dependabot[bot] opened a new pull request, #19810: URL: https://github.com/apache/pinot/pull/19810
Bumps [io.netty:netty-bom](https://github.com/netty/netty) from 4.1.138.Final to 4.1.139.Final. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/netty/netty/releases";>io.netty:netty-bom's releases</a>.</em></p> <blockquote> <h2>netty-4.1.139.Final</h2> <h2>Security</h2> <p><strong>Note that <a href="https://netty.io/news/2026/09/09/4-1-EOL-announcement.html";>Netty 4.1 will be End-of-Life on July 1st, 2027</a>.</strong></p> <p>We strongly recommend upgrading to this version to get the following security fixes:</p> <ul> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-frq3-7pw6-36cg";>CVE-2026-XXXXX</a> : parser desync in <code>io.netty:netty-codec-haproxy</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-6g26-xhvx-g5w3";>CVE-2026-XXXXX</a> : improper CRLF neutralization (request/response smuggling) in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-x9f7-rg73-4rp6";>CVE-2026-XXXXX</a> : origin validation error in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-2p3h-phr9-jf38";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-http2</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-vwgc-hvc9-2j59";>CVE-2026-XXXXX</a> : request/response smuggling in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-m3w2-2657-46g8";>CVE-2026-XXXXX</a> : time-of-check/time-of-use error in <code>io.netty:netty-handler-ssl-ocsp</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-jp47-57pp-4qpp";>CVE-2026-XXXXX</a> : SNI routing bypass in <code>io.netty:netty-handler</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-35qr-v9mm-35c5";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-xml</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-5h6f-wp3f-6hmv";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-base</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-x436-m93c-g2q9";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-c7hc-m259-xhcr";>CVE-2026-XXXXX</a> : input misinterpretation in <code>io.netty:netty-codec-socks</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-268p-9r42-7qp4";>CVE-2026-XXXXX</a> : improper access control in <code>io.netty:netty-handler</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-3h79-3wcf-5whr";>CVE-2026-XXXXX</a> : unbounded resource consumption in <code>io.netty:netty-codec-dns</code></li> </ul> <p>Note that due to overwhelming strain on the CVE infrastructure, we have not gotten a single CVE number assigned to these reports in time for our release. The advisories will be published without.</p> <p>Specific changes worth calling out:</p> <p><strong>Validation in <code>FileUpload.setContentType</code>.</strong> Previously, the <code>FileUpload.setContentType</code> methods did not validate their inputs. They now throw an <code>IllegaalArgumentException</code> if the given string is not formatted as a plausible MIME content type.</p> <h2>What's Changed</h2> <ul> <li>Auto-port 4.1: perf: Use LinkedHashSet to deduplicate search domains by <a href="https://github.com/netty-project-bot";><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17407";>netty/netty#17407</a></li> <li>Auto-port 4.1: Handle non-positive skip lengths in ByteBufInputStream by <a href="https://github.com/netty-project-bot";><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17410";>netty/netty#17410</a></li> <li>Protobuf: Update protobuf-javanano to non alpha release (<a href="https://redirect.github.com/netty/netty/issues/17330";>#17330</a>) by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17335";>netty/netty#17335</a></li> <li>Socket: Add half-closure tests to SocketHalfClosedTest (<a href="https://redirect.github.com/netty/netty/issues/17394";>#17394</a>) by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17434";>netty/netty#17434</a></li> <li>Auto-port 4.1: HttpUtil.getCharset() must accept whitespace before the next Content-Type parameter by <a href="https://github.com/netty-project-bot";><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17436";>netty/netty#17436</a></li> <li>Auto-port 4.1: codec-dns: Add SMIMEA, CDS, CDNSKEY, OPENPGPKEY, CSYNC, ZONEMD records by <a href="https://github.com/netty-project-bot";><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17459";>netty/netty#17459</a></li> <li>Update GitHub Actions to Node.js 24 to fix deprecation warning by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17488";>netty/netty#17488</a></li> <li>Remove not used tools from docker image by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17490";>netty/netty#17490</a></li> <li>Auto-port 