Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package netty for openSUSE:Factory checked in at 2026-07-28 18:06:43 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/netty (Old) and /work/SRC/openSUSE:Factory/.netty.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "netty" Tue Jul 28 18:06:43 2026 rev:16 rq:1368025 version:4.1.136 Changes: -------- --- /work/SRC/openSUSE:Factory/netty/netty.changes 2026-06-15 19:50:34.389354280 +0200 +++ /work/SRC/openSUSE:Factory/.netty.new.2004/netty.changes 2026-07-28 18:07:45.253217908 +0200 @@ -1,0 +2,98 @@ +Tue Jul 21 07:52:40 UTC 2026 - Fridrich Strba <[email protected]> + +- Upgrade to upstream version 4.1.136 + * Security fixes: + + CVE-2026-44891, bsc#1271435: memory exhaustion in + io.netty:netty-codec-stomp + + CVE-2026-55833, bsc#1271961: zip bomb in + io.netty:netty-codec-http + + CVE-2026-59921, bsc#1272307: improper CR/LF neutralization in + io.netty:netty-codec-http (multipart) + + CVE-2026-59919, bsc#1272305: improper CR/LF neutralization in + io.netty:netty-codec-haproxy + + CVE-2026-55851, bsc#1272253: memory exhaustion in + io.netty:netty-codec-haproxy + + CVE-2026-56745, bsc#1272254: memory exhaustion in + io.netty:netty-codec-http + + CVE-2026-56817, bsc#1272257: insecure defaults in XML parsing + in io.netty:netty-codec-xml + + CVE-2026-59899, bsc#1272301: memory exhaustion in + io.netty:netty-codec-http + + CVE-2026-56818, bsc#1272603: memory leak in + io.netty:netty-codec-redis + + CVE-2026-56819, bsc#1272258: memory leak in + io.netty:netty-codec-http2 + + CVE-2026-55831, bsc#1271960: resource exhaustion/DoS in + io.netty:netty-codec-http + + GHSA-mfg7-5gfp-c4w3, bsc#1272519: memory leak in + io.netty:netty-codec-dns + + CVE-2026-59901, bsc#1272304: infinite loop in + io.netty:netty-codec-compression (bzip2) + + CVE-2026-59900, bsc#1272303: improper header neutralization in + io.netty:netty-codec-http2 + + CVE-2026-59898, bsc#1272302: protocol version confusion in + io.netty:netty-codec-http (websocket) + + CVE-2026-56746, bsc#1272255: improper access control in + io.netty:netty-codec-http (CORS) + + CVE-2026-56822, bsc#1272300: time-of-check/time-of-use in + io.netty:netty-handler-ssl-ocsp + + GHSA-v74w-7mr3-4qg3, bsc#1272518: uncontrolled resource + consumption in io.netty:netty-codec-xml + + CVE-2026-56820, bsc#1272259: improper certificate validation + in io.netty:netty-handler-ssl-ocsp + + CVE-2026-56821, bsc#1272299: improper certificate revocation + check in io.netty:netty-handler-ssl-ocsp + + CVE-2026-59920, bsc#1272306: improper CR/LF neutrolization in + io.netty:netty-codec-stomp + * Other significant changes: + + SingleThreadEventExecutor: document Throwable safety contract + on run() + + Make HTTP/2 frame hashCode consistent with equals + + Add BlockHound exception for DnsQueryIdSpace (#16896) + + FlowControlHandler: Fix autoRead behavior + + Fix incorrect bounds in error message of + HpackDecoder.setMaxHeaderListSize + + MQTT: Fix MQTT decoder size check after variable header replay + + MQTT: Make the decodeProperties early-REPLAY check actually + fire + + Reject control characters at the boundary of HTTP method names + (#16723) + + Update to latest tcnative release + + Fix HTTP 2 PUSH_PROMISE stream association validation + + Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder + + Add opt-in validation of mandatory pseudo-header fields for + HTTP/2 + + Strictly validate MQTT UTF-8 Encoded String (#16939) + + Stop DateFormatter trailing token from running past the parse + end + + IpFilter: Deprecate constructor