http)

CVE-2026-44248 (netty-codec-mqtt)

What's Changed

Kqueue: sendfile EINTR doesn't advance offset — data duplication by @normanmaurer in netty/netty#16544

Replace usage of strerror with thread-safe alternative by @normanmaurer in netty/netty#16547

Fix implementation of strerror_r_xsi for GNU by @normanmaurer in netty/netty#16546

Lazy init ArrayList in DefaultHeaders.getAll by @doom369 in netty/netty#16526

Less logging in AWS-LC build by @chrisvest in netty/netty#16565

Ensure the CRYPTO_BUFFER_POOL is also freed when we fail creating the SSLContext by @normanmaurer in netty/netty#16545

Auto-port 4.2: Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by @netty-project-bot in netty/netty#16543

Avoid leak in PemReader on OutOfDirectMemoryError by @raipc in netty/netty#16551

IoUring: Disable test while we debug to unblock other builds by @normanmaurer in netty/netty#16581

Include user properties and subscription IDs in MqttProperties#isEmpty by @ShadowySpirits in netty/netty#16575

Native DNS resolver: Guard against malloc failures by @normanmaurer in netty/netty#16559

Auto-port 4.2: Increase timeouts for QuicChannelConnectTest by @netty-project-bot in netty/netty#16578

Fix parsing HTTP chunks with multiple extensions by @chrisvest in netty/netty#16579

Bump org.codehaus.plexus:plexus-utils from 3.4.2 to 4.0.3 in /codec-native-quic by @dependabot[bot] in netty/netty#16572

Revert to PR build to Ubuntu 22.04 by @chrisvest in netty/netty#16595

Native transports: Correctly create pipe when pipe2 is not supported by @normanmaurer in netty/netty#16592

Epoll: Cleanup code to always return negative value on failure by @normanmaurer in netty/netty#16591

Fix component search fast path by @yawkat in netty/netty#16548

Stabilize read-only toStringMultipleThreads1 by @chrisvest in netty/netty#16608

Stabilize more AbstractByteBufTests by @chrisvest in netty/netty#16611

Remove note about needing 256-bit for PQC by @chrisvest in netty/netty#16605

Stabilize testSessionInvalidate for Conscrypt by @chrisvest in netty/netty#16615

Quic: Correctly handle SSL_CTX_new failures by @normanmaurer in netty/netty#16622

Make LocalIoHandle public by @rdicroce in netty/netty#16621

Quic: Fix shadowing of variable which leads to incorrectly handling errors by @normanmaurer in netty/netty#16623

Auto-port 4.2: Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by @netty-project-bot in netty/netty#16629

Fix shutdownInput bug in kqueue for empty recv buffer by @chrisvest in netty/netty#16630

fix FFM address semantics in directBufferAddress by @dreamlike-ocean in netty/netty#16603

HTTP2: Ensure HTTP2 preface is always send as first message by @normanmaurer in netty/netty#16636

Move Http2FrameCodecSubClassTest to correct package by @normanmaurer in netty/netty#16640

Kqueue: Fix usage of LOCAL_PEERPID by @normanmaurer in netty/netty#16637

Avoid ArrayQueue allocation in HttpServerCodec by @doom369 in netty/netty#16596

Fix file descriptor reuse bug in kqueue by @chrisvest in netty/netty#16650

... (truncated)

Commits

b3844c8 [maven-release-plugin] prepare release netty-4.2.13.Final
82f47fa Merge commit from fork
ada0999 Merge commit from fork
b4051e2 Fix BrotliDecoder not forwarding all decompressed chunks
67207c1 Merge commit from fork
541ca7c Merge commit from fork
943edb3 Fix codec-dns tests
6459a28 Merge commit from fork
b4ba61b Fix checkstyle in HttpObjectDecoder
977661f Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-transport from 4.1.132.Final to 4.2.13.Final

Release notes

Sourced from io.netty:netty-transport's releases.

netty-4.2.13.Final

CVEs Fixed

CVE-2026-42586 (netty-codec-redis)

