dependabot[bot] opened a new pull request, #4548: URL: https://github.com/apache/iggy/pull/4548
Bumps the java group with 3 updates in the /bdd/java directory: [io.cucumber:cucumber-java](https://github.com/cucumber/cucumber-jvm), [io.cucumber:cucumber-junit-platform-engine](https://github.com/cucumber/cucumber-jvm) and [gradle-wrapper](https://github.com/gradle/gradle). Bumps the java group with 1 update in the /examples/java directory: [gradle-wrapper](https://github.com/gradle/gradle). Bumps the java group with 8 updates in the /foreign/java directory: | Package | From | To | | --- | --- | --- | | [gradle-wrapper](https://github.com/gradle/gradle) | `9.8.0` | `9.8.1` | | [org.apache.httpcomponents.client5:httpclient5](https://github.com/apache/httpcomponents-client) | `5.6.4` | `5.6.5` | | [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.6.4` | `1.6.5` | | [io.netty:netty-buffer](https://github.com/netty/netty) | `4.2.18.Final` | `4.2.19.Final` | | [io.netty:netty-transport](https://github.com/netty/netty) | `4.2.18.Final` | `4.2.19.Final` | | [io.netty:netty-handler](https://github.com/netty/netty) | `4.2.18.Final` | `4.2.19.Final` | | [io.netty:netty-codec](https://github.com/netty/netty) | `4.2.18.Final` | `4.2.19.Final` | | [io.netty:netty-resolver-dns-native-macos](https://github.com/netty/netty) | `4.2.18.Final` | `4.2.19.Final` | | [io.netty:netty-transport](https://github.com/netty/netty) | `4.2.18.Final` | `4.2.19.Final` | | [io.netty:netty-handler](https://github.com/netty/netty) | `4.2.18.Final` | `4.2.19.Final` | | [io.netty:netty-codec](https://github.com/netty/netty) | `4.2.18.Final` | `4.2.19.Final` | | [io.netty:netty-resolver-dns-native-macos](https://github.com/netty/netty) | `4.2.18.Final` | `4.2.19.Final` | Updates `io.cucumber:cucumber-java` from 8.0.3 to 8.0.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cucumber/cucumber-jvm/releases";>io.cucumber:cucumber-java's releases</a>.</em></p> <blockquote> <h2>v8.0.4</h2> <h3>Fixed</h3> <ul> <li>[Core] Apply class predicate from backends to glue-classes (<a href="https://redirect.github.com/cucumber/cucumber-jvm/issues/3253";>#3253</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/cucumber/cucumber-jvm/blob/main/CHANGELOG.md";>io.cucumber:cucumber-java's changelog</a>.</em></p> <blockquote> <h2>[8.0.4] - 2026-10-02</h2> <h3>Fixed</h3> <ul> <li>[Core] Apply class predicate from backends to glue-classes (<a href="https://redirect.github.com/cucumber/cucumber-jvm/issues/3253";>#3253</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cucumber/cucumber-jvm/commit/8a14d94caae7b51f79d60a4a738f69147ad6dbfe";><code>8a14d94</code></a> Prepare release v8.0.4</li> <li><a href="https://github.com/cucumber/cucumber-jvm/commit/9f5120de9f8a0989ca6f274a9eea09b5f7cb0fc2";><code>9f5120d</code></a> Apply classpredicate from backend to glue-classes (<a href="https://redirect.github.com/cucumber/cucumber-jvm/issues/3253";>#3253</a>)</li> <li><a href="https://github.com/cucumber/cucumber-jvm/commit/e36fc60c8b7afd0414929c73e9980354d67ef8d1";><code>e36fc60</code></a> Prepare for the next development iteration</li> <li>See full diff in <a href="https://github.com/cucumber/cucumber-jvm/compare/v8.0.3...v8.0.4";>compare view</a></li> </ul> </details> <br /> Updates `io.cucumber:cucumber-junit-platform-engine` from 8.0.3 to 8.0.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cucumber/cucumber-jvm/releases";>io.cucumber:cucumber-junit-platform-engine's releases</a>.</em></p> <blockquote> <h2>v8.0.4</h2> <h3>Fixed</h3> <ul> <li>[Core] Apply class predicate from backends to glue-classes (<a href="https://redirect.github.com/cucumber/cucumber-jvm/issues/3253";>#3253</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/cucumber/cucumber-jvm/blob/main/CHANGELOG.md";>io.cucumber:cucumber-junit-platform-engine's changelog</a>.</em></p> <blockquote> <h2>[8.0.4] - 2026-10-02</h2> <h3>Fixed</h3> <ul> <li>[Core] Apply class predicate from backends to glue-classes (<a href="https://redirect.github.com/cucumber/cucumber-jvm/issues/3253";>#3253</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cucumber/cucumber-jvm/commit/8a14d94caae7b51f79d60a4a738f69147ad6dbfe";><code>8a14d94</code></a> Prepare release v8.0.4</li> <li><a href="https://github.com/cucumber/cucumber-jvm/commit/9f5120de9f8a0989ca6f274a9eea09b5f7cb0fc2";><code>9f5120d</code></a> Apply classpredicate from backend to glue-classes (<a href="https://redirect.github.com/cucumber/cucumber-jvm/issues/3253";>#3253</a>)</li> <li><a href="https://github.com/cucumber/cucumber-jvm/commit/e36fc60c8b7afd0414929c73e9980354d67ef8d1";><code>e36fc60</code></a> Prepare for the next development iteration</li> <li>See full diff in <a href="https://github.com/cucumber/cucumber-jvm/compare/v8.0.3...v8.0.4";>compare view</a></li> </ul> </details> <br /> Updates `gradle-wrapper` from 9.8.0 to 9.8.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/gradle/gradle/releases";>gradle-wrapper's releases</a>.</em></p> <blockquote> <h2>9.8.1</h2> <p>This is a patch release for Gradle 9.8.0. We recommend using 9.8.1 instead of 9.8.0.</p> <p>This release addresses three high rated vulnerabilities:</p> <ul> <li><a href="https://github.com/gradle/gradle/security/advisories/GHSA-mvvg-497x-hmj8";>Unauthenticated worker-to-daemon channel deserializes untrusted Java objects</a></li> <li><a href="https://github.com/gradle/gradle/security/advisories/GHSA-xwqc-3h47-hg64";>Deserialization of untrusted Java objects before authentication in the client - daemon communication</a></li> <li><a href="https://github.com/gradle/gradle/security/advisories/GHSA-j5m7-59rp-24f5";>Failure to disable repositories failing to establish an SSL connection can expose builds to malicious artifacts</a></li> </ul> <p>The following issues were resolved:</p> <ul> <li>[Gradle 9.8.0 complains again about invalid Toolchains on Debian / Ubuntu packaged systems]- (<a href="https://redirect.github.com/gradle/gradle/issues/39358";>gradle/gradle#39358</a>)</li> <li><a href="https://redirect.github.com/gradle/gradle/issues/39359";>Gradle 9.8.0 removes root java.util.logging handlers installed by a custom LogManager (breaks Quarkus test log capture)</a></li> <li><a href="https://redirect.github.com/gradle/gradle/issues/39365";>Dependency resolution regression</a></li> </ul> <p><a href="https://docs.gradle.org/9.8.1/release-notes.html";>Read the Release Notes</a></p> <p>We would like to thank the following community members for their contributions to this release of Gradle: <a href="https://github.com/Gautam-aman";>Aman Gautam</a>, <a href="https://github.com/Vampire";>Björn Kautler</a>, <a href="https://github.com/Juneezee";>Eng Zer Jun</a>, <a href="https://github.com/Hashim1999164";>Hashim Khan</a>, <a href="https://github.com/jkrannich";>Julian Krannich</a>, <a href="https://github.com/youdie006";>KBS</a>, <a href="https://github.com/itsCodeTide";>Labh R Jethe</a>, <a href="https://github.com/doddi";>Mark Dodgson</a>, <a href="https://github.com/kroune";>Maxim</a>, <a href="https://github.com/Develop-KIM";>monkey</a>, <a href="https://github.com/nataphon-ktsystems";>nataphon-ktsystems</a>, <a href="https://github.com/paulk-asert";>Paul King</a>, <a href="https://github.com/qiu-tiandev";>Qiu Tian</a>, <a href="https://github.com/sandeshgorde";>rg_sandesh</a>, <a href="https://github.com/rpalcolea";>Roberto Perez Alcolea</a>, <a href="https://github.com/seanxuu";>Sean</a>, <a href="https://github.com/Goooler";>Zongle Wang</a>.