which use accept by default + + Add RFC 10008 QUERY Method support (#16966) + + Correctly release and fail queued traffic-shaping writes on + close (#16959) + + FlowControlHandler: respect auto-read when toggled while + dequeueing + + IdleStateHandler: reset firstWriter/ReaderIdleEvent in + resetWriteTimeout/resetReadTimeout (#16982) + + Fix typo in AbstractSniHandler Javadoc + + Reconcile AbstractCoalescingBufferQueue readableBytes when it + drains, and fail stuck HTTP/2 streams instead of spinning + empty DATA frames + + Reject control characters at the boundary of the HTTP version + token (#16971) + + Reset UTF-8 decode state on CR in StompSubframeDecoder + + HTTP2: Pass the correct number of arguments when logging + goaway + + FastLz: Guard decompression against truncated input (#17000) + + Fix propagation of startTls for client SslContext handler + + Reject non-token characters in HTTP/2 header names + + Update lz4-java to 1.11.1 + + Pin github actions to reduce risk (#17043) + + Merge branches from forks (#17063) +- Modified patches: + * 0001-Remove-optional-dep-Blockhound.patch + * 0002-Remove-optional-dep-conscrypt.patch + * 0003-Remove-optional-deps-jetty-alpn-and-npn.patch + * 0004-Disable-Brotli-and-ZStd-compression.patch + + rediff + +------------------------------------------------------------------- Old: ---- netty-4.1.135.Final.tar.gz New: ---- netty-4.1.136.Final.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ netty.spec ++++++ --- /var/tmp/diff_new_pack.D5MRS3/_old 2026-07-28 18:07:48.041315934 +0200 +++ /var/tmp/diff_new_pack.D5MRS3/_new 2026-07-28 18:07:48.057316496 +0200 @@ -19,7 +19,7 @@ %global namedreltag .Final %global namedversion %{version}%{?namedreltag} Name: netty -Version: 4.1.135 +Version: 4.1.136 Release: 0 Summary: An asynchronous event-driven network application framework and tools for Java License: Apache-2.0 ++++++ 0001-Remove-optional-dep-Blockhound.patch ++++++ --- /var/tmp/diff_new_pack.D5MRS3/_old 2026-07-28 18:07:48.173320575 +0200 +++ /var/tmp/diff_new_pack.D5MRS3/_new 2026-07-28 18:07:48.189321137 +0200 @@ -1,19 +1,19 @@ -From f3ef38d6857ccd9f1945fe8e92e36a4f18a62dd8 Mon Sep 17 00:00:00 2001 +From 8c1ada1aebcd317efc725094a9602123c945aa49 Mon Sep 17 00:00:00 2001 From: Mat Booth <[email protected]> Date: Mon, 7 Sep 2020 12:17:31 +0100 Subject: [PATCH 1/4] Remove optional dep Blockhound --- common/pom.xml | 5 - - .../java/io/netty/util/internal/Hidden.java | 200 ------ + .../java/io/netty/util/internal/Hidden.java | 208 ------ ...ockhound.integration.BlockHoundIntegration | 14 - pom.xml | 8 - transport-blockhound-tests/pom.xml | 228 ------- - .../NettyBlockHoundIntegrationTest.java | 593 ------------------ + .../NettyBlockHoundIntegrationTest.java | 638 ------------------ .../netty/util/internal/localhost_server.key | 28 - .../netty/util/internal/localhost_server.pem | 17 - .../io/netty/util/internal/mutual_auth_ca.pem | 19 - - 9 files changed, 1112 deletions(-) + 9 files changed, 1165 deletions(-) delete mode 100644 common/src/main/java/io/netty/util/internal/Hidden.java delete mode 100644 common/src/main/resources/META-INF/services/reactor.blockhound.integration.BlockHoundIntegration delete mode 100644 transport-blockhound-tests/pom.xml @@ -23,7 +23,7 @@ delete mode 100644 transport-blockhound-tests/src/test/resources/io/netty/util/internal/mutual_auth_ca.pem diff --git a/common/pom.xml b/common/pom.xml -index 6e0ea10f51..26e2608b74 100644 +index 3d89945cec..c1c2127a40 100644 --- a/common/pom.xml +++ b/common/pom.xml @@ -89,11 +89,6 @@ @@ -40,10 +40,10 @@ <artifactId>mockito-core</artifactId> diff --git a/common/src/main/java/io/netty/util/internal/Hidden.java b/common/src/main/java/io/netty/util/internal/Hidden.java deleted file mode 100644 -index e227c90c7e..0000000000 +index bdc32dad60..0000000000 --- a/common/src/main/java/io/netty/util/internal/Hidden.java +++ /dev/null -@@ -1,200 +0,0 @@ +@@ -1,208 +0,0 @@ -/* - * Copyright 2019 The Netty Project - * @@ -211,6 +211,14 @@ - "parseEtcResolverOptions"); - - builder.allowBlockingCallsInside( +- "io.netty.resolver.dns.DnsQueryIdSpace", +- "nextId"); +- +- builder.allowBlockingCallsInside( +- "io.netty.resolver.dns.DnsQueryIdSpace$DnsQueryIdRange", +- "pushId"); +- +- builder.allowBlockingCallsInside( - "io.netty.resolver.HostsFileEntriesProvider$ParserImpl", - "parse"); - @@ -266,7 +274,7 @@ -io.netty.util.internal.Hidden$NettyBlockHoundIntegration \ No newline at end of file diff --git a/pom.xml b/pom.xml -index 91d6fee8fc..650c93e3ae 100644 +index 7864dd47e8..82a056eeaf 100644 --- a/pom.xml +++ b/pom.xml @@ -909,7 +909,6 @@ @@ -293,7 +301,7 @@ diff --git a/transport-blockhound-tests/pom.xml b/transport-blockhound-tests/pom.xml deleted file mode 100644 -index f53dd286c8..0000000000 +index 9df065b45b..0000000000 --- a/transport-blockhound-tests/pom.xml +++ /dev/null @@ -1,228 +0,0 @@ @@ -319,7 +327,7 @@ - <parent> - <groupId>io.netty</groupId> - <artifactId>netty-parent</artifactId> -- <version>4.1.135.Final</version> +- <version>4.1.136.Final</version> - </parent> - - <artifactId>netty-transport-blockhound-tests</artifactId> @@ -527,10 +535,10 @@ -</project> diff --git a/transport-blockhound-tests/src/test/java/io/netty/util/internal/NettyBlockHoundIntegrationTest.java b/transport-blockhound-tests/src/test/java/io/netty/util/internal/NettyBlockHoundIntegrationTest.java deleted file mode 100644 -index ed0845ac0e..0000000000 +index 66e169a11d..0000000000 --- a/transport-blockhound-tests/src/test/java/io/netty/util/internal/NettyBlockHoundIntegrationTest.java +++ /dev/null -@@ -1,593 +0,0 @@ +@@ -1,638 +0,0 @@ -/* - * Copyright 2019 The Netty Project - @@ -571,6 +579,7 @@ -import io.netty.handler.ssl.SslProvider; -import io.netty.handler.ssl.util.InsecureTrustManagerFactory; -import io.netty.handler.ssl.util.SelfSignedCertificate; +-import io.netty.resolver.dns.DnsNameResolver; -import io.netty.resolver.dns.DnsNameResolverBuilder; -import io.netty.resolver.dns.DnsServerAddressStreamProviders; -import io.netty.util.HashedWheelTimer; @@ -578,6 +587,7 @@ -import io.netty.util.concurrent.DefaultThreadFactory; -import io.netty.util.concurrent.EventExecutor; -import io.netty.util.concurrent.FastThreadLocalThread; +-import io.netty.util.concurrent.GenericFutureListener; -import io.netty.util.concurrent.GlobalEventExecutor; -import io.netty.util.concurrent.ImmediateEventExecutor; -import io.netty.util.concurrent.ImmediateExecutor; @@ -591,6 +601,7 @@ -import reactor.blockhound.BlockingOperationError; -import reactor.blockhound.integration.BlockHoundIntegration; - +-import java.net.InetAddress; -import java.net.InetSocketAddress; -import java.util.ArrayList; -import java.util.List; @@ -605,6 +616,7 @@ -import java.util.concurrent.Future; -import java.util.concurrent.FutureTask; -import java.util.concurrent.LinkedBlockingQueue; +-import java.util.concurrent.ThreadFactory; -import java.util.concurrent.TimeUnit; -import java.util.concurrent.atomic.AtomicLong; -import java.util.concurrent.atomic.AtomicReference; @@ -968,6 +980,47 @@ - } - } - +- @Test +- @Timeout(value = 5000, unit = TimeUnit.MILLISECONDS) +- public