CVE-2026-42578 (netty-handler-proxy)

CVE-2026-42577 (netty-transport-native-epoll)

CVE-2026-42587 (netty-codec-http, netty-codec-http2)

CVE-2026-41417 (netty-codec-http)

CVE-2026-42581 (netty-codec-http)

CVE-2026-42580 (netty-codec-http)

CVE-2026-42585 (netty-codec-http)

CVE-2026-42579 (netty-codec-dns)

CVE-2026-42582 (netty-codec-http3)

CVE-2026-42583 (netty-codec, netty-codec-compression)

CVE-2026-42584 (netty-codec-http)

CVE-2026-44248 (netty-codec-mqtt)

What's Changed

Kqueue: sendfile EINTR doesn't advance offset — data duplication by @normanmaurer in netty/netty#16544

Replace usage of strerror with thread-safe alternative by @normanmaurer in netty/netty#16547

Fix implementation of strerror_r_xsi for GNU by @normanmaurer in netty/netty#16546

Lazy init ArrayList in DefaultHeaders.getAll by @doom369 in netty/netty#16526

Less logging in AWS-LC build by @chrisvest in netty/netty#16565

Ensure the CRYPTO_BUFFER_POOL is also freed when we fail creating the SSLContext by @normanmaurer in netty/netty#16545

Auto-port 4.2: Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by @netty-project-bot in netty/netty#16543

Avoid leak in PemReader on OutOfDirectMemoryError by @raipc in netty/netty#16551

IoUring: Disable test while we debug to unblock other builds by @normanmaurer in netty/netty#16581

Include user properties and subscription IDs in MqttProperties#isEmpty by @ShadowySpirits in netty/netty#16575

Native DNS resolver: Guard against malloc failures by @normanmaurer in netty/netty#16559

Auto-port 4.2: Increase timeouts for QuicChannelConnectTest by @netty-project-bot in netty/netty#16578

Fix parsing HTTP chunks with multiple extensions by @chrisvest in netty/netty#16579

Bump org.codehaus.plexus:plexus-utils from 3.4.2 to 4.0.3 in /codec-native-quic by @dependabot[bot] in netty/netty#16572

Revert to PR build to Ubuntu 22.04 by @chrisvest in netty/netty#16595

Native transports: Correctly create pipe when pipe2 is not supported by @normanmaurer in netty/netty#16592

Epoll: Cleanup code to always return negative value on failure by @normanmaurer in netty/netty#16591

Fix component search fast path by @yawkat in netty/netty#16548

Stabilize read-only toStringMultipleThreads1 by @chrisvest in netty/netty#16608

Stabilize more AbstractByteBufTests by @chrisvest in netty/netty#16611

Remove note about needing 256-bit for PQC by @chrisvest in netty/netty#16605

Stabilize testSessionInvalidate for Conscrypt by @chrisvest in netty/netty#16615

Quic: Correctly handle SSL_CTX_new failures by @normanmaurer in netty/netty#16622

Make LocalIoHandle public by @rdicroce in netty/netty#16621

Quic: Fix shadowing of variable which leads to incorrectly handling errors by @normanmaurer in netty/netty#16623

Auto-port 4.2: Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by @netty-project-bot in netty/netty#16629

Fix shutdownInput bug in kqueue for empty recv buffer by @chrisvest in netty/netty#16630

fix FFM address semantics in directBufferAddress by @dreamlike-ocean in netty/netty#16603

HTTP2: Ensure HTTP2 preface is always send as first message by @normanmaurer in netty/netty#16636

Move Http2FrameCodecSubClassTest to correct package by @normanmaurer in netty/netty#16640

Kqueue: Fix usage of LOCAL_PEERPID by @normanmaurer in netty/netty#16637

Avoid ArrayQueue allocation in HttpServerCodec by @doom369 in netty/netty#16596

Fix file descriptor reuse bug in kqueue by @chrisvest in netty/netty#16650

... (truncated)