</p> <h2>Upgrade instructions</h2> <p>Switch your build to use Gradle 9.8.1 by updating your wrapper:</p> <pre><code>./gradlew :wrapper --gradle-version=9.8.1 && ./gradlew :wrapper </code></pre> <p>See the Gradle <a href="https://docs.gradle.org/9.8.1/userguide/upgrading_version_9.html";>9.x upgrade guide</a> to learn about deprecations, breaking changes and other considerations when upgrading.</p> <p>For Java, Groovy, Kotlin and Android compatibility, see the <a href="https://docs.gradle.org/9.8.1/userguide/compatibility.html";>full compatibility notes</a>.</p> <h2>Reporting problems</h2> <p>If you find a problem with this release, please file a bug on <a href="https://github.com/gradle/gradle/issues";>GitHub Issues</a> adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the <a href="https://discuss.gradle.org/c/help-discuss";>forum</a>.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/gradle/gradle/commit/39daf39feb60a18b1b6ddccde53366522fef516f";><code>39daf39</code></a> Release notes for Gradle 9.8.1 (<a href="https://redirect.github.com/gradle/gradle/issues/39409";>#39409</a>)</li> <li><a href="https://github.com/gradle/gradle/commit/4fc92e52f54010b0c973476e01ace071b3ecd7ba";><code>4fc92e5</code></a> Release notes for Gradle 9.8.1</li> <li><a href="https://github.com/gradle/gradle/commit/bfbd14a7daf19978f8028765b78e2d53f398d9ad";><code>bfbd14a</code></a> Make repository disabling stricter (<a href="https://redirect.github.com/gradle/gradle/issues/39403";>#39403</a>)</li> <li><a href="https://github.com/gradle/gradle/commit/95e0bf95c8837ea91f150460f6ea97746f71c640";><code>95e0bf9</code></a> Check daemon & worker preamble earlier (<a href="https://redirect.github.com/gradle/gradle/issues/39402";>#39402</a>)</li> <li><a href="https://github.com/gradle/gradle/commit/7aa9a5b469771202833e354bb91becdde27dcd70";><code>7aa9a5b</code></a> Improve display for distribution url in wrapper (<a href="https://redirect.github.com/gradle/gradle/issues/39401";>#39401</a>)</li> <li><a href="https://github.com/gradle/gradle/commit/74a77206ec954fa9725e8d27fb62744afaf4a228";><code>74a7720</code></a> Wrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...</li> <li><a href="https://github.com/gradle/gradle/commit/651110a5cbf1b1ee9777e0c8f90f160d5d91fcba";><code>651110a</code></a> Check worker token before any serialization similarly to daemon</li> <li><a href="https://github.com/gradle/gradle/commit/8a6b9d9f9c59aefadb91369c90bd00aa4f1a323f";><code>8a6b9d9</code></a> Harden repository disabling: disable them by default on failure unless there'...</li> <li><a href="https://github.com/gradle/gradle/commit/f28e51437beb6c61f4cd83eefe86d1070b129054";><code>f28e514</code></a> Check the daemon token before any serialization</li> <li><a href="https://github.com/gradle/gradle/commit/86ab2732c8d83fc23b2fd0aca9de548e4a260937";><code>86ab273</code></a> Replace credentials for distribution url with *** and avoid showing the plain...</li> <li>Additional commits viewable in <a href="https://github.com/gradle/gradle/compare/v9.8.0...v9.8.1";>compare view</a></li> </ul> </details> <br /> Updates `gradle-wrapper` from 9.8.0 to 9.8.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/gradle/gradle/releases";>gradle-wrapper's releases</a>.</em></p> <blockquote> <h2>9.8.1</h2> <p>This is a patch release for Gradle 9.8.0. We recommend using 9.8.1 instead of 9.8.0.</p> <p>This release addresses three high rated vulnerabilities:</p> <ul> <li><a href="https://github.com/gradle/gradle/security/advisories/GHSA-mvvg-497x-hmj8";>Unauthenticated worker-to-daemon channel deserializes untrusted Java objects</a></li> <li><a href="https://github.com/gradle/gradle/security/advisories/GHSA-xwqc-3h47-hg64";>Deserialization of untrusted Java objects before authentication in the client - daemon communication</a></li> <li><a href="https://github.com/gradle/gradle/security/advisories/GHSA-j5m7-59rp-24f5";>Failure to disable repositories failing to establish an SSL connection can expose builds to malicious artifacts</a></li> </ul> <p>The following issues were resolved:</p> <ul> <li>[Gradle 9.8.0 complains again about invalid Toolchains on Debian / Ubuntu packaged systems]- (<a href="https://redirect.github.com/gradle/gradle/issues/39358";>gradle/gradle#39358</a>)</li> <li><a href="https://redirect.github.com/gradle/gradle/issues/39359";>Gradle 9.8.0 removes root java.util.logging handlers installed by a custom LogManager (breaks Quarkus test log capture)</a></li> <li><a href="https://redirect.github.com/gradle/gradle/issues/39365";>Dependency resolution regression</a></li> </ul> <p><a href="https://docs.gradle.org/9.8.1/release-notes.html";>Read the Release Notes</a></p> <p>We would like to thank the following community members for their contributions to this release of Gradle: <a href="https://github.com/Gautam-aman";>Aman Gautam</a>, <a href="https://github.com/Vampire";>Björn Kautler</a>, <a href="https://github.com/Juneezee";>Eng Zer Jun</a>, <a href="https://github.com/Hashim1999164";>Hashim Khan</a>, <a href="https://github.com/jkrannich";>Julian Krannich</a>, <a href="https://github.com/youdie006";>KBS</a>, <a href="https://github.com/itsCodeTide";>Labh R Jethe</a>, <a href="https://github.com/doddi";>Mark Dodgson</a>, <a href="https://github.com/kroune";>Maxim</a>, <a href="https://github.com/Develop-KIM";>monkey</a>, <a href="https://github.com/nataphon-ktsystems";>nataphon-ktsystems</a>, <a href="https://github.com/paulk-asert";>Paul King</a>, <a href="https://github.com/qiu-tiandev";>Qiu Tian</a>, <a href="https://github.com/sandeshgorde";>rg_sandesh</a>, <a href="https://github.com/rpalcolea";>Roberto Perez Alcolea</a>, <a href="https://github.com/seanxuu";>Sean</a>, <a href="https://github.com/Goooler";>Zongle Wang</a>.</p> <h2>Upgrade instructions</h2> <p>Switch your build to use Gradle 9.8.1 by updating your wrapper:</p> <pre><code>./gradlew :wrapper --gradle-version=9.8.1 && ./gradlew :wrapper </code></pre> <p>See the Gradle <a href="https://docs.gradle.org/9.8.1/userguide/upgrading_version_9.html";>9.x upgrade guide</a> to learn about deprecations, breaking changes and other considerations when upgrading.</p> <p>For Java, Groovy, Kotlin and Android compatibility, see the <a href="https://docs.gradle.org/9.8.1/userguide/compatibility.html";>full compatibility notes</a>.</p> <h2>Reporting problems</h2> <p>If you find a problem with this release, please file a bug on <a href="https://github.com/gradle/gradle/issues";>GitHub Issues</a> adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the <a href="https://discuss.gradle.org/c/help-discuss";>forum</a>.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/gradle/gradle/commit/39daf39feb60a18b1b6ddccde53366522fef516f";><code>39daf39</code></a> Release notes for Gradle 9.8.1 (<a href="https://redirect.github.com/gradle/gradle/issues/39409";>#39409</a>)</li> <li><a href="https://github.com/gradle/gradle/commit/4fc92e52f54010b0c973476e01ace071b3ecd7ba";><code>4fc92e5</code></a> Release notes for Gradle 9.8.1</li> <li><a href="https://github.com/gradle/gradle/commit/bfbd14a7daf19978f8028765b78e2d53f398d9ad";><code>bfbd14a</code></a> Make repository disabling stricter (<a href="https://redirect.github.com/gradle/gradle/issues/39403";>#39403</a>)</li> <li><a href="https://github.com/gradle/gradle/commit/95e0bf95c8837ea91f150460f6ea97746f71c640";><code>95e0bf9</code></a> Check daemon & worker preamble earlier (<a href="https://redirect.github.com/gradle/gradle/issues/39402";>#39402</a>)</li> <li><a href="https://github.com/gradle/gradle/commit/7aa9a5b469771202833e354bb91becdde27dcd70";><code>7aa9a5b</code></a> Improve display for distribution url in wrapper (<a href="https://redirect.github.com/gradle/gradle/issues/39401";>#39401</a>)</li> <li><a href="https://github.com/gradle/gradle/commit/74a77206ec954fa9725e8d27fb62744afaf4a228";><code>74a7720</code></a> Wrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...