This is an automated email from the ASF dual-hosted git repository.
rmetzger pushed a commit to branch release-20.0
in repository https://gitbox.apache.org/repos/asf/flink-shaded.git
The following commit(s) were added to refs/heads/release-20.0 by this push:
new 8d27f6d [FLINK-39570] Bump Netty to 4.1.136.Final (release-20.0)
8d27f6d is described below
commit 8d27f6dc0e6298aeea91d7bb86dcb913f7e31aa0
Author: Purushottam Sinha <[email protected]>
AuthorDate: Mon Aug 31 15:30:32 2026 +0530
[FLINK-39570] Bump Netty to 4.1.136.Final (release-20.0)
Bump netty.version from 4.1.135.Final to 4.1.136.Final to pick up the
fix for CVE-2026-59920 (netty-codec-stomp), CVE-2026-59919 and
CVE-2026-55851 (netty-codec-haproxy), and GHSA-mfg7-5gfp-c4w3
(netty-codec-dns) (Confluent CF-4086, CF-4088, CF-4090, CF-4145), and
update every bundled-dependency NOTICE to match the newly bundled
Netty version.
Netty is bundled (relocated) by flink-shaded-netty-4 and, via the
shared io.netty:netty-bom import in dependencyManagement, by all four
flink-shaded-zookeeper-{35,36,37,38} modules. All five NOTICE files
are updated so the upstream license check (NoticeFileChecker) stays
green. The netty-bom module set is unchanged between 4.1.135.Final and
4.1.136.Final, so no NOTICE entries are added or removed beyond the
version string.
Verified by building flink-shaded-netty-4 and
flink-shaded-zookeeper-38 locally: both packages bundle
io.netty:*:4.1.136.Final and produce a clean jar.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
---
.../src/main/resources/META-INF/NOTICE | 70 +++++++++++-----------
.../src/main/resources/META-INF/NOTICE | 18 +++---
.../src/main/resources/META-INF/NOTICE | 18 +++---
.../src/main/resources/META-INF/NOTICE | 18 +++---
.../src/main/resources/META-INF/NOTICE | 18 +++---
pom.xml | 2 +-
6 files changed, 72 insertions(+), 72 deletions(-)
diff --git a/flink-shaded-netty-4/src/main/resources/META-INF/NOTICE
b/flink-shaded-netty-4/src/main/resources/META-INF/NOTICE
index c8215a2..7ab460e 100644
--- a/flink-shaded-netty-4/src/main/resources/META-INF/NOTICE
+++ b/flink-shaded-netty-4/src/main/resources/META-INF/NOTICE
@@ -6,38 +6,38 @@ The Apache Software Foundation (http://www.apache.org/).
This project bundles the following dependencies under the Apache Software
License 2.0 (http://www.apache.org/licenses/LICENSE-2.0.txt)
-- io.netty:netty-all:4.1.135.Final
-- io.netty:netty-buffer:4.1.135.Final
-- io.netty:netty-codec-dns:4.1.135.Final
-- io.netty:netty-codec-haproxy:4.1.135.Final
-- io.netty:netty-codec-http2:4.1.135.Final
-- io.netty:netty-codec-http:4.1.135.Final
-- io.netty:netty-codec-memcache:4.1.135.Final
-- io.netty:netty-codec-mqtt:4.1.135.Final
-- io.netty:netty-codec-redis:4.1.135.Final
-- io.netty:netty-codec-smtp:4.1.135.Final
-- io.netty:netty-codec-socks:4.1.135.Final
-- io.netty:netty-codec-stomp:4.1.135.Final
-- io.netty:netty-codec-xml:4.1.135.Final
-- io.netty:netty-codec:4.1.135.Final
-- io.netty:netty-common:4.1.135.Final
-- io.netty:netty-handler-proxy:4.1.135.Final
-- io.netty:netty-handler-ssl-ocsp:4.1.135.Final
-- io.netty:netty-handler:4.1.135.Final
-- io.netty:netty-resolver-dns-classes-macos:4.1.135.Final