Commits

b3844c8 [maven-release-plugin] prepare release netty-4.2.13.Final
82f47fa Merge commit from fork
ada0999 Merge commit from fork
b4051e2 Fix BrotliDecoder not forwarding all decompressed chunks
67207c1 Merge commit from fork
541ca7c Merge commit from fork
943edb3 Fix codec-dns tests
6459a28 Merge commit from fork
b4ba61b Fix checkstyle in HttpObjectDecoder
977661f Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-codec-http from 4.1.132.Final to 4.2.13.Final

Release notes

Sourced from io.netty:netty-codec-http's releases.

netty-4.2.13.Final

CVEs Fixed

CVE-2026-42586 (netty-codec-redis)

CVE-2026-42578 (netty-handler-proxy)

CVE-2026-42577 (netty-transport-native-epoll)

CVE-2026-42587 (netty-codec-http, netty-codec-http2)

CVE-2026-41417 (netty-codec-http)

CVE-2026-42581 (netty-codec-http)

CVE-2026-42580 (netty-codec-http)

CVE-2026-42585 (netty-codec-http)

CVE-2026-42579 (netty-codec-dns)

CVE-2026-42582 (netty-codec-http3)

CVE-2026-42583 (netty-codec, netty-codec-compression)

CVE-2026-42584 (netty-codec-http)

CVE-2026-44248 (netty-codec-mqtt)

What's Changed

Kqueue: sendfile EINTR doesn't advance offset — data duplication by @normanmaurer in netty/netty#16544

Replace usage of strerror with thread-safe alternative by @normanmaurer in netty/netty#16547

Fix implementation of strerror_r_xsi for GNU by @normanmaurer in netty/netty#16546

Lazy init ArrayList in DefaultHeaders.getAll by @doom369 in netty/netty#16526

Less logging in AWS-LC build by @chrisvest in netty/netty#16565

Ensure the CRYPTO_BUFFER_POOL is also freed when we fail creating the SSLContext by @normanmaurer in netty/netty#16545

Auto-port 4.2: Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by @netty-project-bot in netty/netty#16543

Avoid leak in PemReader on OutOfDirectMemoryError by @raipc in netty/netty#16551

IoUring: Disable test while we debug to unblock other builds by @normanmaurer in netty/netty#16581

Include user properties and subscription IDs in MqttProperties#isEmpty by @ShadowySpirits in netty/netty#16575

Native DNS resolver: Guard against malloc failures by @normanmaurer in netty/netty#16559

Auto-port 4.2: Increase timeouts for QuicChannelConnectTest by @netty-project-bot in netty/netty#16578

Fix parsing HTTP chunks with multiple extensions by @chrisvest in netty/netty#16579

Bump org.codehaus.plexus:plexus-utils from 3.4.2 to 4.0.3 in /codec-native-quic by @dependabot[bot] in netty/netty#16572

Revert to PR build to Ubuntu 22.04 by @chrisvest in netty/netty#16595

Native transports: Correctly create pipe when pipe2 is not supported by @normanmaurer in netty/netty#16592

Epoll: Cleanup code to always return negative value on failure by @normanmaurer in netty/netty#16591

Fix component search fast path by @yawkat in netty/netty#16548

Stabilize read-only toStringMultipleThreads1 by @chrisvest in netty/netty#16608

Stabilize more AbstractByteBufTests by @chrisvest in netty/netty#16611

Remove note about needing 256-bit for PQC by @chrisvest in netty/netty#16605

Stabilize testSessionInvalidate for Conscrypt by @chrisvest in netty/netty#16615

Quic: Correctly handle SSL_CTX_new failures by @normanmaurer in netty/netty#16622

Make LocalIoHandle public by @rdicroce in netty/netty#16621

Quic: Fix shadowing of variable which leads to incorrectly handling errors by @normanmaurer in netty/netty#16623

Auto-port 4.2: Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by @netty-project-bot in netty/netty#16629

Fix shutdownInput bug in kqueue for empty recv buffer by @chrisvest in netty/netty#16630

fix FFM address semantics in directBufferAddress by @dreamlike-ocean in netty/netty#16603