</li> <li><a href="https://github.com/gradle/gradle/commit/651110a5cbf1b1ee9777e0c8f90f160d5d91fcba";><code>651110a</code></a> Check worker token before any serialization similarly to daemon</li> <li><a href="https://github.com/gradle/gradle/commit/8a6b9d9f9c59aefadb91369c90bd00aa4f1a323f";><code>8a6b9d9</code></a> Harden repository disabling: disable them by default on failure unless there'...</li> <li><a href="https://github.com/gradle/gradle/commit/f28e51437beb6c61f4cd83eefe86d1070b129054";><code>f28e514</code></a> Check the daemon token before any serialization</li> <li><a href="https://github.com/gradle/gradle/commit/86ab2732c8d83fc23b2fd0aca9de548e4a260937";><code>86ab273</code></a> Replace credentials for distribution url with *** and avoid showing the plain...</li> <li>Additional commits viewable in <a href="https://github.com/gradle/gradle/compare/v9.8.0...v9.8.1";>compare view</a></li> </ul> </details> <br /> Updates `gradle-wrapper` from 9.8.0 to 9.8.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/gradle/gradle/releases";>gradle-wrapper's releases</a>.</em></p> <blockquote> <h2>9.8.1</h2> <p>This is a patch release for Gradle 9.8.0. We recommend using 9.8.1 instead of 9.8.0.</p> <p>This release addresses three high rated vulnerabilities:</p> <ul> <li><a href="https://github.com/gradle/gradle/security/advisories/GHSA-mvvg-497x-hmj8";>Unauthenticated worker-to-daemon channel deserializes untrusted Java objects</a></li> <li><a href="https://github.com/gradle/gradle/security/advisories/GHSA-xwqc-3h47-hg64";>Deserialization of untrusted Java objects before authentication in the client - daemon communication</a></li> <li><a href="https://github.com/gradle/gradle/security/advisories/GHSA-j5m7-59rp-24f5";>Failure to disable repositories failing to establish an SSL connection can expose builds to malicious artifacts</a></li> </ul> <p>The following issues were resolved:</p> <ul> <li>[Gradle 9.8.0 complains again about invalid Toolchains on Debian / Ubuntu packaged systems]- (<a href="https://redirect.github.com/gradle/gradle/issues/39358";>gradle/gradle#39358</a>)</li> <li><a href="https://redirect.github.com/gradle/gradle/issues/39359";>Gradle 9.8.0 removes root java.util.logging handlers installed by a custom LogManager (breaks Quarkus test log capture)</a></li> <li><a href="https://redirect.github.com/gradle/gradle/issues/39365";>Dependency resolution regression</a></li> </ul> <p><a href="https://docs.gradle.org/9.8.1/release-notes.html";>Read the Release Notes</a></p> <p>We would like to thank the following community members for their contributions to this release of Gradle: <a href="https://github.com/Gautam-aman";>Aman Gautam</a>, <a href="https://github.com/Vampire";>Björn Kautler</a>, <a href="https://github.com/Juneezee";>Eng Zer Jun</a>, <a href="https://github.com/Hashim1999164";>Hashim Khan</a>, <a href="https://github.com/jkrannich";>Julian Krannich</a>, <a href="https://github.com/youdie006";>KBS</a>, <a href="https://github.com/itsCodeTide";>Labh R Jethe</a>, <a href="https://github.com/doddi";>Mark Dodgson</a>, <a href="https://github.com/kroune";>Maxim</a>, <a href="https://github.com/Develop-KIM";>monkey</a>, <a href="https://github.com/nataphon-ktsystems";>nataphon-ktsystems</a>, <a href="https://github.com/paulk-asert";>Paul King</a>, <a href="https://github.com/qiu-tiandev";>Qiu Tian</a>, <a href="https://github.com/sandeshgorde";>rg_sandesh</a>, <a href="https://github.com/rpalcolea";>Roberto Perez Alcolea</a>, <a href="https://github.com/seanxuu";>Sean</a>, <a href="https://github.com/Goooler";>Zongle Wang</a>.</p> <h2>Upgrade instructions</h2> <p>Switch your build to use Gradle 9.8.1 by updating your wrapper:</p> <pre><code>./gradlew :wrapper --gradle-version=9.8.1 && ./gradlew :wrapper </code></pre> <p>See the Gradle <a href="https://docs.gradle.org/9.8.1/userguide/upgrading_version_9.html";>9.x upgrade guide</a> to learn about deprecations, breaking changes and other considerations when upgrading.</p> <p>For Java, Groovy, Kotlin and Android compatibility, see the <a href="https://docs.gradle.org/9.8.1/userguide/compatibility.html";>full compatibility notes</a>.</p> <h2>Reporting problems</h2> <p>If you find a problem with this release, please file a bug on <a href="https://github.com/gradle/gradle/issues";>GitHub Issues</a> adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the <a href="https://discuss.gradle.org/c/help-discuss";>forum</a>.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/gradle/gradle/commit/39daf39feb60a18b1b6ddccde53366522fef516f";><code>39daf39</code></a> Release notes for Gradle 9.8.1 (<a href="https://redirect.github.com/gradle/gradle/issues/39409";>#39409</a>)</li> <li><a href="https://github.com/gradle/gradle/commit/4fc92e52f54010b0c973476e01ace071b3ecd7ba";><code>4fc92e5</code></a> Release notes for Gradle 9.8.1</li> <li><a href="https://github.com/gradle/gradle/commit/bfbd14a7daf19978f8028765b78e2d53f398d9ad";><code>bfbd14a</code></a> Make repository disabling stricter (<a href="https://redirect.github.com/gradle/gradle/issues/39403";>#39403</a>)</li> <li><a href="https://github.com/gradle/gradle/commit/95e0bf95c8837ea91f150460f6ea97746f71c640";><code>95e0bf9</code></a> Check daemon & worker preamble earlier (<a href="https://redirect.github.com/gradle/gradle/issues/39402";>#39402</a>)</li> <li><a href="https://github.com/gradle/gradle/commit/7aa9a5b469771202833e354bb91becdde27dcd70";><code>7aa9a5b</code></a> Improve display for distribution url in wrapper (<a href="https://redirect.github.com/gradle/gradle/issues/39401";>#39401</a>)</li> <li><a href="https://github.com/gradle/gradle/commit/74a77206ec954fa9725e8d27fb62744afaf4a228";><code>74a7720</code></a> Wrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...</li> <li><a href="https://github.com/gradle/gradle/commit/651110a5cbf1b1ee9777e0c8f90f160d5d91fcba";><code>651110a</code></a> Check worker token before any serialization similarly to daemon</li> <li><a href="https://github.com/gradle/gradle/commit/8a6b9d9f9c59aefadb91369c90bd00aa4f1a323f";><code>8a6b9d9</code></a> Harden repository disabling: disable them by default on failure unless there'...</li> <li><a href="https://github.com/gradle/gradle/commit/f28e51437beb6c61f4cd83eefe86d1070b129054";><code>f28e514</code></a> Check the daemon token before any serialization</li> <li><a href="https://github.com/gradle/gradle/commit/86ab2732c8d83fc23b2fd0aca9de548e4a260937";><code>86ab273</code></a> Replace credentials for distribution url with *** and avoid showing the plain...</li> <li>Additional commits viewable in <a href="https://github.com/gradle/gradle/compare/v9.8.0...v9.8.1";>compare view</a></li> </ul> </details> <br /> Updates `org.apache.httpcomponents.client5:httpclient5` from 5.6.4 to 5.6.5 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/apache/httpcomponents-client/blob/rel/v5.6.5/RELEASE_NOTES.txt";>org.apache.httpcomponents.client5:httpclient5's changelog</a>.