4.1: HttpUtil.getMimeType() must not include whitespace before the next Content-Type parameter by <a href="https://github.com/netty-project-bot";><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17494";>netty/netty#17494</a></li> <li>Auto-port 4.1: Fix buffer leak when recvmmsg returns single UDP_GRO batch by <a href="https://github.com/netty-project-bot";><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17500";>netty/netty#17500</a></li> <li>Auto-port 4.1: Guard ChunkedWriteHandler.doFlush() against re-entrant invocation from user code by <a href="https://github.com/netty-project-bot";><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17501";>netty/netty#17501</a></li> <li>Auto-port 4.1: Add regression test for close() cascade reentering flush() by <a href="https://github.com/netty-project-bot";><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17505";>netty/netty#17505</a></li> <li>Port: Fix UDP_GRO segment size is lost when reading with recvmmsg (<a href="https://redirect.github.com/netty/netty/issues/17492";>#17492</a>) by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17506";>netty/netty#17506</a></li> <li>Auto-port 4.1: Make CompositeBufferGatheringWriteTest robust against write/close race by <a href="https://github.com/netty-project-bot";><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17510";>netty/netty#17510</a></li> <li>Auto-port 4.1: Add workflow that will cancel running workflows for merged PRs by <a href="https://github.com/netty-project-bot";><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17519";>netty/netty#17519</a></li> <li>Auto-port 4.1: Harden DnsNameResolverTest against transient null localAddress from TestDnsServer by <a href="https://github.com/netty-project-bot";><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17522";>netty/netty#17522</a></li> <li>Cache docker build images in ghcr.io to speed up CI for 4.1 by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17533";>netty/netty#17533</a></li> <li>Auto-port 4.1: HTTP/2: Remove failed SETTINGS from ACK queue by <a href="https://github.com/netty-project-bot";><code>@netty-project-bot</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17534";>netty/netty#17534</a></li> <li>Port: Fix compilation on latest macOS 27.0 (<a href="https://redirect.github.com/netty/netty/issues/17529";>#17529</a>) by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17542";>netty/netty#17542</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/netty/netty/commit/7bc0414acbb21f752dd615c386821f58e722c5f5";><code>7bc0414</code></a> [maven-release-plugin] prepare release netty-4.1.139.Final</li> <li><a href="https://github.com/netty/netty/commit/da8f17b8a61466a5ea98bea744e80541fd86e491";><code>da8f17b</code></a> Fix IP allow-list bypass from ruleType-blind dedup in IpSubnetFilter</li> <li><a href="https://github.com/netty/netty/commit/2dd4c04775a0c5ede96294f825afccc57354ac96";><code>2dd4c04</code></a> Bound domain-name decode buffer to avoid quadratic allocation</li> <li><a href="https://github.com/netty/netty/commit/85ef3da53ba419b534bd9e1c7810066ffe823eda";><code>85ef3da</code></a> Fix sign-extension bug in SocksInitRequestDecoder NMETHODS field</li> <li><a href="https://github.com/netty/netty/commit/0770efbc000affd9dff894bfc32d4a3deace33a9";><code>0770efb</code></a> Fix quadratic CPU usage in XmlFrameDecoder when an element is never balanced</li> <li><a href="https://github.com/netty/netty/commit/3c1cf73f7bab61916971498b717dad12c220ea0a";><code>3c1cf73</code></a> Fail closed on zero-length handshake records in SslClientHelloHandler</li> <li><a href="https://github.com/netty/netty/commit/cdfe56fce966dc482ab9871641a41d1f987bec2b";><code>cdfe56f</code></a> Netty OcspServerCertificateValidator still delivers buffered data from a revo...</li> <li><a href="https://github.com/netty/netty/commit/d2839db10ad2b2a5813320726ccec9b12b21ec38";><code>d2839db</code></a> Correctly handle multiple Content-Length</li> <li><a href="https://github.com/netty/netty/commit/131cf478fa2242dcf8fde8adfcf222aa119e0d14";><code>131cf47</code></a> HTTP/2: Limit buffered memory for table size changes</li> <li><a href="https://github.com/netty/netty/commit/cc7afc476637236ffda6a1582524347b4dea50f1";><code>cc7afc4</code></a> CorsHandler omits Vary: Origin for the null-origin branch, unlike every other...</li> <li>Additional commits viewable in <a href="https://github.com/netty/netty/compare/netty-4.1.138.Final...netty-4.1.139.Final";>compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | io.netty:netty-bom | [>= 4.2.a0, < 4.3] | </details> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