-- io.netty:netty-resolver-dns-native-macos:osx-aarch_64:4.1.135.Final
-- io.netty:netty-resolver-dns-native-macos:osx-x86_64:4.1.135.Final
-- io.netty:netty-resolver-dns:4.1.135.Final
-- io.netty:netty-resolver:4.1.135.Final
-- io.netty:netty-transport-classes-epoll:4.1.135.Final
-- io.netty:netty-transport-classes-kqueue:4.1.135.Final
-- io.netty:netty-transport-native-epoll:linux-aarch_64:4.1.135.Final
-- io.netty:netty-transport-native-epoll:linux-riscv64:4.1.135.Final
-- io.netty:netty-transport-native-epoll:linux-x86_64:4.1.135.Final
-- io.netty:netty-transport-native-kqueue:osx-aarch_64:4.1.135.Final
-- io.netty:netty-transport-native-kqueue:osx-x86_64:4.1.135.Final
-- io.netty:netty-transport-native-unix-common:4.1.135.Final
-- io.netty:netty-transport-rxtx:4.1.135.Final
-- io.netty:netty-transport-sctp:4.1.135.Final
-- io.netty:netty-transport-udt:4.1.135.Final
-- io.netty:netty-transport:4.1.135.Final
\ No newline at end of file
+- io.netty:netty-all:4.1.136.Final
+- io.netty:netty-buffer:4.1.136.Final
+- io.netty:netty-codec-dns:4.1.136.Final
+- io.netty:netty-codec-haproxy:4.1.136.Final
+- io.netty:netty-codec-http2:4.1.136.Final
+- io.netty:netty-codec-http:4.1.136.Final
+- io.netty:netty-codec-memcache:4.1.136.Final
+- io.netty:netty-codec-mqtt:4.1.136.Final
+- io.netty:netty-codec-redis:4.1.136.Final
+- io.netty:netty-codec-smtp:4.1.136.Final
+- io.netty:netty-codec-socks:4.1.136.Final
+- io.netty:netty-codec-stomp:4.1.136.Final
+- io.netty:netty-codec-xml:4.1.136.Final
+- io.netty:netty-codec:4.1.136.Final
+- io.netty:netty-common:4.1.136.Final
+- io.netty:netty-handler-proxy:4.1.136.Final
+- io.netty:netty-handler-ssl-ocsp:4.1.136.Final
+- io.netty:netty-handler:4.1.136.Final
+- io.netty:netty-resolver-dns-classes-macos:4.1.136.Final
+- io.netty:netty-resolver-dns-native-macos:osx-aarch_64:4.1.136.Final
+- io.netty:netty-resolver-dns-native-macos:osx-x86_64:4.1.136.Final
+- io.netty:netty-resolver-dns:4.1.136.Final
+- io.netty:netty-resolver:4.1.136.Final
+- io.netty:netty-transport-classes-epoll:4.1.136.Final
+- io.netty:netty-transport-classes-kqueue:4.1.136.Final
+- io.netty:netty-transport-native-epoll:linux-aarch_64:4.1.136.Final
+- io.netty:netty-transport-native-epoll:linux-riscv64:4.1.136.Final
+- io.netty:netty-transport-native-epoll:linux-x86_64:4.1.136.Final
+- io.netty:netty-transport-native-kqueue:osx-aarch_64:4.1.136.Final
+- io.netty:netty-transport-native-kqueue:osx-x86_64:4.1.136.Final
+- io.netty:netty-transport-native-unix-common:4.1.136.Final
+- io.netty:netty-transport-rxtx:4.1.136.Final
+- io.netty:netty-transport-sctp:4.1.136.Final
+- io.netty:netty-transport-udt:4.1.136.Final
+- io.netty:netty-transport:4.1.136.Final
\ No newline at end of file
diff --git
a/flink-shaded-zookeeper-parent/flink-shaded-zookeeper-35/src/main/resources/META-INF/NOTICE
b/flink-shaded-zookeeper-parent/flink-shaded-zookeeper-35/src/main/resources/META-INF/NOTICE
index 220cdf1..45c09ff 100644
---
a/flink-shaded-zookeeper-parent/flink-shaded-zookeeper-35/src/main/resources/META-INF/NOTICE
+++
b/flink-shaded-zookeeper-parent/flink-shaded-zookeeper-35/src/main/resources/META-INF/NOTICE
@@ -7,15 +7,15 @@ The Apache Software Foundation (http://www.apache.org/).