</em></p> <blockquote> <h2>Release 5.6.5</h2> <p>This maintenance release fixes several defects found since the previous release including the defect in the async Brotli decompression code that can cause the message exchange to hang indefinitely. It also upgrades HttpCore to version 5.4.4.</p> <h2>Change Log</h2> <ul> <li> <p>Upgraded HttpCore to version 5.4.4. Contributed by Oleg Kalnichevski <!-- raw HTML omitted --></p> </li> <li> <p>HTTPCLIENT-2433: Prevent concurrent HTTP/2 request body replay. Contributed by Matthias Kurz <m.kurz at irregular.at></p> </li> <li> <p>HTTPCLIENT-2432: Fixed connection-pool leak in ResponseEntityProxy#cleanup() when runtime #disconnectEndpoint throws an exception (<a href="https://redirect.github.com/apache/httpcomponents-client/issues/883";>#883</a>). Contributed by Victor Alekseev <!-- raw HTML omitted --></p> </li> <li> <p>Decode punycode public suffixes in PublicSuffixMatcher#verify (<a href="https://redirect.github.com/apache/httpcomponents-client/issues/876";>#876</a>). Contributed by Javid Khan <!-- raw HTML omitted --></p> </li> <li> <p>Fixed Brotli decompression hang with large input buffers. Contributed by Arturo Bernal <!-- raw HTML omitted --></p> </li> <li> <p>HTTP cache to treat malformed delta-seconds as absent. Contributed by Arturo Bernal Javid Khan <!-- raw HTML omitted --></p> </li> <li> <p>Bug-fix: ResponseCachingPolicy incorrectly applies <code>neverCache1_1ResponsesWithQueryString</code> config parameter. This config parameter and related functionality will be deprecated in the next feature release and removed in the future. Contributed by Oleg Kalnichevski <!-- raw HTML omitted --></p> </li> <li> <p>Removed invalid request version check from ResponseCachingPolicy. Contributed by Oleg Kalnichevski <!-- raw HTML omitted --></p> </li> <li> <p>Fixed resource leaking on error in AsyncCachingExec Contributed by Jeremie Bolduc <16137441+Jouramie at users.noreply.github.com></p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/httpcomponents-client/commit/e6970b4b9da00485bc6e702a3c632933d19d6f3f";><code>e6970b4</code></a> HttpClient 5.6.5 release</li> <li><a href="https://github.com/apache/httpcomponents-client/commit/d0ff6ec0d53afc79ada7f8790df6226de4204654";><code>d0ff6ec</code></a> Updated release notes for HttpClient 5.6.5 release</li> <li><a href="https://github.com/apache/httpcomponents-client/commit/03a2abc5fa2dccccaaa9de0a1e4ed6d5ba150515";><code>03a2abc</code></a> Upgraded HttpCore to version 5.4.4</li> <li><a href="https://github.com/apache/httpcomponents-client/commit/7ed9d66d0fe108123ebf43d0392f1de0b90ad1c1";><code>7ed9d66</code></a> HTTPCLIENT-2433: Prevent concurrent HTTP/2 request body replay</li> <li><a href="https://github.com/apache/httpcomponents-client/commit/bd278a662a615aa6155f251842ed736b4abaa60f";><code>bd278a6</code></a> Improved connection expiry and eviction example</li> <li><a href="https://github.com/apache/httpcomponents-client/commit/02f11ebeeea92dc0b3156b357cebd56cadedd8f8";><code>02f11eb</code></a> HTTPCLIENT-2432: fix connection-pool leak in ResponseEntityProxy.cleanup() wh...</li> <li><a href="https://github.com/apache/httpcomponents-client/commit/8e45f17619dd5e7e139f11d58cbc9419ba0c3cc3";><code>8e45f17</code></a> decode punycode public suffixes in PublicSuffixMatcher.verify (<a href="https://redirect.github.com/apache/httpcomponents-client/issues/876";>#876</a>)</li> <li><a href="https://github.com/apache/httpcomponents-client/commit/6d8319a2532595bad3098f98587d4a72b618aea6";><code>6d8319a</code></a> Fix Brotli decompression hang with large input buffers</li> <li><a href="https://github.com/apache/httpcomponents-client/commit/908ccc12050b3a54709103b9969907a52a73c3b3";><code>908ccc1</code></a> treat malformed delta-seconds as absent in deltaSeconds</li> <li><a href="https://github.com/apache/httpcomponents-client/commit/815043adf57b31cd7c99f911dcfb573fffcb5e4d";><code>815043a</code></a> Moved timeout and stale connection related integration tests into separate gr...</li> <li>Additional commits viewable in <a href="https://github.com/apache/httpcomponents-client/compare/rel/v5.6.4...rel/v5.6.5";>compare view</a></li> </ul> </details> <br /> Updates `ch.qos.logback:logback-classic` from 1.6.4 to 1.6.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/qos-ch/logback/releases";>ch.qos.logback:logback-classic's releases</a>.</em></p> <blockquote> <h2>Logback 1.6.5</h2> <p>2026-09-30 Release of logback version 1.6.5</p> <p>• Fixed a vulnerability <a href="https://www.cve.org/CVERecord?id=CVE-2026-104721";>CVE-2026-104721</a> closely related to <a href="https://www.cve.org/cverecord?id=CVE-2026-19880";>CVE-2026-19880</a>. The fix in version 1.6.3, which strips forward and backward slashes from <code>MDC</code> values, was insufficient. An <code>MDC</code> value could still contain relative path components such as .., variable references such as /, or characters that are special in file name patterns and email addresses. This latest vulnerability was found and reported by François Martin (GitHub: <a href="https://github.com/martinfrancois";><code>@martinfrancois</code></a>, <a href="https://github.com/martinfrancois";>https://github.com/martinfrancois</a>).</p> <p><code>MDCBasedDiscriminator</code>, used by <a href="https://logback.qos.ch/manual/appenders-async-sift.html#SiftingAppender";><code>SiftingAppender</code></a>, now rejects <code>MDC</code> values instead of stripping characters from them. An MDC value is rejected if it is empty, if it is longer than 64 characters, if it contains the sequence .., or if it contains any of the following characters: <code>/ \ $ { } [ ] ( ) | ? * + % , @</code>. When an <code>MDC</code> value is rejected, the discriminator returns the value of its <code>DefaultValue</code> property. A warning is emitted for each rejected value. These warnings are rate-limited.</p> <p>• When compression is enabled, <code>TimeBasedRollingPolicy</code> and <code>SizeAndTimeBasedRollingPolicy</code> now also remove old log files that were never compressed, for example because the application was not running at rollover time. Previously, such files were ignored by <code>maxHistory</code> and accumulated indefinitely. This issue was discussed in <a href="https://github.com/qos-ch/logback/discussions/1032";>discussions/1032</a>. See <a href="https://logback.qos.ch/manual/appenders-rolling.html#TimeBasedRollingPolicy";><code>TimeBasedRollingPolicy</code></a>.</p> <p>• <code>SimpleInvocationGate</code>, deprecated in version 1.6.3, is now marked for removal. Use <code>FixedIntervalInvocationGate</code> instead.</p> <p>• A bit-wise identical binary of this version can be reproduced by building from source code at commit d1b829dcdb9fd98511c64401beb1419a9c9384aa associated with the tag v_1.6.5. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/qos-ch/logback/commit/d1b829dcdb9fd98511c64401beb1419a9c9384aa";><code>d1b829d</code></a> prepare release 1.6.5</li> <li><a href="https://github.com/qos-ch/logback/commit/065b9b23d0d39f78bc92fe02f1c206feb281f7ab";><code>065b9b2</code></a> enhance protectin against mischievious MDC values in MDCBasedDiscriminator</li> <li><a href="https://github.com/qos-ch/logback/commit/b69beabb2c48a3e08cb2fdbb0846969be54346cc";><code>b69beab</code></a> complete commit in relation to discussion_1032</li> <li><a href="https://github.com/qos-ch/logback/commit/7266c0b08c4f52aba5aa0983c36622e0cbfccb9a";><code>7266c0b</code></a> fix intermittently failing SocketAppenderMessageLossTest rest condition</li> <li><a href="https://github.com/qos-ch/logback/commit/a633bb0f12600a6260498e1e81d7a123d3af8861";><code>a633bb0</code></a> fix intermittently failing SocketAppenderMessageLossTest rest condition</li> <li><a href="https://github.com/qos-ch/logback/commit/2bc5bccfa5db52428ad439880a35824ac8434819";><code>2bc5bcc</code></a> renamed tbrp and eclosingTBRP, other minor changes</li> <li><a href="https://github.com/qos-ch/logback/commit/2cd876291ce49fb33cbe8a21cdbaeece5c3b4f89";><code>2cd8762</code></a> fix typo in AGENTS.md</li> <li><a href="https://github.com/qos-ch/logback/commit/647846ce230a8865605fe8dd8dc95eac3c1e58ea";><code>647846c</code></a> fix errors when running tests under intellij IDEA</li> <li><a href="https://github.com/qos-ch/logback/commit/1048917953f79e6fa65a9f3f0e77c49f5baff4f0";><code>1048917</code></a> removed ConsoleCharsetPropertyDefiner.java</li> <li><a href="https://github.com/qos-ch/logback/commit/39b50022362fc242fa051d4be6d427aacfdc92cc";><code>39b5002</code></a> added 'since' and 'forRemoval' attributes to SimpleInvocationGate <a href="https://github.com/Deprecatio";><code>@Deprecatio</code></a>...</li> <li>See full diff in <a href="https://github.com/qos-ch/logback/compare/v_1.6.4...v_1.6.5";>compare view</a></li> </ul> </details> <br /> Updates `io.netty:netty-buffer` from 4.2.18.Final to 4.2.19.Final <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/netty/netty/releases";>io.netty:netty-buffer's releases</a>.</em></p> <blockquote> <h2>netty-4.2.19.Final</h2> <h2>Security</h2> <p><strong>Note that <a href="https://netty.io/news/2026/09/09/4-1-EOL-announcement.html";>Netty 4.1 will be End-of-Life on July 1st, 2027</a>.</strong></p> <p>We strongly recommend upgrading to this version to get the following security fixes:</p> <ul> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-frq3-7pw6-36cg";>CVE-2026-XXXXX</a> : parser desync in <code>io.netty:netty-codec-haproxy</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-6g26-xhvx-g5w3";>CVE-2026-XXXXX</a> : improper CRLF neutralization (request/response smuggling) in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-x9f7-rg73-4rp6";>CVE-2026-XXXXX</a> : origin validation error in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-2p3h-phr9-jf38";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-http2</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-vwgc-hvc9-2j59";>CVE-2026-XXXXX</a> : request/response smuggling in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-m3w2-2657-46g8";>CVE-2026-XXXXX</a> : time-of-check/time-of-use error in <code>io.netty:netty-handler-ssl-ocsp</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-jp47-57pp-4qpp";>CVE-2026-XXXXX</a> : SNI routing bypass in <code>io.netty:netty-handler</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-35qr-v9mm-35c5";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-xml</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-5h6f-wp3f-6hmv";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-base</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-x436-m93c-g2q9";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-c7hc-m259-xhcr";>CVE-2026-XXXXX</a> : input misinterpretation in <code>io.netty:netty-codec-socks</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-268p-9r42-7qp4";>CVE-2026-XXXXX</a> : improper access control in <code>io.netty:netty-handler</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-3h79-3wcf-5whr";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-dns</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-25w5-4jgp-m94q";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-http3</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-x2j7-6j3j-5vwj";>CVE-2026-XXXXX</a> : use-after-free in <code>io.netty:netty-transport-classes-io_uring</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-79q2-mhf4-2j6j";>CVE-2026-XXXXX</a> : memory leak in <code>io.netty:netty-transport-native-io_uring</code></li> </ul> <p>Note that due to overwhelming strain on the CVE infrastructure, we have not gotten a single CVE number assigned to these reports in time for our release. The advisories will be published without.</p> <p>Specific changes worth calling out:</p> <p><strong>Validation in <code>FileUpload.setContentType</code>.</strong> Previously, the <code>FileUpload.setContentType</code> methods did not validate their inputs. They now throw an <code>IllegaalArgumentException</code> if the given string is not formatted as a plausible MIME content type.</p> <h2>What's Changed</h2> <ul> <li>perf: Use LinkedHashSet to deduplicate search domains by <a href="https://github.com/JunggiKim";><code>@JunggiKim</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17400";>netty/netty#17400</a></li> <li>Handle non-positive skip lengths in ByteBufInputStream by <a href="https://github.com/cuishuang";><code>@cuishuang</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17388";>netty/netty#17388</a></li> <li>Avoid double promise allocation in SslHandler.wrap() by <a href="https://github.com/doom369";><code>@doom369</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17382";>netty/netty#17382</a></li> <li>Socket: Add half-closure tests to SocketHalfClosedTest by <a href="https://github.com/rajan-github";><code>@rajan-github</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17394";>netty/netty#17394</a></li> <li>HttpUtil.getCharset() must accept whitespace before the next Content-Type parameter by <a href="https://github.com/hunseonglee";><code>@hunseonglee</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17386";>netty/netty#17386</a></li> <li>codec-dns: Add SMIMEA, CDS, CDNSKEY, OPENPGPKEY, CSYNC, ZONEMD records by <a href="https://github.com/hyperxpro";><code>@hyperxpro</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17373";>netty/netty#17373</a></li> <li>transport: Avoid io_uring completion callback allocation by <a href="https://github.com/massiccio";><code>@massiccio</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17457";>netty/netty#17457</a></li> <li>QUIC: Ensure writable events reflect stream capacity by <a href="https://github.com/yawkat";><code>@yawkat</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17431";>netty/netty#17431</a></li> <li>OcspServerCertificateValidatorTest: Fix possible leak in test by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17469";>netty/netty#17469</a></li> <li>Use github to download cmake and also remove tar file after unpacking by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17482";>netty/netty#17482</a></li> <li>build: Upgrade GitHub Actions to fix Node.js 20 deprecation warnings by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17484";>netty/netty#17484</a></li> <li>HttpUtil.getMimeType() must not include whitespace before the next Content-Type parameter by <a href="https://github.com/ohchanKyu";><code>@ohchanKyu</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17456";>netty/netty#17456</a></li> <li>Fix buffer leak when recvmmsg returns single UDP_GRO batch by <a href="https://github.com/octa-one";><code>@octa-one</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17493";>netty/netty#17493</a></li> <li>Guard ChunkedWriteHandler.doFlush() against re-entrant invocation from user code by <a