This is an automated email from the ASF dual-hosted git repository. Cole-Greer pushed a commit to branch 3.7-dependencies in repository https://gitbox.apache.org/repos/asf/tinkerpop.git
commit 8cfcb736acec59d0f9966767cb31aed7cd96b069 Author: Cole Greer <[email protected]> AuthorDate: Wed Jul 29 11:40:23 2026 -0700 Bump Netty to 4.1.136.Final Upgrades netty.version to 4.1.136.Final to pick up numerous security fixes accumulated since 4.1.125.Final (HTTP request smuggling, DoS, XXE, and other CVEs). Bumps bouncycastle.version 1.69 -> 1.70 to stay aligned with the bcpkix-jdk15on version Netty itself pins for optional SelfSignedCertificate support. Fixes HttpHandlerUtilTest, which used a placeholder URI containing a space ("some uri"). Netty's hardened HttpUtil.validateRequestLineTokens now rejects such URIs; updated the fixture to a valid URI ("/some-uri") since the tests exercise serializer/deserializer behavior, not URI parsing. Updates NOTICE files in gremlin-console, gremlin-driver, and gremlin-server to reflect the new Netty version. Assisted-by: Kiro:claude-sonnet-5 [code] [execute_bash] [fs_write] --- CHANGELOG.asciidoc | 1 + gremlin-console/src/main/static/NOTICE | 2 +- gremlin-driver/src/main/static/NOTICE | 2 +- gremlin-server/src/main/static/NOTICE | 2 +- .../tinkerpop/gremlin/server/handler/HttpHandlerUtilTest.java | 6 +++--- pom.xml | 4 ++-- 6 files changed, 9 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc index 37f9e7e4c5..b1824b0b80 100644 --- a/CHANGELOG.asciidoc +++ b/CHANGELOG.asciidoc @@ -35,6 +35,7 @@ image::https://raw.githubusercontent.com/apache/tinkerpop/master/docs/static/ima * Fixed `hasId()` to only unroll a collection when it is supplied as the single argument, aligning its behavior with `g.V()`/`g.E()`. * Allowed float literals without a leading digit (e.g. `.5`, `.5f`, `.5d`) in the Gremlin grammar to better match Groovy. * Fixed conjoin has incorrect null handling. +* Bump Netty to 4.1.136. * Removed the Mono dependency from the `gremlin-dotnet` build/release process, using `dotnet pack`/`dotnet nuget push` instead of `mono nuget.exe`. * Expanded `gremlin-python` CI matrix to test against Python 3.9, 3.10, 3.11, 3.12, and 3.13. * Add Node 26 support for `gremlin-javascript` and `gremlint`. diff --git a/gremlin-console/src/main/static/NOTICE b/gremlin-console/src/main/static/NOTICE index 2be233e054..3e2a2b66e1 100644 --- a/gremlin-console/src/main/static/NOTICE +++ b/gremlin-console/src/main/static/NOTICE @@ -86,7 +86,7 @@ JavaTuples 1.2 Copyright (c) 2010, The JAVATUPLES team (http://www.javatuples.org) ------------------------------------------------------------------------ -Netty 4.1.125.Final +Netty 4.1.136.Final ------------------------------------------------------------------------ Copyright 2014 The Netty Project diff --git a/gremlin-driver/src/main/static/NOTICE b/gremlin-driver/src/main/static/NOTICE index a5c48466be..81c56e1758 100644 --- a/gremlin-driver/src/main/static/NOTICE +++ b/gremlin-driver/src/main/static/NOTICE @@ -49,7 +49,7 @@ JavaTuples 1.2 Copyright (c) 2010, The JAVATUPLES team (http://www.javatuples.org) ------------------------------------------------------------------------ -Netty 4.1.125.Final +Netty 4.1.136.Final ------------------------------------------------------------------------ Copyright 2014 The Netty Project diff --git a/gremlin-server/src/main/static/NOTICE b/gremlin-server/src/main/static/NOTICE index 80f72cbbaf..5209d71d80 100644 --- a/gremlin-server/src/main/static/NOTICE +++ b/gremlin-server/src/main/static/NOTICE @@ -87,7 +87,7 @@ LongAdder), which was released with the following comments: http://creativecommons.org/publicdomain/zero/1.0/ ------------------------------------------------------------------------ -Netty 4.1.125.Final +Netty 4.1.136.Final ------------------------------------------------------------------------ Copyright 2014 The Netty Project diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/handler/HttpHandlerUtilTest.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/handler/HttpHandlerUtilTest.java index c67988c9b5..8ef5b05e6b 100644 --- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/handler/HttpHandlerUtilTest.java +++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/handler/HttpHandlerUtilTest.java @@ -69,7 +69,7 @@ public class HttpHandlerUtilTest { final HttpHeaders headers = new DefaultHttpHeaders(); headers.add(HttpHeaderNames.CONTENT_TYPE, SerTokens.MIME_GRAPHBINARY_V1); - final FullHttpRequest httpRequest = new DefaultFullHttpRequest(HttpVersion.HTTP_1_1, HttpMethod.POST, "some uri", + final FullHttpRequest httpRequest = new DefaultFullHttpRequest(HttpVersion.HTTP_1_1, HttpMethod.POST, "some-uri", buffer, headers, new DefaultHttpHeaders()); final Map<String, MessageSerializer<?>> serializers = new HashMap<>(); @@ -96,7 +96,7 @@ public class HttpHandlerUtilTest { final HttpHeaders headers = new DefaultHttpHeaders(); headers.add(HttpHeaderNames.CONTENT_TYPE, SerTokens.MIME_GRAPHBINARY_V1); - final FullHttpRequest httpRequest = new DefaultFullHttpRequest(HttpVersion.HTTP_1_1, HttpMethod.POST, "some uri", + final FullHttpRequest httpRequest = new DefaultFullHttpRequest(HttpVersion.HTTP_1_1, HttpMethod.POST, "some-uri", buffer, headers, new DefaultHttpHeaders()); final Map<String, MessageSerializer<?>> serializers = new HashMap<>(); @@ -119,7 +119,7 @@ public class HttpHandlerUtilTest { final HttpHeaders headers = new DefaultHttpHeaders(); headers.add(HttpHeaderNames.CONTENT_TYPE, SerTokens.MIME_JSON); - final FullHttpRequest httpRequest = new DefaultFullHttpRequest(HttpVersion.HTTP_1_1, HttpMethod.POST, "some uri", + final FullHttpRequest httpRequest = new DefaultFullHttpRequest(HttpVersion.HTTP_1_1, HttpMethod.POST, "some-uri", buffer, headers, new DefaultHttpHeaders()); final Map<String, MessageSerializer<?>> serializers = new HashMap<>(); diff --git a/pom.xml b/pom.xml index 6e33f515f0..434cfcd2aa 100644 --- a/pom.xml +++ b/pom.xml @@ -174,12 +174,12 @@ limitations under the License. <logback.version>1.2.13</logback.version> <metrics.version>3.0.2</metrics.version> <mockito.version>3.10.0</mockito.version> - <netty.version>4.1.125.Final</netty.version> + <netty.version>4.1.136.Final</netty.version> <slf4j.version>1.7.25</slf4j.version> <snakeyaml.version>2.0</snakeyaml.version> <spark.version>3.3.2</spark.version> <!-- Version aligned with Netty's optional bcpkix dependency used for SelfSignedCertificate --> - <bouncycastle.version>1.69</bouncycastle.version> + <bouncycastle.version>1.70</bouncycastle.version> <ayza.version>10.0.0</ayza.version> <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
