This is an automated email from the ASF dual-hosted git repository. lhotari pushed a commit to branch branch-4.0 in repository https://gitbox.apache.org/repos/asf/pulsar.git
commit b8efeffb7156c5cce23cc499bdca7345a488f450 Author: Lari Hotari <[email protected]> AuthorDate: Tue May 5 12:14:39 2026 +0300 [fix][sec] Upgrade Netty to 4.1.133.Final to address CVEs (#25670) (cherry picked from commit a6a4678ebf19a9af6b6161e9cd54304a3901373c) --- buildtools/pom.xml | 2 +- distribution/server/src/assemble/LICENSE.bin.txt | 54 ++++++++++++------------ distribution/shell/src/assemble/LICENSE.bin.txt | 52 +++++++++++------------ pom.xml | 2 +- 4 files changed, 55 insertions(+), 55 deletions(-) diff --git a/buildtools/pom.xml b/buildtools/pom.xml index 8616e904c26..18d1061574f 100644 --- a/buildtools/pom.xml +++ b/buildtools/pom.xml @@ -55,7 +55,7 @@ <license-maven-plugin.version>4.1</license-maven-plugin.version> <puppycrawl.checkstyle.version>10.14.2</puppycrawl.checkstyle.version> <maven-checkstyle-plugin.version>3.1.2</maven-checkstyle-plugin.version> - <netty.version>4.1.132.Final</netty.version> + <netty.version>4.1.133.Final</netty.version> <guice.version>4.2.3</guice.version> <guava.version>32.1.2-jre</guava.version> <ant.version>1.10.12</ant.version> diff --git a/distribution/server/src/assemble/LICENSE.bin.txt b/distribution/server/src/assemble/LICENSE.bin.txt index 591cb3fedfa..a667a9d724e 100644 --- a/distribution/server/src/assemble/LICENSE.bin.txt +++ b/distribution/server/src/assemble/LICENSE.bin.txt @@ -293,33 +293,33 @@ The Apache Software License, Version 2.0 - org.apache.commons-commons-lang3-3.19.0.jar - org.apache.commons-commons-text-1.14.0.jar * Netty - - io.netty-netty-buffer-4.1.132.Final.jar - - io.netty-netty-codec-4.1.132.Final.jar - - io.netty-netty-codec-dns-4.1.132.Final.jar - - io.netty-netty-codec-http-4.1.132.Final.jar - - io.netty-netty-codec-http2-4.1.132.Final.jar - - io.netty-netty-codec-socks-4.1.132.Final.jar - - io.netty-netty-codec-haproxy-4.1.132.Final.jar - - io.netty-netty-common-4.1.132.Final.jar - - io.netty-netty-handler-4.1.132.Final.jar - - io.netty-netty-handler-proxy-4.1.132.Final.jar - - io.netty-netty-resolver-4.1.132.Final.jar - - io.netty-netty-resolver-dns-4.1.132.Final.jar - - io.netty-netty-resolver-dns-classes-macos-4.1.132.Final.jar - - io.netty-netty-resolver-dns-native-macos-4.1.132.Final-osx-aarch_64.jar - - io.netty-netty-resolver-dns-native-macos-4.1.132.Final-osx-x86_64.jar - - io.netty-netty-transport-4.1.132.Final.jar - - io.netty-netty-transport-classes-epoll-4.1.132.Final.jar - - io.netty-netty-transport-native-epoll-4.1.132.Final-linux-aarch_64.jar - - io.netty-netty-transport-native-epoll-4.1.132.Final-linux-x86_64.jar - - io.netty-netty-transport-native-unix-common-4.1.132.Final.jar - - io.netty-netty-tcnative-boringssl-static-2.0.75.Final.jar - - io.netty-netty-tcnative-boringssl-static-2.0.75.Final-linux-aarch_64.jar - - io.netty-netty-tcnative-boringssl-static-2.0.75.Final-linux-x86_64.jar - - io.netty-netty-tcnative-boringssl-static-2.0.75.Final-osx-aarch_64.jar - - io.netty-netty-tcnative-boringssl-static-2.0.75.Final-osx-x86_64.jar - - io.netty-netty-tcnative-boringssl-static-2.0.75.Final-windows-x86_64.jar - - io.netty-netty-tcnative-classes-2.0.75.Final.jar + - io.netty-netty-buffer-4.1.133.Final.jar + - io.netty-netty-codec-4.1.133.Final.jar + - io.netty-netty-codec-dns-4.1.133.Final.jar + - io.netty-netty-codec-http-4.1.133.Final.jar + - io.netty-netty-codec-http2-4.1.133.Final.jar + - io.netty-netty-codec-socks-4.1.133.Final.jar + - io.netty-netty-codec-haproxy-4.1.133.Final.jar + - io.netty-netty-common-4.1.133.Final.jar + - io.netty-netty-handler-4.1.133.Final.jar + - io.netty-netty-handler-proxy-4.1.133.Final.jar + - io.netty-netty-resolver-4.1.133.Final.jar + - io.netty-netty-resolver-dns-4.1.133.Final.jar + - io.netty-netty-resolver-dns-classes-macos-4.1.133.Final.jar + - io.netty-netty-resolver-dns-native-macos-4.1.133.Final-osx-aarch_64.jar + - io.netty-netty-resolver-dns-native-macos-4.1.133.Final-osx-x86_64.jar + - io.netty-netty-transport-4.1.133.Final.jar + - io.netty-netty-transport-classes-epoll-4.1.133.Final.jar + - io.netty-netty-transport-native-epoll-4.1.133.Final-linux-aarch_64.jar + - io.netty-netty-transport-native-epoll-4.1.133.Final-linux-x86_64.jar + - io.netty-netty-transport-native-unix-common-4.1.133.Final.jar + - io.netty-netty-tcnative-boringssl-static-2.0.77.Final.jar + - io.netty-netty-tcnative-boringssl-static-2.0.77.Final-linux-aarch_64.jar + - io.netty-netty-tcnative-boringssl-static-2.0.77.Final-linux-x86_64.jar + - io.netty-netty-tcnative-boringssl-static-2.0.77.Final-osx-aarch_64.jar + - io.netty-netty-tcnative-boringssl-static-2.0.77.Final-osx-x86_64.jar + - io.netty-netty-tcnative-boringssl-static-2.0.77.Final-windows-x86_64.jar + - io.netty-netty-tcnative-classes-2.0.77.Final.jar - io.netty.incubator-netty-incubator-transport-classes-io_uring-0.0.26.Final.jar - io.netty.incubator-netty-incubator-transport-native-io_uring-0.0.26.Final-linux-x86_64.jar - io.netty.incubator-netty-incubator-transport-native-io_uring-0.0.26.Final-linux-aarch_64.jar diff --git a/distribution/shell/src/assemble/LICENSE.bin.txt b/distribution/shell/src/assemble/LICENSE.bin.txt index dde0a75897a..4f8b843e241 100644 --- a/distribution/shell/src/assemble/LICENSE.bin.txt +++ b/distribution/shell/src/assemble/LICENSE.bin.txt @@ -345,35 +345,35 @@ The Apache Software License, Version 2.0 - commons-text-1.14.0.jar - commons-compress-1.28.0.jar * Netty - - netty-buffer-4.1.132.Final.jar - - netty-codec-4.1.132.Final.jar - - netty-codec-dns-4.1.132.Final.jar - - netty-codec-http-4.1.132.Final.jar - - netty-codec-socks-4.1.132.Final.jar - - netty-codec-haproxy-4.1.132.Final.jar - - netty-common-4.1.132.Final.jar - - netty-handler-4.1.132.Final.jar - - netty-handler-proxy-4.1.132.Final.jar - - netty-resolver-4.1.132.Final.jar - - netty-resolver-dns-4.1.132.Final.jar - - netty-transport-4.1.132.Final.jar - - netty-transport-classes-epoll-4.1.132.Final.jar - - netty-transport-native-epoll-4.1.132.Final-linux-aarch_64.jar - - netty-transport-native-epoll-4.1.132.Final-linux-x86_64.jar - - netty-transport-native-unix-common-4.1.132.Final.jar - - netty-tcnative-boringssl-static-2.0.75.Final.jar - - netty-tcnative-boringssl-static-2.0.75.Final-linux-aarch_64.jar - - netty-tcnative-boringssl-static-2.0.75.Final-linux-x86_64.jar - - netty-tcnative-boringssl-static-2.0.75.Final-osx-aarch_64.jar - - netty-tcnative-boringssl-static-2.0.75.Final-osx-x86_64.jar - - netty-tcnative-boringssl-static-2.0.75.Final-windows-x86_64.jar - - netty-tcnative-classes-2.0.75.Final.jar + - netty-buffer-4.1.133.Final.jar + - netty-codec-4.1.133.Final.jar + - netty-codec-dns-4.1.133.Final.jar + - netty-codec-http-4.1.133.Final.jar + - netty-codec-socks-4.1.133.Final.jar + - netty-codec-haproxy-4.1.133.Final.jar + - netty-common-4.1.133.Final.jar + - netty-handler-4.1.133.Final.jar + - netty-handler-proxy-4.1.133.Final.jar + - netty-resolver-4.1.133.Final.jar + - netty-resolver-dns-4.1.133.Final.jar + - netty-transport-4.1.133.Final.jar + - netty-transport-classes-epoll-4.1.133.Final.jar + - netty-transport-native-epoll-4.1.133.Final-linux-aarch_64.jar + - netty-transport-native-epoll-4.1.133.Final-linux-x86_64.jar + - netty-transport-native-unix-common-4.1.133.Final.jar + - netty-tcnative-boringssl-static-2.0.77.Final.jar + - netty-tcnative-boringssl-static-2.0.77.Final-linux-aarch_64.jar + - netty-tcnative-boringssl-static-2.0.77.Final-linux-x86_64.jar + - netty-tcnative-boringssl-static-2.0.77.Final-osx-aarch_64.jar + - netty-tcnative-boringssl-static-2.0.77.Final-osx-x86_64.jar + - netty-tcnative-boringssl-static-2.0.77.Final-windows-x86_64.jar + - netty-tcnative-classes-2.0.77.Final.jar - netty-incubator-transport-classes-io_uring-0.0.26.Final.jar - netty-incubator-transport-native-io_uring-0.0.26.Final-linux-aarch_64.jar - netty-incubator-transport-native-io_uring-0.0.26.Final-linux-x86_64.jar - - netty-resolver-dns-classes-macos-4.1.132.Final.jar - - netty-resolver-dns-native-macos-4.1.132.Final-osx-aarch_64.jar - - netty-resolver-dns-native-macos-4.1.132.Final-osx-x86_64.jar + - netty-resolver-dns-classes-macos-4.1.133.Final.jar + - netty-resolver-dns-native-macos-4.1.133.Final-osx-aarch_64.jar + - netty-resolver-dns-native-macos-4.1.133.Final-osx-x86_64.jar * Prometheus client - simpleclient-0.16.0.jar - simpleclient_log4j2-0.16.0.jar diff --git a/pom.xml b/pom.xml index bbd1df06573..71e54046add 100644 --- a/pom.xml +++ b/pom.xml @@ -184,7 +184,7 @@ flexible messaging model and an intuitive client API.</description> <snappy.version>1.1.10.8</snappy.version> <!-- ZooKeeper server --> <dropwizardmetrics.version>4.1.12.1</dropwizardmetrics.version> <!-- ZooKeeper server --> <curator.version>5.7.1</curator.version> - <netty.version>4.1.132.Final</netty.version> + <netty.version>4.1.133.Final</netty.version> <netty-iouring.version>0.0.26.Final</netty-iouring.version> <jetty.version>12.1.8</jetty.version> <!-- Jetty 9 is used in tiered-storage/file-system tests and pulsar-io/alluxio -->