href="https://github.com/fudianchn";><code>@fudianchn</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17438";>netty/netty#17438</a></li> <li>Add regression test for close() cascade reentering flush() by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17497";>netty/netty#17497</a></li> <li>Fix UDP_GRO segment size is lost when reading with recvmmsg by <a href="https://github.com/octa-one";><code>@octa-one</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17492";>netty/netty#17492</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/netty/netty/commit/64cc10f38ea5f5bd7eae48507817c66680d0afdc";><code>64cc10f</code></a> [maven-release-plugin] prepare release netty-4.2.19.Final</li> <li><a href="https://github.com/netty/netty/commit/e863e6965c44ec4d7a84e3edfec032b0dbd0fe75";><code>e863e69</code></a> Fix io_uring domain socket fd leak on multi-fd SCM_RIGHTS messages</li> <li><a href="https://github.com/netty/netty/commit/d82c6c34d38bbfaf3600ec61a608985e5e15bfb1";><code>d82c6c3</code></a> Fix IP allow-list bypass from ruleType-blind dedup in IpSubnetFilter</li> <li><a href="https://github.com/netty/netty/commit/bccc62a8c349119dded45df67f6688c3ae5d33b0";><code>bccc62a</code></a> Bound domain-name decode buffer to avoid quadratic allocation</li> <li><a href="https://github.com/netty/netty/commit/6b02cd33b27dcf02adc31df32a59b7e4ecdf2697";><code>6b02cd3</code></a> Fix wrong nextBid computation in IoUringBufferRing for RECVSEND_BUNDLE</li> <li><a href="https://github.com/netty/netty/commit/ef3a3e1d532f97a81bce4d6f34b570153796c6da";><code>ef3a3e1</code></a> Fix sign-extension bug in SocksInitRequestDecoder NMETHODS field</li> <li><a href="https://github.com/netty/netty/commit/4cacdf08e48b36bb95af960d8adb94ce4923c1a1";><code>4cacdf0</code></a> Fix quadratic CPU usage in XmlFrameDecoder when an element is never balanced</li> <li><a href="https://github.com/netty/netty/commit/20f3aaebd87b45569f59c3af9a7ef2a2f290379b";><code>20f3aae</code></a> Fail closed on zero-length handshake records in SslClientHelloHandler</li> <li><a href="https://github.com/netty/netty/commit/c3f7088e9b4b24e65a454ff6765c6fb8f3fc5df4";><code>c3f7088</code></a> Netty OcspServerCertificateValidator still delivers buffered data from a revo...</li> <li><a href="https://github.com/netty/netty/commit/4029f071642e20ad6a290198eaca1832d183fa5e";><code>4029f07</code></a> Correctly handle multiple Content-Length</li> <li>Additional commits viewable in <a href="https://github.com/netty/netty/compare/netty-4.2.18.Final...netty-4.2.19.Final";>compare view</a></li> </ul> </details> <br /> Updates `io.netty:netty-transport` from 4.2.18.Final to 4.2.19.Final <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/netty/netty/releases";>io.netty:netty-transport's releases</a>.</em></p> <blockquote> <h2>netty-4.2.19.Final</h2> <h2>Security</h2> <p><strong>Note that <a href="https://netty.io/news/2026/09/09/4-1-EOL-announcement.html";>Netty 4.1 will be End-of-Life on July 1st, 2027</a>.</strong></p> <p>We strongly recommend upgrading to this version to get the following security fixes:</p> <ul> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-frq3-7pw6-36cg";>CVE-2026-XXXXX</a> : parser desync in <code>io.netty:netty-codec-haproxy</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-6g26-xhvx-g5w3";>CVE-2026-XXXXX</a> : improper CRLF neutralization (request/response smuggling) in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-x9f7-rg73-4rp6";>CVE-2026-XXXXX</a> : origin validation error in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-2p3h-phr9-jf38";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-http2</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-vwgc-hvc9-2j59";>CVE-2026-XXXXX</a> : request/response smuggling in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-m3w2-2657-46g8";>CVE-2026-XXXXX</a> : time-of-check/time-of-use error in <code>io.netty:netty-handler-ssl-ocsp</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-jp47-57pp-4qpp";>CVE-2026-XXXXX</a> : SNI routing bypass in <code>io.netty:netty-handler</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-35qr-v9mm-35c5";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-xml</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-5h6f-wp3f-6hmv";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-base</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-x436-m93c-g2q9";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-c7hc-m259-xhcr";>CVE-2026-XXXXX</a> : input misinterpretation in <code>io.netty:netty-codec-socks</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-268p-9r42-7qp4";>CVE-2026-XXXXX</a> : improper access control in <code>io.netty:netty-handler</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-3h79-3wcf-5whr";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-dns</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-25w5-4jgp-m94q";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-http3</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-x2j7-6j3j-5vwj";>CVE-2026-XXXXX</a> : use-after-free in <code>io.netty:netty-transport-classes-io_uring</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-79q2-mhf4-2j6j";>CVE-2026-XXXXX</a> : memory leak in <code>io.netty:netty-transport-native-io_uring</code></li> </ul> <p>Note that due to overwhelming strain on the CVE infrastructure, we have not gotten a single CVE number assigned to these reports in time for our release. The advisories will be published without.</p> <p>Specific changes worth calling out:</p> <p><strong>Validation in <code>FileUpload.setContentType</code>.</strong> Previously, the <code>FileUpload.setContentType</code> methods did not validate their inputs. They now throw an <code>IllegaalArgumentException</code> if the given string is not formatted as a plausible MIME content type.</p> <h2>What's Changed</h2> <ul> <li>perf: Use LinkedHashSet to deduplicate search domains by <a href="https://github.com/JunggiKim";><code>@JunggiKim</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17400";>netty/netty#17400</a></li> <li>Handle non-positive skip lengths in ByteBufInputStream by <a href="https://github.com/cuishuang";><code>@cuishuang</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17388";>netty/netty#17388</a></li> <li>Avoid double promise allocation in SslHandler.wrap() by <a href="https://github.com/doom369";><code>@doom369</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17382";>netty/netty#17382</a></li> <li>Socket: Add half-closure tests to SocketHalfClosedTest by <a href="https://github.com/rajan-github";><code>@rajan-github</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17394";>netty/netty#17394</a></li> <li>HttpUtil.getCharset() must accept whitespace before the next Content-Type parameter by <a href="https://github.com/hunseonglee";><code>@hunseonglee</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17386";>netty/netty#17386</a></li> <li>codec-dns: Add SMIMEA, CDS, CDNSKEY, OPENPGPKEY, CSYNC, ZONEMD records by <a href="https://github.com/hyperxpro";><code>@hyperxpro</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17373";>netty/netty#17373</a></li> <li>transport: Avoid io_uring completion callback allocation by <a href="https://github.com/massiccio";><code>@massiccio</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17457";>netty/netty#17457</a></li> <li>QUIC: Ensure writable events reflect stream capacity by <a href="https://github.com/yawkat";><code>@yawkat</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17431";>netty/netty#17431</a></li> <li>OcspServerCertificateValidatorTest: Fix possible leak in test by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17469";>netty/netty#17469</a></li> <li>Use github to download cmake and also remove tar file after unpacking by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17482";>netty/netty#17482</a></li> <li>build: Upgrade GitHub Actions to fix Node.js 20 deprecation warnings by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17484";>netty/netty#17484</a></li> <li>HttpUtil.getMimeType() must not include whitespace before the next Content-Type parameter by <a href="https://github.com/ohchanKyu";><code>@ohchanKyu</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17456";>netty/netty#17456</a></li> <li>Fix buffer leak when recvmmsg returns single UDP_GRO batch by <a href="https://github.com/octa-one";><code>@octa-one</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17493";>netty/netty#17493</a></li> <li>Guard ChunkedWriteHandler.doFlush() against re-entrant invocation from user code by <a href="https://github.com/fudianchn";><code>@fudianchn</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17438";>netty/netty#17438</a></li> <li>Add regression test for close() cascade reentering flush() by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17497";>netty/netty#17497</a></li> <li>Fix UDP_GRO segment size is lost when reading with recvmmsg by <a href="https://github.com/octa-one";><code>@octa-one</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17492";>netty/netty#17492</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/netty/netty/commit/64cc10f38ea5f5bd7eae48507817c66680d0afdc";><code>64cc10f</code></a> [maven-release-plugin] prepare release netty-4.2.19.Final</li> <li><a href="https://github.com/netty/netty/commit/e863e6965c44ec4d7a84e3edfec032b0dbd0fe75";><code>e863e69</code></a> Fix io_uring domain socket fd leak on multi-fd SCM_RIGHTS messages</li> <li><a href="https://github.com/netty/netty/commit/d82c6c34d38bbfaf3600ec61a608985e5e15bfb1";><code>d82c6c3</code></a> Fix IP allow-list bypass from ruleType-blind dedup in IpSubnetFilter</li> <li><a href="https://github.com/netty/netty/commit/bccc62a8c349119dded45df67f6688c3ae5d33b0";><code>bccc62a</code></a> Bound domain-name decode buffer to avoid quadratic allocation</li> <li><a href="https://github.com/netty/netty/commit/6b02cd33b27dcf02adc31df32a59b7e4ecdf2697";><code>6b02cd3</code></a> Fix wrong nextBid computation in IoUringBufferRing for RECVSEND_BUNDLE</li> <li><a href="https://github.com/netty/netty/commit/ef3a3e1d532f97a81bce4d6f34b570153796c6da";><code>ef3a3e1</code></a> Fix sign-extension bug in SocksInitRequestDecoder NMETHODS field</li> <li><a href="https://github.com/netty/netty/commit/4cacdf08e48b36bb95af960d8adb94ce4923c1a1";><code>4cacdf0</code></a> Fix quadratic CPU usage in XmlFrameDecoder when an element is never balanced</li> <li><a href="https://github.com/netty/netty/commit/20f3aaebd87b45569f59c3af9a7ef2a2f290379b";><code>20f3aae</code></a> Fail closed on zero-length handshake records in SslClientHelloHandler</li> <li><a href="https://github.com/netty/netty/commit/c3f7088e9b4b24e65a454ff6765c6fb8f3fc5df4";><code>c3f7088</code></a> Netty OcspServerCertificateValidator still delivers buffered data from a revo...</li> <li><a href="https://github.com/netty/netty/commit/4029f071642e20ad6a290198eaca1832d183fa5e";><code>4029f07</code></a> Correctly handle multiple Content-Length</li> <li>Additional commits viewable in <a href="https://github.com/netty/netty/compare/netty-4.2.18.Final...netty-4.2.19.Final";>compare view</a></li> </ul> </details> <br /> Updates `io.netty:netty-handler` from 4.2.18.Final to 4.2.19.Final <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/netty/netty/releases";>io.netty:netty-handler's releases</a>.</em></p> <blockquote> <h2>netty-4.2.19.Final</h2> <h2>Security</h2> <p><strong>Note that <a href="https://netty.io/news/2026/09/09/4-1-EOL-announcement.html";>Netty 4.1 will be End-of-Life on July 1st, 2027</a>.</strong></p> <p>We strongly recommend upgrading to this version to get the following security fixes:</p> <ul> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-frq3-7pw6-36cg";>CVE-2026-XXXXX</a> : parser desync in <code>io.netty:netty-codec-haproxy</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-6g26-xhvx-g5w3";>CVE-2026-XXXXX</a> : improper CRLF neutralization (request/response smuggling) in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-x9f7-rg73-4rp6";>CVE-2026-XXXXX</a> : origin validation error in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-2p3h-phr9-jf38";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-http2</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-vwgc-hvc9-2j59";>CVE-2026-XXXXX</a> : request/response smuggling in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-m3w2-2657-46g8";>CVE-2026-XXXXX</a> : time-of-check/time-of-use error in <code>io.netty:netty-handler-ssl-ocsp</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-jp47-57pp-4qpp";>CVE-2026-XXXXX</a> : SNI routing bypass in <code>io.netty:netty-handler</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-35qr-v9mm-35c5";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-xml</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-5h6f-wp3f-6hmv";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-base</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-x436-m93c-g2q9";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-c7hc-m259-xhcr";>CVE-2026-XXXXX</a> : input misinterpretation in <code>io.netty:netty-codec-socks</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-268p-9r42-7qp4";>CVE-2026-XXXXX</a> : improper access control in <code>io.netty:netty-handler</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-3h79-3wcf-5whr";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-dns</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-25w5-4jgp-m94q";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-http3</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-x2j7-6j3j-5vwj";>CVE-2026-XXXXX</a> : use-after-free in <code>io.netty:netty-transport-classes-io_uring</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-79q2-mhf4-2j6j";>CVE-2026-XXXXX</a> : memory leak in <code>io.netty:netty-transport-native-io_uring</code></li> </ul> <p>Note that due to overwhelming strain on the CVE infrastructure, we have not gotten a single CVE number assigned to these reports in time for our release. The advisories will be published without.</p> <p>Specific changes worth calling out:</p> <p><strong>Validation in <code>FileUpload.setContentType</code>.</strong> Previously, the <code>FileUpload.setContentType</code> methods did not validate their inputs. They now throw an <code>IllegaalArgumentException</code> if the given string is not formatted as a plausible MIME content type.