void testDnsNameResolverAllowsBlockingCalls() throws InterruptedException { +- CountDownLatch latch = new CountDownLatch(1); +- List<Throwable> error = new ArrayList<>(); +- ThreadFactory threadFactory = new ThreadFactory() { +- @Override +- public Thread newThread(Runnable r) { +- Thread t = new DefaultThreadFactory("test").newThread(r); +- t.setUncaughtExceptionHandler((t1, e) -> { +- error.add(e); +- latch.countDown(); +- }); +- return t; +- } +- }; +- EventLoopGroup group = new NioEventLoopGroup(1, threadFactory); +- try (DnsNameResolver resolver = new DnsNameResolverBuilder(group.next()) +- .datagramChannelFactory(NioDatagramChannel::new) +- .build()) { +- resolver.resolve("netty.io").addListener( +- new GenericFutureListener<io.netty.util.concurrent.Future<? super InetAddress>>() { +- @Override +- public void operationComplete(io.netty.util.concurrent.Future<? super InetAddress> future) { +- if (!future.isSuccess()) { +- error.add(future.cause()); +- } +- latch.countDown(); +- } +- }); +- latch.await(); +- for (Throwable t : error) { +- if (t instanceof BlockingOperationError || t.getCause() instanceof BlockingOperationError) { +- fail("BlockingOperationError was thrown: " + t); +- } +- } +- } finally { +- group.shutdownGracefully(); +- } +- } +- - private static void doTestParseResolverFilesAllowsBlockingCalls(Callable<Object> callable) - throws InterruptedException { - SingleThreadEventExecutor executor = @@ -1207,6 +1260,6 @@ -hH82y9bBeflqroOeztqMpONpWoZjlz0sWbJNvXztXINL7LaNmVYOcoUrCcxPS54T ------END CERTIFICATE----- -- -2.54.0 +2.55.0 ++++++ 0002-Remove-optional-dep-conscrypt.patch ++++++ --- /var/tmp/diff_new_pack.D5MRS3/_old 2026-07-28 18:07:48.317325638 +0200 +++ /var/tmp/diff_new_pack.D5MRS3/_new 2026-07-28 18:07:48.353326904 +0200 @@ -1,4 +1,4 @@ -From 5d077cf5d0da696c0f5dcabe50dcbb01c6bb95d3 Mon Sep 17 00:00:00 2001 +From b0dd10b09e56b70aaab1d2c969f39033ff332104 Mon Sep 17 00:00:00 2001 From: Mat Booth <[email protected]> Date: Mon, 7 Sep 2020 13:24:30 +0100 Subject: [PATCH 2/4] Remove optional dep conscrypt @@ -15,7 +15,7 @@ delete mode 100644 handler/src/main/java/io/netty/handler/ssl/ConscryptAlpnSslEngine.java diff --git a/handler/pom.xml b/handler/pom.xml -index 9b8e6ad834..dd377f5897 100644 +index a217c1934e..bf50b8686d 100644 --- a/handler/pom.xml +++ b/handler/pom.xml @@ -96,12 +96,6 @@ @@ -434,7 +434,7 @@ SslEngineType(boolean wantsDirectBuffer, Cumulator cumulator) { diff --git a/pom.xml b/pom.xml -index 650c93e3ae..c744d999ee 100644 +index 82a056eeaf..29294b1fac 100644 --- a/pom.xml +++ b/pom.xml @@ -988,16 +988,6 @@ @@ -455,6 +455,6 @@ <dependency> <groupId>software.amazon.cryptools</groupId> -- -2.54.0 +2.55.0 ++++++ 0003-Remove-optional-deps-jetty-alpn-and-npn.patch ++++++ --- /var/tmp/diff_new_pack.D5MRS3/_old 2026-07-28 18:07:48.461330701 +0200 +++ /var/tmp/diff_new_pack.D5MRS3/_new 2026-07-28 18:07:48.497331967 +0200 @@ -1,4 +1,4 @@ -From df0ce19cad8ac2e55f463d5b3a39acf8643c020f Mon Sep 17 00:00:00 2001 +From ec1968cdf18bc516fa9ca9797ba9b05e6937e44d Mon Sep 17 00:00:00 2001 From: Mat Booth <[email protected]> Date: Mon, 7 Sep 2020 13:26:20 +0100 Subject: [PATCH 3/4] Remove optional deps jetty alpn and npn @@ -15,7 +15,7 @@ delete mode 100644 handler/src/main/java/io/netty/handler/ssl/JettyNpnSslEngine.java diff --git a/handler/pom.xml b/handler/pom.xml -index dd377f5897..7e69d94c7b 100644 +index bf50b8686d..ba53f86112 100644 --- a/handler/pom.xml +++ b/handler/pom.xml @@ -86,16 +86,6 @@ @@ -374,7 +374,7 @@ - } -} diff --git a/pom.xml b/pom.xml -index c744d999ee..355ae52e93 