dongjoon-hyun opened a new pull request, #60166: URL: https://github.com/apache/spark/pull/60166
### What changes were proposed in this pull request? This PR aims to upgrade Netty from 4.2.19.Final to 4.2.20.Final. - `pom.xml`: bump `netty.version` to `4.2.20.Final` - `dev/deps/spark-deps-hadoop-3-hive-2.3`: update the Netty jar entries accordingly `netty-tcnative` is left unchanged at 2.0.84.Final. ### Why are the changes needed? To bring in the latest bug and security fixes of the 4.2.x line. Netty 4.2.20.Final includes fixes for multiple security advisories, for example out-of-bounds reads in `netty-buffer`, unbounded memory usage in `netty-codec-http2`, insufficient control character neutralization in `netty-codec-http`, and insufficient entropy in `netty-resolver-dns`, along with many other bug fixes. - Release notes: https://github.com/netty/netty/releases/tag/netty-4.2.20.Final (released on 2026-11-02) - Full changelog: https://github.com/netty/netty/compare/netty-4.2.19.Final...netty-4.2.20.Final ### Does this PR introduce _any_ user-facing change? No behavior change is expected. This is a dependency patch upgrade, but users who bundle or rely on the Netty version shipped with Spark will see 4.2.20.Final. ### How was this patch tested? Pass the CIs. In addition, verified locally that `build/sbt network-common/compile` succeeds with the new version. ### Was this patch authored or co-authored using generative AI tooling? Generated-by: Claude Sonnet 5.5 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
