dependabot[bot] opened a new pull request, #11285: URL: https://github.com/apache/ozone/pull/11285
Bumps [io.netty:netty-bom](https://github.com/netty/netty) from 4.1.137.Final to 4.1.138.Final. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/netty/netty/releases";>io.netty:netty-bom's releases</a>.</em></p> <blockquote> <h2>netty-4.1.138.Final</h2> <h2>Security fixes</h2> <ul> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-rmcw-9fcq-wjq7";>CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code> (SPDY)</li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-pvjx-v7vp-62vq";>CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-8352-h356-c9qh";>CVE-2026-XXXXX</a> : denial of service vector in <code>io.netty:netty-codec-http2</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-jj3c-mwvr-9g52";>CVE-2026-XXXXX</a> : improper certificate validation in <code>io.netty:netty-handler-ssl-ocsp</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-ghg5-c4jg-8q5j";>CVE-2026-XXXXX</a> : memory leak in <code>io.netty:netty-codec-stomp</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc";>CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-hmf3-49g9-g7qq";>CVE-2026-XXXXX</a> : denial of service vector in <code>io.netty:netty-codec-stomp</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-wxrh-4rgq-pjcg";>CVE-2026-XXXXX</a> : parser desync/response smuggling in <code>io.netty:netty-codec-memcache</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c";>CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-pq4x-537v-r54q";>CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-smtp</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-j58c-g352-8h4p";>CVE-2026-XXXXX</a> : memory leak in <code>io.netty:netty-codec-haproxy</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-h75q-xqrh-59rf";>CVE-2026-XXXXX</a> : request smuggling in <code>io.netty:netty-codec-http</code> (RTSP)</li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-rq4j-fc47-9698";>CVE-2026-XXXXX</a> : request smuggling in <code>io.netty:netty-codec-http</code> (HTTP/1)</li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg";>CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f";>CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m";>CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-r4xx-7fpg-j8xg";>CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-redis</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-3jrc-fchc-59pw";>CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-j4mg-hqgv-34qc";>CVE-2026-XXXXX</a> : request smuggling vector in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-jqf3-r9ww-c5x8";>CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-mqtt</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-5vh9-c45f-rf7p";>CVE-2026-XXXXX</a> : improper CRLF neutralization in <code>io.netty:netty-codec-smtp</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-jhjp-5q4f-8wr2";>CVE-2026-XXXXX</a> : improper certificate validation in <code>io.netty:netty-handler-ssl-ocsp</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-8whp-c7w8-2m72";>CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li> </ul> <h2>Compatibility note</h2> <p><strong>HTTP/2 header <em>value</em> validation is now enabled by default.</strong> HTTP/2 header <em>name</em> validation has always been enabled by default, with an option to disable it, but HTTP/2 header <em>value</em> validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.</p> <h2>What's Changed</h2> <ul> <li>Auto-port 4.1: Use X509ExtendedTrustManager in SSLErrorTest by <a href="https://github.com/netty-project-bot";><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17224";>netty/netty#17224</a></li> <li>Auto-port 4.1: Validate chunked-must-be-last regardless of HTTP version by <a href="https://github.com/netty-project-bot";><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17228";>netty/netty#17228</a></li> <li>Update junit version by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17233";>netty/netty#17233</a></li> <li>Auto-port 4.1: Add system property to disable RFC 6761 localhost resolution by <a href="https://github.com/netty-project-bot";><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17230";>netty/netty#17230</a></li> <li>Update setup-testlens to v1.9.4 (<a href="https://redirect.github.com/netty/netty/issues/17223";>#17223</a>) by <a href="https://github.com/chrisvest";><code>@chrisvest</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17229";>netty/netty#17229</a></li> <li>Auto-port 4.1: Adjust failsafe plugin version to be in sync with surefire plugin by <a href="https://github.com/netty-project-bot";><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17241";>netty/netty#17241</a></li> <li>Auto-port 4.1: Release unsent LastHttpContent in HttpChunkedInput by <a href="https://github.com/netty-project-bot";><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17251";>netty/netty#17251</a></li> <li>Auto-port 4.1: HTTP/2: Release compressors after failed headers writes by <a href="https://github.com/netty-project-bot";><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17265";>netty/netty#17265</a></li> <li>Auto-port 4.1: HTTP/2: Prevent reentrant flush on writability change by <a href="https://github.com/netty-project-bot";><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17268";>netty/netty#17268</a></li> <li>Respect max messages per read in LocalServerChannel (<a href="https://redirect.github.com/netty/netty/issues/17255";>#17255</a>) by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17269";>netty/netty#17269</a></li> <li>Auto-port 4.1: HTTP: Preserve encoder state after header encoding failures by <a href="https://github.com/netty-project-bot";><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17275";>netty/netty#17275</a></li> <li>Bzip2: Correctly detect overflow during block size bound check (<a href="https://redirect.github.com/netty/netty/issues/17261";>#17261</a>) by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17273";>netty/netty#17273</a></li> <li>Auto-port 4.1: HTTP/2: Drain queued frames stranded by a writability change during flush by <a href="https://github.com/netty-project-bot";><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17280";>netty/netty#17280</a></li> <li>Port to 4.1: Add clock skew tolerance to OcspServerCertificateValidator by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17282";>netty/netty#17282</a></li> <li>Extract Bootstrap and ServerBootstrap setup to a common method (<a href="https://redirect.github.com/netty/netty/issues/15134";>#15134</a>) by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17289";>netty/netty#17289</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/netty/netty/commit/26e68a2c3935e459b374891c87760f6d6c5e2550";><code>26e68a2</code></a> [maven-release-plugin] prepare release netty-4.1.138.Final</li> <li><a href="https://github.com/netty/netty/commit/9099e6bd54bb15e29fbbc7a644a2c53628decda9";><code>9099e6b</code></a> OCSP: Correctly handle that <code>nextUpdate</code> is optional</li> <li><a href="https://github.com/netty/netty/commit/46f4ab0322d36caa6aab0d636d1278f979e64d10";><code>46f4ab0</code></a> Verify id-kp-OCSPSigning EKU on delegated OCSP responder certificates</li> <li><a href="https://github.com/netty/netty/commit/ab3f6df8350cc5fa7613b1d2e8a2c647eee24d26";><code>ab3f6df</code></a> SPDY: SpdySessionHandler must limit the concurrent streams</li> <li><a href="https://github.com/netty/netty/commit/36ee6443300b698e7af7f66c38195a17a47d127e";><code>36ee644</code></a> HTTP: Limit the maximum number of concurrent pipelined requests</li> <li><a href="https://github.com/netty/netty/commit/d9cf57d5efd8ab1bd0fbdfe6dbbe1797d4155718";><code>d9cf57d</code></a> HTTP/2: Limit HPACK encoding table size</li> <li><a href="https://github.com/netty/netty/commit/cb84b06388fda7e1514a4d17ce25fe99ccbb7b32";><code>cb84b06</code></a> STOMP: Correctly release partial content on handler removal</li> <li><a href="https://github.com/netty/netty/commit/3574f7ed7a59492443a091b32d11955df6be0841";><code>3574f7e</code></a> WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...</li> <li><a href="https://github.com/netty/netty/commit/9551ac48fd1c3c98d3a13d2f6f0a8d418c02460a";><code>9551ac4</code></a> STOMP codec content-length long-to-int truncation causes infinite decode loop...</li> <li><a href="https://github.com/netty/netty/commit/d5bc02802df8863e6c3ce68308a204b4f14dde67";><code>d5bc028</code></a> Fix frame desynchronization in the binary memcache decoder</li> <li>Additional commits viewable in <a href="https://github.com/netty/netty/compare/netty-4.1.137.Final...netty-4.1.138.Final";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