HTTP2: Ensure HTTP2 preface is always send as first message by @normanmaurer in netty/netty#16636

Move Http2FrameCodecSubClassTest to correct package by @normanmaurer in netty/netty#16640

Kqueue: Fix usage of LOCAL_PEERPID by @normanmaurer in netty/netty#16637

Avoid ArrayQueue allocation in HttpServerCodec by @doom369 in netty/netty#16596

Fix file descriptor reuse bug in kqueue by @chrisvest in netty/netty#16650

... (truncated)

Commits

b3844c8 [maven-release-plugin] prepare release netty-4.2.13.Final
82f47fa Merge commit from fork
ada0999 Merge commit from fork
b4051e2 Fix BrotliDecoder not forwarding all decompressed chunks
67207c1 Merge commit from fork
541ca7c Merge commit from fork
943edb3 Fix codec-dns tests
6459a28 Merge commit from fork
b4ba61b Fix checkstyle in HttpObjectDecoder
977661f Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-codec-http2 from 4.1.132.Final to 4.2.13.Final

Release notes

Sourced from io.netty:netty-codec-http2's releases.

netty-4.2.13.Final

CVEs Fixed

CVE-2026-42586 (netty-codec-redis)

CVE-2026-42578 (netty-handler-proxy)

CVE-2026-42577 (netty-transport-native-epoll)

CVE-2026-42587 (netty-codec-http, netty-codec-http2)

CVE-2026-41417 (netty-codec-http)

CVE-2026-42581 (netty-codec-http)

CVE-2026-42580 (netty-codec-http)

CVE-2026-42585 (netty-codec-http)

CVE-2026-42579 (netty-codec-dns)

CVE-2026-42582 (netty-codec-http3)

CVE-2026-42583 (netty-codec, netty-codec-compression)

CVE-2026-42584 (netty-codec-http)

CVE-2026-44248 (netty-codec-mqtt)

What's Changed

Kqueue: sendfile EINTR doesn't advance offset — data duplication by @normanmaurer in netty/netty#16544

Replace usage of strerror with thread-safe alternative by @normanmaurer in netty/netty#16547

Fix implementation of strerror_r_xsi for GNU by @normanmaurer in netty/netty#16546

Lazy init ArrayList in DefaultHeaders.getAll by @doom369 in netty/netty#16526

Less logging in AWS-LC build by @chrisvest in netty/netty#16565

Ensure the CRYPTO_BUFFER_POOL is also freed when we fail creating the SSLContext by @normanmaurer in netty/netty#16545

Auto-port 4.2: Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by @netty-project-bot in netty/netty#16543

Avoid leak in PemReader on OutOfDirectMemoryError by @raipc in netty/netty#16551

IoUring: Disable test while we debug to unblock other builds by @normanmaurer in netty/netty#16581

Include user properties and subscription IDs in MqttProperties#isEmpty by @ShadowySpirits in netty/netty#16575

Native DNS resolver: Guard against malloc failures by @normanmaurer in netty/netty#16559

Auto-port 4.2: Increase timeouts for QuicChannelConnectTest by @netty-project-bot in netty/netty#16578

Fix parsing HTTP chunks with multiple extensions by @chrisvest in netty/netty#16579

Bump org.codehaus.plexus:plexus-utils from 3.4.2 to 4.0.3 in /codec-native-quic by @dependabot[bot] in netty/netty#16572

Revert to PR build to Ubuntu 22.04 by @chrisvest in netty/netty#16595

Native transports: Correctly create pipe when pipe2 is not supported by @normanmaurer in netty/netty#16592

Epoll: Cleanup code to always return negative value on failure by @normanmaurer in netty/netty#16591

Fix component search fast path by @yawkat in netty/netty#16548

Stabilize read-only toStringMultipleThreads1 by @chrisvest in netty/netty#16608

Stabilize more AbstractByteBufTests by @chrisvest in netty/netty#16611

Remove note about needing 256-bit for PQC by @chrisvest in netty/netty#16605

Stabilize testSessionInvalidate for Conscrypt by @chrisvest in netty/netty#16615

Quic: Correctly handle SSL_CTX_new failures by @normanmaurer in netty/netty#16622