This project bundles the following dependencies under the Apache Software
License 2.0 (http://www.apache.org/licenses/LICENSE-2.0.txt)
- com.google.guava:guava:33.4.0-jre
-- io.netty:netty-buffer:4.1.135.Final
-- io.netty:netty-codec:4.1.135.Final
-- io.netty:netty-common:4.1.135.Final
-- io.netty:netty-handler:4.1.135.Final
-- io.netty:netty-resolver:4.1.135.Final
-- io.netty:netty-transport-classes-epoll:4.1.135.Final
-- io.netty:netty-transport-native-epoll:4.1.135.Final
-- io.netty:netty-transport-native-unix-common:4.1.135.Final
-- io.netty:netty-transport:4.1.135.Final
+- io.netty:netty-buffer:4.1.136.Final
+- io.netty:netty-codec:4.1.136.Final
+- io.netty:netty-common:4.1.136.Final
+- io.netty:netty-handler:4.1.136.Final
+- io.netty:netty-resolver:4.1.136.Final
+- io.netty:netty-transport-classes-epoll:4.1.136.Final
+- io.netty:netty-transport-native-epoll:4.1.136.Final
+- io.netty:netty-transport-native-unix-common:4.1.136.Final
+- io.netty:netty-transport:4.1.136.Final
- org.apache.curator:curator-client:5.4.0
- org.apache.curator:curator-framework:5.4.0
- org.apache.curator:curator-recipes:5.4.0
diff --git
a/flink-shaded-zookeeper-parent/flink-shaded-zookeeper-36/src/main/resources/META-INF/NOTICE
b/flink-shaded-zookeeper-parent/flink-shaded-zookeeper-36/src/main/resources/META-INF/NOTICE
index 88dc00d..ef67df6 100644
---
a/flink-shaded-zookeeper-parent/flink-shaded-zookeeper-36/src/main/resources/META-INF/NOTICE
+++
b/flink-shaded-zookeeper-parent/flink-shaded-zookeeper-36/src/main/resources/META-INF/NOTICE
@@ -8,15 +8,15 @@ This project bundles the following dependencies under the
Apache Software Licens
- com.google.guava:guava:33.4.0-jre
- io.dropwizard.metrics:metrics-core:3.2.5
-- io.netty:netty-buffer:4.1.135.Final
-- io.netty:netty-codec:4.1.135.Final
-- io.netty:netty-common:4.1.135.Final
-- io.netty:netty-handler:4.1.135.Final
-- io.netty:netty-resolver:4.1.135.Final
-- io.netty:netty-transport-classes-epoll:4.1.135.Final
-- io.netty:netty-transport-native-epoll:4.1.135.Final
-- io.netty:netty-transport-native-unix-common:4.1.135.Final
-- io.netty:netty-transport:4.1.135.Final
+- io.netty:netty-buffer:4.1.136.Final
+- io.netty:netty-codec:4.1.136.Final
+- io.netty:netty-common:4.1.136.Final
+- io.netty:netty-handler:4.1.136.Final
+- io.netty:netty-resolver:4.1.136.Final
+- io.netty:netty-transport-classes-epoll:4.1.136.Final
+- io.netty:netty-transport-native-epoll:4.1.136.Final
+- io.netty:netty-transport-native-unix-common:4.1.136.Final
+- io.netty:netty-transport:4.1.136.Final
- org.apache.curator:curator-client:5.4.0
- org.apache.curator:curator-framework:5.4.0
- org.apache.curator:curator-recipes:5.4.0
diff --git
a/flink-shaded-zookeeper-parent/flink-shaded-zookeeper-37/src/main/resources/META-INF/NOTICE
b/flink-shaded-zookeeper-parent/flink-shaded-zookeeper-37/src/main/resources/META-INF/NOTICE
index 7da6ed3..dfe9554 100644
---
a/flink-shaded-zookeeper-parent/flink-shaded-zookeeper-37/src/main/resources/META-INF/NOTICE
+++
b/flink-shaded-zookeeper-parent/flink-shaded-zookeeper-37/src/main/resources/META-INF/NOTICE