</p> <h2>What's Changed</h2> <ul> <li>perf: Use LinkedHashSet to deduplicate search domains by <a href="https://github.com/JunggiKim";><code>@JunggiKim</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17400";>netty/netty#17400</a></li> <li>Handle non-positive skip lengths in ByteBufInputStream by <a href="https://github.com/cuishuang";><code>@cuishuang</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17388";>netty/netty#17388</a></li> <li>Avoid double promise allocation in SslHandler.wrap() by <a href="https://github.com/doom369";><code>@doom369</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17382";>netty/netty#17382</a></li> <li>Socket: Add half-closure tests to SocketHalfClosedTest by <a href="https://github.com/rajan-github";><code>@rajan-github</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17394";>netty/netty#17394</a></li> <li>HttpUtil.getCharset() must accept whitespace before the next Content-Type parameter by <a href="https://github.com/hunseonglee";><code>@hunseonglee</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17386";>netty/netty#17386</a></li> <li>codec-dns: Add SMIMEA, CDS, CDNSKEY, OPENPGPKEY, CSYNC, ZONEMD records by <a href="https://github.com/hyperxpro";><code>@hyperxpro</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17373";>netty/netty#17373</a></li> <li>transport: Avoid io_uring completion callback allocation by <a href="https://github.com/massiccio";><code>@massiccio</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17457";>netty/netty#17457</a></li> <li>QUIC: Ensure writable events reflect stream capacity by <a href="https://github.com/yawkat";><code>@yawkat</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17431";>netty/netty#17431</a></li> <li>OcspServerCertificateValidatorTest: Fix possible leak in test by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17469";>netty/netty#17469</a></li> <li>Use github to download cmake and also remove tar file after unpacking by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17482";>netty/netty#17482</a></li> <li>build: Upgrade GitHub Actions to fix Node.js 20 deprecation warnings by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17484";>netty/netty#17484</a></li> <li>HttpUtil.getMimeType() must not include whitespace before the next Content-Type parameter by <a href="https://github.com/ohchanKyu";><code>@ohchanKyu</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17456";>netty/netty#17456</a></li> <li>Fix buffer leak when recvmmsg returns single UDP_GRO batch by <a href="https://github.com/octa-one";><code>@octa-one</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17493";>netty/netty#17493</a></li> <li>Guard ChunkedWriteHandler.doFlush() against re-entrant invocation from user code by <a href="https://github.com/fudianchn";><code>@fudianchn</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17438";>netty/netty#17438</a></li> <li>Add regression test for close() cascade reentering flush() by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17497";>netty/netty#17497</a></li> <li>Fix UDP_GRO segment size is lost when reading with recvmmsg by <a href="https://github.com/octa-one";><code>@octa-one</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17492";>netty/netty#17492</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/netty/netty/commit/64cc10f38ea5f5bd7eae48507817c66680d0afdc";><code>64cc10f</code></a> [maven-release-plugin] prepare release netty-4.2.19.Final</li> <li><a href="https://github.com/netty/netty/commit/e863e6965c44ec4d7a84e3edfec032b0dbd0fe75";><code>e863e69</code></a> Fix io_uring domain socket fd leak on multi-fd SCM_RIGHTS messages</li> <li><a href="https://github.com/netty/netty/commit/d82c6c34d38bbfaf3600ec61a608985e5e15bfb1";><code>d82c6c3</code></a> Fix IP allow-list bypass from ruleType-blind dedup in IpSubnetFilter</li> <li><a href="https://github.com/netty/netty/commit/bccc62a8c349119dded45df67f6688c3ae5d33b0";><code>bccc62a</code></a> Bound domain-name decode buffer to avoid quadratic allocation</li> <li><a href="https://github.com/netty/netty/commit/6b02cd33b27dcf02adc31df32a59b7e4ecdf2697";><code>6b02cd3</code></a> Fix wrong nextBid computation in IoUringBufferRing for RECVSEND_BUNDLE</li> <li><a href="https://github.com/netty/netty/commit/ef3a3e1d532f97a81bce4d6f34b570153796c6da";><code>ef3a3e1</code></a> Fix sign-extension bug in SocksInitRequestDecoder NMETHODS field</li> <li><a href="https://github.com/netty/netty/commit/4cacdf08e48b36bb95af960d8adb94ce4923c1a1";><code>4cacdf0</code></a> Fix quadratic CPU usage in XmlFrameDecoder when an element is never balanced</li> <li><a href="https://github.com/netty/netty/commit/20f3aaebd87b45569f59c3af9a7ef2a2f290379b";><code>20f3aae</code></a> Fail closed on zero-length handshake records in SslClientHelloHandler</li> <li><a href="https://github.com/netty/netty/commit/c3f7088e9b4b24e65a454ff6765c6fb8f3fc5df4";><code>c3f7088</code></a> Netty OcspServerCertificateValidator still delivers buffered data from a revo...</li> <li><a href="https://github.com/netty/netty/commit/4029f071642e20ad6a290198eaca1832d183fa5e";><code>4029f07</code></a> Correctly handle multiple Content-Length</li> <li>Additional commits viewable in <a href="https://github.com/netty/netty/compare/netty-4.2.18.Final...netty-4.2.19.Final";>compare view</a></li> </ul> </details> <br /> Updates `io.netty:netty-codec` from 4.2.18.Final to 4.2.19.Final <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/netty/netty/releases";>io.netty:netty-codec's releases</a>.</em></p> <blockquote> <h2>netty-4.2.19.Final</h2> <h2>Security</h2> <p><strong>Note that <a href="https://netty.io/news/2026/09/09/4-1-EOL-announcement.html";>Netty 4.1 will be End-of-Life on July 1st, 2027</a>.</strong></p> <p>We strongly recommend upgrading to this version to get the following security fixes:</p> <ul> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-frq3-7pw6-36cg";>CVE-2026-XXXXX</a> : parser desync in <code>io.netty:netty-codec-haproxy</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-6g26-xhvx-g5w3";>CVE-2026-XXXXX</a> : improper CRLF neutralization (request/response smuggling) in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-x9f7-rg73-4rp6";>CVE-2026-XXXXX</a> : origin validation error in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-2p3h-phr9-jf38";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-http2</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-vwgc-hvc9-2j59";>CVE-2026-XXXXX</a> : request/response smuggling in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-m3w2-2657-46g8";>CVE-2026-XXXXX</a> : time-of-check/time-of-use error in <code>io.netty:netty-handler-ssl-ocsp</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-jp47-57pp-4qpp";>CVE-2026-XXXXX</a> : SNI routing bypass in <code>io.netty:netty-handler</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-35qr-v9mm-35c5";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-xml</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-5h6f-wp3f-6hmv";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-base</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-x436-m93c-g2q9";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-c7hc-m259-xhcr";>CVE-2026-XXXXX</a> : input misinterpretation in <code>io.netty:netty-codec-socks</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-268p-9r42-7qp4";>CVE-2026-XXXXX</a> : improper access control in <code>io.netty:netty-handler</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-3h79-3wcf-5whr";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-dns</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-25w5-4jgp-m94q";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-http3</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-x2j7-6j3j-5vwj";>CVE-2026-XXXXX</a> : use-after-free in <code>io.netty:netty-transport-classes-io_uring</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-79q2-mhf4... _Description has been truncated_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