Make LocalIoHandle public by @rdicroce in netty/netty#16621

Quic: Fix shadowing of variable which leads to incorrectly handling errors by @normanmaurer in netty/netty#16623

Auto-port 4.2: Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by @netty-project-bot in netty/netty#16629

Fix shutdownInput bug in kqueue for empty recv buffer by @chrisvest in netty/netty#16630

fix FFM address semantics in directBufferAddress by @dreamlike-ocean in netty/netty#16603

HTTP2: Ensure HTTP2 preface is always send as first message by @normanmaurer in netty/netty#16636

Move Http2FrameCodecSubClassTest to correct package by @normanmaurer in netty/netty#16640

Kqueue: Fix usage of LOCAL_PEERPID by @normanmaurer in netty/netty#16637

Avoid ArrayQueue allocation in HttpServerCodec by @doom369 in netty/netty#16596

Fix file descriptor reuse bug in kqueue by @chrisvest in netty/netty#16650

... (truncated)

Commits

b3844c8 [maven-release-plugin] prepare release netty-4.2.13.Final
82f47fa Merge commit from fork
ada0999 Merge commit from fork
b4051e2 Fix BrotliDecoder not forwarding all decompressed chunks
67207c1 Merge commit from fork
541ca7c Merge commit from fork
943edb3 Fix codec-dns tests
6459a28 Merge commit from fork
b4ba61b Fix checkstyle in HttpObjectDecoder
977661f Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-codec from 4.1.132.Final to 4.2.13.Final

Release notes

Sourced from io.netty:netty-codec's releases.

netty-4.2.13.Final

CVEs Fixed

CVE-2026-42586 (netty-codec-redis)

CVE-2026-42578 (netty-handler-proxy)

CVE-2026-42577 (netty-transport-native-epoll)

CVE-2026-42587 (netty-codec-http, netty-codec-http2)

CVE-2026-41417 (netty-codec-http)

CVE-2026-42581 (netty-codec-http)

CVE-2026-42580 (netty-codec-http)

CVE-2026-42585 (netty-codec-http)

CVE-2026-42579 (netty-codec-dns)

CVE-2026-42582 (netty-codec-http3)

CVE-2026-42583 (netty-codec, netty-codec-compression)

CVE-2026-42584 (netty-codec-http)

CVE-2026-44248 (netty-codec-mqtt)

What's Changed

Kqueue: sendfile EINTR doesn't advance offset — data duplication by @normanmaurer in netty/netty#16544

Replace usage of strerror with thread-safe alternative by @normanmaurer in netty/netty#16547

Fix implementation of strerror_r_xsi for GNU by @normanmaurer in netty/netty#16546

Lazy init ArrayList in DefaultHeaders.getAll by @doom369 in netty/netty#16526

Less logging in AWS-LC build by @chrisvest in netty/netty#16565

Ensure the CRYPTO_BUFFER_POOL is also freed when we fail creating the SSLContext by @normanmaurer in netty/netty#16545

Auto-port 4.2: Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by @netty-project-bot in netty/netty#16543

Avoid leak in PemReader on OutOfDirectMemoryError by @raipc in netty/netty#16551

IoUring: Disable test while we debug to unblock other builds by @normanmaurer in netty/netty#16581

Include user properties and subscription IDs in MqttProperties#isEmpty by @ShadowySpirits in netty/netty#16575

Native DNS resolver: Guard against malloc failures by @normanmaurer in netty/netty#16559

Auto-port 4.2: Increase timeouts for QuicChannelConnectTest by @netty-project-bot in netty/netty#16578

Fix parsing HTTP chunks with multiple extensions by @chrisvest in netty/netty#16579

Bump org.codehaus.plexus:plexus-utils from 3.4.2 to 4.0.3 in /codec-native-quic by @dependabot[bot] in netty/netty#16572