@@ -8,15 +8,15 @@ This project bundles the following dependencies under the
Apache Software Licens
- com.google.guava:guava:33.4.0-jre
- io.dropwizard.metrics:metrics-core:4.1.12.1
-- io.netty:netty-buffer:4.1.135.Final
-- io.netty:netty-codec:4.1.135.Final
-- io.netty:netty-common:4.1.135.Final
-- io.netty:netty-handler:4.1.135.Final
-- io.netty:netty-resolver:4.1.135.Final
-- io.netty:netty-transport-classes-epoll:4.1.135.Final
-- io.netty:netty-transport-native-epoll:4.1.135.Final
-- io.netty:netty-transport-native-unix-common:4.1.135.Final
-- io.netty:netty-transport:4.1.135.Final
+- io.netty:netty-buffer:4.1.136.Final
+- io.netty:netty-codec:4.1.136.Final
+- io.netty:netty-common:4.1.136.Final
+- io.netty:netty-handler:4.1.136.Final
+- io.netty:netty-resolver:4.1.136.Final
+- io.netty:netty-transport-classes-epoll:4.1.136.Final
+- io.netty:netty-transport-native-epoll:4.1.136.Final
+- io.netty:netty-transport-native-unix-common:4.1.136.Final
+- io.netty:netty-transport:4.1.136.Final
- org.apache.curator:curator-client:5.4.0
- org.apache.curator:curator-framework:5.4.0
- org.apache.curator:curator-recipes:5.4.0
diff --git
a/flink-shaded-zookeeper-parent/flink-shaded-zookeeper-38/src/main/resources/META-INF/NOTICE
b/flink-shaded-zookeeper-parent/flink-shaded-zookeeper-38/src/main/resources/META-INF/NOTICE
index fb6e624..2ce0050 100644
---
a/flink-shaded-zookeeper-parent/flink-shaded-zookeeper-38/src/main/resources/META-INF/NOTICE
+++
b/flink-shaded-zookeeper-parent/flink-shaded-zookeeper-38/src/main/resources/META-INF/NOTICE
@@ -9,15 +9,15 @@ This project bundles the following dependencies under the
Apache Software Licens
- com.google.guava:guava:33.4.0-jre
- commons-io:commons-io:2.11.0
- io.dropwizard.metrics:metrics-core:4.1.12.1
-- io.netty:netty-buffer:4.1.135.Final
-- io.netty:netty-codec:4.1.135.Final
-- io.netty:netty-common:4.1.135.Final
-- io.netty:netty-handler:4.1.135.Final
-- io.netty:netty-resolver:4.1.135.Final
-- io.netty:netty-transport-classes-epoll:4.1.135.Final
-- io.netty:netty-transport-native-epoll:4.1.135.Final
-- io.netty:netty-transport-native-unix-common:4.1.135.Final
-- io.netty:netty-transport:4.1.135.Final
+- io.netty:netty-buffer:4.1.136.Final
+- io.netty:netty-codec:4.1.136.Final
+- io.netty:netty-common:4.1.136.Final
+- io.netty:netty-handler:4.1.136.Final
+- io.netty:netty-resolver:4.1.136.Final
+- io.netty:netty-transport-classes-epoll:4.1.136.Final
+- io.netty:netty-transport-native-epoll:4.1.136.Final
+- io.netty:netty-transport-native-unix-common:4.1.136.Final
+- io.netty:netty-transport:4.1.136.Final
- org.apache.curator:curator-client:5.4.0
- org.apache.curator:curator-framework:5.4.0
- org.apache.curator:curator-recipes:5.4.0
diff --git a/pom.xml b/pom.xml
index 515a304..557a6cf 100644
--- a/pom.xml
+++ b/pom.xml
@@ -62,7 +62,7 @@ under the License.
<properties>
<shading.prefix>org.apache.flink.shaded</shading.prefix>
- <netty.version>4.1.135.Final</netty.version>
+ <netty.version>4.1.136.Final</netty.version>
<jackson.version>2.18.10</jackson.version>
<jsonpath.version>2.9.0</jsonpath.version>
<guava.version>33.4.0-jre</guava.version>
