Bump nettyVersion from 4.1.135.Final to 4.2.17.Final - #227
Bump nettyVersion from 4.1.135.Final to 4.2.17.Final#227dependabot[bot] wants to merge 1 commit into
Conversation
Bumps `nettyVersion` from 4.1.135.Final to 4.2.17.Final. Updates `io.netty:netty-codec-http2` from 4.1.135.Final to 4.2.17.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.135.Final...netty-4.2.17.Final) Updates `io.netty:netty-handler-proxy` from 4.1.135.Final to 4.2.17.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.135.Final...netty-4.2.17.Final) Updates `io.netty:netty-transport-native-unix-common` from 4.1.135.Final to 4.2.17.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.135.Final...netty-4.2.17.Final) --- updated-dependencies: - dependency-name: io.netty:netty-codec-http2 dependency-version: 4.2.17.Final dependency-type: direct:production - dependency-name: io.netty:netty-handler-proxy dependency-version: 4.2.17.Final dependency-type: direct:production - dependency-name: io.netty:netty-transport-native-unix-common dependency-version: 4.2.17.Final dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 2f1e9ae. Configure here.
| // to CVE-2025-24970). grpc-netty does not pin a patched Netty even in recent releases, so we | ||
| // pin Netty directly here. Bump alongside grpc when grpc itself ships a patched Netty. | ||
| def nettyVersion = '4.1.135.Final' | ||
| def nettyVersion = '4.2.17.Final' |
There was a problem hiding this comment.
Incompatible Netty major version bump
High Severity
nettyVersion jumps from 4.1.135.Final to 4.2.17.Final while grpc-netty stays at 1.60.2, which targets Netty 4.1 and uses unstable Netty HTTP/2 APIs. That mismatch can cause runtime failures such as NoSuchMethodError. These modules are also api deps, so consumers are forced onto Netty 4.2, which cannot coexist with 4.1. A safer pin (for example 4.1.137.Final) remains available; Netty 4.2 support landed in grpc-java 1.83.0.
Triggered by project rule: Code Review Guidance
Reviewed by Cursor Bugbot for commit 2f1e9ae. Configure here.
Bumps
nettyVersionfrom 4.1.135.Final to 4.2.17.Final.Updates
io.netty:netty-codec-http2from 4.1.135.Final to 4.2.17.FinalRelease notes
Sourced from io.netty:netty-codec-http2's releases.
... (truncated)
Commits
e0789d3[maven-release-plugin] prepare release netty-4.2.17.Final1b5abc6Merge changes from forks (#17213)36fbf57Update surefire plugin to latest version (#17210)a96226cAdd.editorconfigto enforce consistent coding style (#17052)14a4e6aOpenSSL: Allow to obtain used named group via OpenSslSession (#17058)26255b1Weakly reference engines from the OpenSSL engine map (#17199)ae41417HttpServerCodec: do not consume the method queue for 1xx interim responses ...41f1db5Do not write WebSocket handshake response to the tail of the pipeline (#17192)035d76eUpdate compress-lzf to 1.2.1 (#17194)7681affFix JdkZlibDecompressor losing the tail of highly compressible streams (#17191)Updates
io.netty:netty-handler-proxyfrom 4.1.135.Final to 4.2.17.FinalRelease notes
Sourced from io.netty:netty-handler-proxy's releases.
... (truncated)
Commits
e0789d3[maven-release-plugin] prepare release netty-4.2.17.Final1b5abc6Merge changes from forks (#17213)36fbf57Update surefire plugin to latest version (#17210)a96226cAdd.editorconfigto enforce consistent coding style (#17052)14a4e6aOpenSSL: Allow to obtain used named group via OpenSslSession (#17058)26255b1Weakly reference engines from the OpenSSL engine map (#17199)ae41417HttpServerCodec: do not consume the method queue for 1xx interim responses ...41f1db5Do not write WebSocket handshake response to the tail of the pipeline (#17192)035d76eUpdate compress-lzf to 1.2.1 (#17194)7681affFix JdkZlibDecompressor losing the tail of highly compressible streams (#17191)Updates
io.netty:netty-transport-native-unix-commonfrom 4.1.135.Final to 4.2.17.FinalRelease notes
Sourced from io.netty:netty-transport-native-unix-common's releases.
... (truncated)
Commits
e0789d3[maven-release-plugin] prepare release netty-4.2.17.Final1b5abc6Merge changes from forks (#17213)36fbf57Update surefire plugin to latest version (#17210)a96226cAdd.editorconfigto enforce consistent coding style (#17052)14a4e6aOpenSSL: Allow to obtain used named group via OpenSslSession (#17058)26255b1Weakly reference engines from the OpenSSL engine map (#17199)ae41417HttpServerCodec: do not consume the method queue for 1xx interim responses ...41f1db5Do not write WebSocket handshake response to the tail of the pipeline (#17192)035d76eUpdate compress-lzf to 1.2.1 (#17194)7681affFix JdkZlibDecompressor losing the tail of highly compressible streams (#17191)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Medium Risk
Netty 4.1→4.2 affects gRPC networking/SSL paths for all library consumers; scope is dependency-only but behavior changes in the transport stack warrant regression testing.
Overview
Updates the pinned
nettyVersioninbuild.gradlefrom 4.1.135.Final to 4.2.17.Final, so all existing direct Nettyapipins (netty-codec-http2,netty-handler-proxy,netty-transport-native-unix-common) resolve to the newer line instead of 4.1.x.This keeps the intentional override of gRPC’s transitive Netty (still on grpc 1.60.2) while moving published/consumed Netty artifacts to a newer release that includes additional security and bug fixes beyond the prior 4.1 pin.
Reviewed by Cursor Bugbot for commit 2f1e9ae. Bugbot is set up for automated code reviews on this repo. Configure here.