Revert to PR build to Ubuntu 22.04 by @chrisvest in netty/netty#16595

Native transports: Correctly create pipe when pipe2 is not supported by @normanmaurer in netty/netty#16592

Epoll: Cleanup code to always return negative value on failure by @normanmaurer in netty/netty#16591

Fix component search fast path by @yawkat in netty/netty#16548

Stabilize read-only toStringMultipleThreads1 by @chrisvest in netty/netty#16608

Stabilize more AbstractByteBufTests by @chrisvest in netty/netty#16611

Remove note about needing 256-bit for PQC by @chrisvest in netty/netty#16605

Stabilize testSessionInvalidate for Conscrypt by @chrisvest in netty/netty#16615

Quic: Correctly handle SSL_CTX_new failures by @normanmaurer in netty/netty#16622

Make LocalIoHandle public by @rdicroce in netty/netty#16621

Quic: Fix shadowing of variable which leads to incorrectly handling errors by @normanmaurer in netty/netty#16623

Auto-port 4.2: Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by @netty-project-bot in netty/netty#16629

Fix shutdownInput bug in kqueue for empty recv buffer by @chrisvest in netty/netty#16630

fix FFM address semantics in directBufferAddress by @dreamlike-ocean in netty/netty#16603

HTTP2: Ensure HTTP2 preface is always send as first message by @normanmaurer in netty/netty#16636

Move Http2FrameCodecSubClassTest to correct package by @normanmaurer in netty/netty#16640

Kqueue: Fix usage of LOCAL_PEERPID by @normanmaurer in netty/netty#16637

Avoid ArrayQueue allocation in HttpServerCodec by @doom369 in netty/netty#16596

Fix file descriptor reuse bug in kqueue by @chrisvest in netty/netty#16650

... (truncated)

Commits

b3844c8 [maven-release-plugin] prepare release netty-4.2.13.Final
82f47fa Merge commit from fork
ada0999 Merge commit from fork
b4051e2 Fix BrotliDecoder not forwarding all decompressed chunks
67207c1 Merge commit from fork
541ca7c Merge commit from fork
943edb3 Fix codec-dns tests
6459a28 Merge commit from fork
b4ba61b Fix checkstyle in HttpObjectDecoder
977661f Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-common from 4.1.132.Final to 4.2.13.Final

Release notes

Sourced from io.netty:netty-common's releases.

netty-4.2.13.Final

CVEs Fixed

CVE-2026-42586 (netty-codec-redis)

CVE-2026-42578 (netty-handler-proxy)

CVE-2026-42577 (netty-transport-native-epoll)

CVE-2026-42587 (netty-codec-http, netty-codec-http2)

CVE-2026-41417 (netty-codec-http)

CVE-2026-42581 (netty-codec-http)

CVE-2026-42580 (netty-codec-http)

CVE-2026-42585 (netty-codec-http)

CVE-2026-42579 (netty-codec-dns)

CVE-2026-42582 (netty-codec-http3)

CVE-2026-42583 (netty-codec, netty-codec-compression)

CVE-2026-42584 (netty-codec-http)

CVE-2026-44248 (netty-codec-mqtt)

What's Changed

Kqueue: sendfile EINTR doesn't advance offset — data duplication by @normanmaurer in netty/netty#16544

Replace usage of strerror with thread-safe alternative by @normanmaurer in netty/netty#16547

Fix implementation of strerror_r_xsi for GNU by @normanmaurer in netty/netty#16546

Lazy init ArrayList in DefaultHeaders.getAll by @doom369 in netty/netty#16526

Less logging in AWS-LC build by @chrisvest in netty/netty#16565

Ensure the CRYPTO_BUFFER_POOL is also freed when we fail creating the SSLContext by @normanmaurer in netty/netty#16545

Auto-port 4.2: Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by @netty-project-bot in netty/netty#16543

Avoid leak in PemReader on OutOfDirectMemoryError by @raipc in netty/netty#16551

IoUring: Disable test while we debug to unblock other builds by @normanmaurer in netty/netty#16581

Include user properties and subscription IDs in MqttProperties#isEmpty by @ShadowySpirits in netty/netty#16575