100644 +index 29294b1fac..39ae390749 100644 --- a/pom.xml +++ b/pom.xml @@ -945,20 +945,6 @@ @@ -399,6 +399,6 @@ <dependency> <groupId>com.google.protobuf</groupId> -- -2.54.0 +2.55.0 ++++++ 0004-Disable-Brotli-and-ZStd-compression.patch ++++++ --- /var/tmp/diff_new_pack.D5MRS3/_old 2026-07-28 18:07:48.621336327 +0200 +++ /var/tmp/diff_new_pack.D5MRS3/_new 2026-07-28 18:07:48.665337873 +0200 @@ -1,4 +1,4 @@ -From d77380c8bee1268b43659e0852cdb712c33127ac Mon Sep 17 00:00:00 2001 +From 5624f7254d8fbc9de088c0751de60ea5b37e2f1b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fridrich=20=C5=A0trba?= <[email protected]> Date: Thu, 30 Mar 2023 13:19:04 +0200 Subject: [PATCH 4/4] Disable Brotli and ZStd compression @@ -333,10 +333,10 @@ return new EmbeddedChannel(ctx.channel().id(), ctx.channel().metadata().hasDisconnect(), ctx.channel().config(), new SnappyFrameEncoder()); diff --git a/codec-http2/src/main/java/io/netty/handler/codec/http2/DelegatingDecompressorFrameListener.java b/codec-http2/src/main/java/io/netty/handler/codec/http2/DelegatingDecompressorFrameListener.java -index c14502b94f..26c93460f8 100644 +index 6975c6f9e6..8486c83e58 100644 --- a/codec-http2/src/main/java/io/netty/handler/codec/http2/DelegatingDecompressorFrameListener.java +++ b/codec-http2/src/main/java/io/netty/handler/codec/http2/DelegatingDecompressorFrameListener.java -@@ -20,24 +20,18 @@ import io.netty.channel.ChannelHandlerContext; +@@ -20,10 +20,6 @@ import io.netty.channel.ChannelHandlerContext; import io.netty.channel.ChannelInboundHandlerAdapter; import io.netty.channel.embedded.EmbeddedChannel; import io.netty.handler.codec.ByteToMessageDecoder; @@ -347,6 +347,7 @@ import io.netty.handler.codec.compression.ZlibCodecFactory; import io.netty.handler.codec.compression.ZlibWrapper; import io.netty.handler.codec.compression.SnappyFrameDecoder; +@@ -32,14 +28,12 @@ import java.nio.channels.ClosedChannelException; import static io.netty.handler.codec.http.HttpHeaderNames.CONTENT_ENCODING; import static io.netty.handler.codec.http.HttpHeaderNames.CONTENT_LENGTH; @@ -361,7 +362,7 @@ import static io.netty.handler.codec.http2.Http2Error.INTERNAL_ERROR; import static io.netty.handler.codec.http2.Http2Exception.streamError; import static io.netty.util.internal.ObjectUtil.checkNotNull; -@@ -179,18 +173,10 @@ public class DelegatingDecompressorFrameListener extends Http2FrameListenerDecor +@@ -181,18 +175,10 @@ public class DelegatingDecompressorFrameListener extends Http2FrameListenerDecor return new EmbeddedChannel(ctx.channel().id(), ctx.channel().metadata().hasDisconnect(), ctx.channel().config(), ZlibCodecFactory.newZlibDecoder(wrapper, maxAllocation)); } @@ -465,6 +466,6 @@ * Create a new {@link SnappyOptions} */ -- -2.54.0 +2.55.0 ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.D5MRS3/_old 2026-07-28 18:07:48.805342796 +0200 +++ /var/tmp/diff_new_pack.D5MRS3/_new 2026-07-28 18:07:48.853344484 +0200 @@ -1,6 +1,6 @@ -mtime: 1781514666 -commit: da46f5b7fba646f87b3b547b6b017b62034b3069aeecfa9529a3dc17c10472ed +mtime: 1785155627 +commit: 38277e1b198c1f2781864029f18a3b495cba772ffbeca0382c88d84dc9505cfe url: https://src.opensuse.org/java-packages/netty -revision: da46f5b7fba646f87b3b547b6b017b62034b3069aeecfa9529a3dc17c10472ed +revision: 38277e1b198c1f2781864029f18a3b495cba772ffbeca0382c88d84dc9505cfe projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-07-27 14:33:47.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ netty-4.1.135.Final.tar.gz -> netty-4.1.136.Final.tar.gz ++++++ ++++ 8386 lines of diff (skipped)