Native DNS resolver: Guard against malloc failures by @normanmaurer in netty/netty#16559

Auto-port 4.2: Increase timeouts for QuicChannelConnectTest by @netty-project-bot in netty/netty#16578

Fix parsing HTTP chunks with multiple extensions by @chrisvest in netty/netty#16579

Bump org.codehaus.plexus:plexus-utils from 3.4.2 to 4.0.3 in /codec-native-quic by @dependabot[bot] in netty/netty#16572

Revert to PR build to Ubuntu 22.04 by @chrisvest in netty/netty#16595

Native transports: Correctly create pipe when pipe2 is not supported by @normanmaurer in netty/netty#16592

Epoll: Cleanup code to always return negative value on failure by @normanmaurer in netty/netty#16591

Fix component search fast path by @yawkat in netty/netty#16548

Stabilize read-only toStringMultipleThreads1 by @chrisvest in netty/netty#16608

Stabilize more AbstractByteBufTests by @chrisvest in netty/netty#16611

Remove note about needing 256-bit for PQC by @chrisvest in netty/netty#16605

Stabilize testSessionInvalidate for Conscrypt by @chrisvest in netty/netty#16615

Quic: Correctly handle SSL_CTX_new failures by @normanmaurer in netty/netty#16622

Make LocalIoHandle public by @rdicroce in netty/netty#16621

Quic: Fix shadowing of variable which leads to incorrectly handling errors by @normanmaurer in netty/netty#16623

Auto-port 4.2: Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by @netty-project-bot in netty/netty#16629

Fix shutdownInputDescription has been truncated

Bumps the netty group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [io.netty:netty-handler](https://github.com/netty/netty) | `4.1.132.Final` | `4.2.13.Final` | | [io.netty:netty-transport](https://github.com/netty/netty) | `4.1.132.Final` | `4.2.13.Final` | | [io.netty:netty-codec-http](https://github.com/netty/netty) | `4.1.132.Final` | `4.2.13.Final` | | [io.netty:netty-codec-http2](https://github.com/netty/netty) | `4.1.132.Final` | `4.2.13.Final` | | [io.netty:netty-codec](https://github.com/netty/netty) | `4.1.132.Final` | `4.2.13.Final` | | [io.netty:netty-common](https://github.com/netty/netty) | `4.1.132.Final` | `4.2.13.Final` | | [io.netty:netty-buffer](https://github.com/netty/netty) | `4.1.132.Final` | `4.2.13.Final` | | [io.netty:netty-resolver](https://github.com/netty/netty) | `4.1.132.Final` | `4.2.13.Final` | | [io.netty:netty-resolver-dns](https://github.com/netty/netty) | `4.1.132.Final` | `4.2.13.Final` | | [io.netty:netty-transport-classes-epoll](https://github.com/netty/netty) | `4.1.132.Final` | `4.2.13.Final` | | [io.netty:netty-tcnative-boringssl-static](https://github.com/netty/netty-tcnative) | `2.0.75.Final` | `2.0.77.Final` | Updates `io.netty:netty-handler` from 4.1.132.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.2.13.Final) Updates `io.netty:netty-transport` from 4.1.132.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.2.13.Final) Updates `io.netty:netty-codec-http` from 4.1.132.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.2.13.Final) Updates `io.netty:netty-codec-http2` from 4.1.132.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.2.13.Final) Updates `io.netty:netty-codec` from 4.1.132.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.2.13.Final) Updates `io.netty:netty-common` from 4.1.132.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.2.13.Final) Updates `io.netty:netty-buffer` from 4.1.132.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.2.13.Final) Updates `io.netty:netty-resolver` from 4.1.132.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.2.13.Final) Updates `io.netty:netty-resolver-dns` from 4.1.132.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.2.13.Final) Updates `io.netty:netty-transport-classes-epoll` from 4.1.132.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.2.13.Final) Updates `io.netty:netty-transport` from 4.1.132.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.2.13.Final) Updates `io.netty:netty-codec-http` from 4.1.132.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.2.13.Final) Updates `io.netty:netty-codec-http2` from 4.1.132.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.2.13.Final) Updates `io.netty:netty-codec` from 4.1.132.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.2.13.Final) Updates `io.netty:netty-common` from 4.1.132.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.2.13.Final) Updates `io.netty:netty-buffer` from 4.1.132.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.2.13.Final) Updates `io.netty:netty-resolver` from 4.1.132.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.2.13.Final) Updates `io.netty:netty-resolver-dns` from 4.1.132.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.2.13.Final) Updates `io.netty:netty-transport-classes-epoll` from 4.1.132.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.2.13.Final) Updates `io.netty:netty-tcnative-boringssl-static` from 2.0.75.Final to 2.0.77.Final - [Release notes](https://github.com/netty/netty-tcnative/releases) - [Commits](netty/netty-tcnative@netty-tcnative-parent-2.0.75.Final...netty-tcnative-parent-2.0.77.Final) --- updated-dependencies: - dependency-name: io.netty:netty-buffer dependency-version: 4.2.12.Final dependency-type: direct:development update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-buffer dependency-version: 4.2.12.Final dependency-type: direct:development update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-codec dependency-version: 4.2.12.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-codec dependency-version: 4.2.12.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-codec-http dependency-version: 4.2.12.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-codec-http dependency-version: 4.2.12.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-codec-http2 dependency-version: 4.2.12.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-codec-http2 dependency-version: 4.2.12.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-common dependency-version: 4.2.12.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-common dependency-version: 4.2.12.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-handler dependency-version: 4.2.12.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-resolver dependency-version: 4.2.12.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-resolver dependency-version: 4.2.12.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-resolver-dns dependency-version: 4.2.12.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-resolver-dns dependency-version: 4.2.12.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-tcnative-boringssl-static dependency-version: 2.0.76.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: netty - dependency-name: io.netty:netty-transport dependency-version: 4.2.12.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-transport dependency-version: 4.2.12.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-transport-classes-epoll dependency-version: 4.2.12.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-transport-classes-epoll dependency-version: 4.2.12.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-05-06T18:28:04Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies This issue is a problem in a dependency. java Pull requests that update java code labels Apr 20, 2026

dependabot Bot requested a review from a team as a code owner April 20, 2026 16:42

dependabot Bot added dependencies This issue is a problem in a dependency. java Pull requests that update java code labels Apr 20, 2026

dependabot Bot force-pushed the dependabot/maven/netty-2c7e2ae89b branch 11 times, most recently from 779cce8 to 5b80f5a Compare April 25, 2026 16:45

dependabot Bot force-pushed the dependabot/maven/netty-2c7e2ae89b branch 11 times, most recently from 8fa1af9 to 382d149 Compare May 4, 2026 19:13

dependabot Bot force-pushed the dependabot/maven/netty-2c7e2ae89b branch from 382d149 to d7c8e2c Compare May 5, 2026 19:57

dependabot Bot closed this May 6, 2026

dependabot Bot deleted the dependabot/maven/netty-2c7e2ae89b branch May 6, 2026 18:28

bhoradc mentioned this pull request May 6, 2026

Restrict Dependabot Netty updates to patch versions only #6942

Merged

12 tasks

Navigation Menu

Uh oh!

Bump the netty group across 1 directory with 11 updates - #6878

Bump the netty group across 1 directory with 11 updates#6878
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/netty-2c7e2ae89b

dependabot Bot commented on behalf of github Apr 20, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github May 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

netty-4.2.13.Final

CVEs Fixed

What's Changed

netty-4.2.13.Final

CVEs Fixed

What's Changed

netty-4.2.13.Final

CVEs Fixed

What's Changed

netty-4.2.13.Final

CVEs Fixed

What's Changed

netty-4.2.13.Final

CVEs Fixed

What's Changed

netty-4.2.13.Final

CVEs Fixed

What's Changed

Uh oh!

dependabot Bot commented on behalf of github May 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Apr 20, 2026 •

edited

Loading