dependabot[bot] opened a new pull request, #950: URL: https://github.com/apache/mina-sshd/pull/950
Bumps [io.netty:netty-bom](https://github.com/netty/netty) from 4.2.10.Final to 4.2.20.Final. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/netty/netty/releases";>io.netty:netty-bom's releases</a>.</em></p> <blockquote> <h2>netty-4.2.20.Final</h2> <h2>Security Fixes</h2> <ul> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-m77g-r4c7-3w77";>https://github.com/netty/netty/security/advisories/GHSA-m77g-r4c7-3w77</a> - out-of-bounds read in <code>netty-buffer</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-v2v6-vch9-4pcg";>https://github.com/netty/netty/security/advisories/GHSA-v2v6-vch9-4pcg</a> - inefficient CPU computation in <code>netty-codec-http3</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-rx4g-qxm6-238r";>https://github.com/netty/netty/security/advisories/GHSA-rx4g-qxm6-238r</a> - out-of-bounds read in <code>netty-buffer</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-cqmg-wc9g-fpj8";>https://github.com/netty/netty/security/advisories/GHSA-cqmg-wc9g-fpj8</a> - insufficient entropy in <code>netty-resolver-dns</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-hc9x-r52h-gh4x";>https://github.com/netty/netty/security/advisories/GHSA-hc9x-r52h-gh4x</a> - unbounded memory usage in <code>netty-codec-http2</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-42mp-m8rq-6rgj";>https://github.com/netty/netty/security/advisories/GHSA-42mp-m8rq-6rgj</a> - insufficient control character neutralization in <code>netty-codec-http</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-w53r-xhgx-8582";>https://github.com/netty/netty/security/advisories/GHSA-w53r-xhgx-8582</a> - use-after-free in <code>netty-codec-classes-quic</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-qhw9-p586-v948";>https://github.com/netty/netty/security/advisories/GHSA-qhw9-p586-v948</a> - out-of-bounds read in <code>netty-buffer</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-84gx-4cj4-rm7q";>https://github.com/netty/netty/security/advisories/GHSA-84gx-4cj4-rm7q</a> - unbounded memory usage in <code>netty-codec-mqtt</code></li> <li><a href="https://github.com/netty/netty/security/advisories/GHSA-6xv6-9mgg-mfvc";>https://github.com/netty/netty/security/advisories/GHSA-6xv6-9mgg-mfvc</a> - mTLS auth bypass via session resumption in <code>netty-handler</code> and <code>netty-codec-quic</code></li> </ul> <h2>What's Changed</h2> <ul> <li>IoUring: Fix empty writev submissions after sendmsg_zc by <a href="https://github.com/dreamlike-ocean";><code>@dreamlike-ocean</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17782";>netty/netty#17782</a></li> <li>Do not let a negatively cached search domain shadow a positive one by <a href="https://github.com/akilegaspi";><code>@akilegaspi</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17623";>netty/netty#17623</a></li> <li>Fix musl verify job by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17801";>netty/netty#17801</a></li> <li>Reject Redis lines that start with LF by <a href="https://github.com/yawkat";><code>@yawkat</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17793";>netty/netty#17793</a></li> <li>Choose server key types from client's signature algorithms for TLS 1.3 by <a href="https://github.com/eager-signal";><code>@eager-signal</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17764";>netty/netty#17764</a></li> <li>Port 4.2: LocalChannel: Deliver data written by the peer before it closed (<a href="https://redirect.github.com/netty/netty/issues/17814";>#17814</a>) by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17816";>netty/netty#17816</a></li> <li>Validate padding of HEADERS frames without priority by <a href="https://github.com/bryce-anderson";><code>@bryce-anderson</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17817";>netty/netty#17817</a></li> <li>Don't spin in SslHandler.wrapMultiple(...) when the engine consumes nothing by <a href="https://github.com/allthingssecurity";><code>@allthingssecurity</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17728";>netty/netty#17728</a></li> <li>Preserve invalid SNI names in <code>ReferenceCountedOpenSslEngine</code> by <a href="https://github.com/gavinbunney";><code>@gavinbunney</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17781";>netty/netty#17781</a></li> <li>Optimize redundant bounds checking in ByteBuf.setBytes by <a href="https://github.com/vpelikh";><code>@vpelikh</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17023";>netty/netty#17023</a></li> <li>Respect SETTINGS_QPACK_BLOCKED_STREAMS for unacknowledged QPACK entries by <a href="https://github.com/allthingssecurity";><code>@allthingssecurity</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17754";>netty/netty#17754</a></li> <li>Release the DNS response when a query future loses a cancel race by <a href="https://github.com/watson-ryan";><code>@watson-ryan</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17475";>netty/netty#17475</a></li> <li>Lazily instantiate VarHandle JCTools queues via holder class by <a href="https://github.com/arnabnandy7";><code>@arnabnandy7</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17750";>netty/netty#17750</a></li> <li>Keep reading a closed QUIC stream until the end of its input by <a href="https://github.com/allthingssecurity";><code>@allthingssecurity</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17755";>netty/netty#17755</a></li> <li>Throw UnsupportedOperationException from AdaptiveByteBuf.memoryAddress() without an address by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17820";>netty/netty#17820</a></li> <li>HAProxyMessage: validate the length of all TLV types by <a href="https://github.com/yawkat";><code>@yawkat</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17834";>netty/netty#17834</a></li> <li>Fix HpackDynamicTable losing entries when filled to capacity by <a href="https://github.com/yawkat";><code>@yawkat</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17831";>netty/netty#17831</a></li> <li>Make AdaptiveByteBuf.memoryAddress() faster by <a href="https://github.com/lhotari";><code>@lhotari</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17767";>netty/netty#17767</a></li> <li>Validate bzip2 Huffman code lengths before building decode tables by <a href="https://github.com/Raghuvardhan-Reddy78";><code>@Raghuvardhan-Reddy78</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17812";>netty/netty#17812</a></li> <li>Validate header values on DefaultHeaders.copy(), bulk add, entry setValue and ReadOnlyHttpHeaders by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17841";>netty/netty#17841</a></li> <li>Throw DecompressionException on JdkZlib preset dictionary mismatch by <a href="https://github.com/yawkat";><code>@yawkat</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17838";>netty/netty#17838</a></li> <li>Reject HTTP version numbers that overflow int by <a href="https://github.com/yawkat";><code>@yawkat</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17836";>netty/netty#17836</a></li> <li>Apply certificate list size floor by <a href="https://github.com/arnabnandy7";><code>@arnabnandy7</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17674";>netty/netty#17674</a></li> <li>HAProxyMessageEncoder: encode v1 PROXY UNKNOWN headers by <a href="https://github.com/yawkat";><code>@yawkat</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17837";>netty/netty#17837</a></li> <li>HAProxyMessage: decode TLVs with an empty value at the end of the header by <a href="https://github.com/yawkat";><code>@yawkat</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17835";>netty/netty#17835</a></li> <li>Reject invalid content-length in PUSH_PROMISE with a stream error by <a href="https://github.com/yawkat";><code>@yawkat</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17867";>netty/netty#17867</a></li> <li>Honor maxAllocation for brotli in DelegatingDecompressorFrameListener by <a href="https://github.com/yawkat";><code>@yawkat</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17866";>netty/netty#17866</a></li> <li>HAProxyMessageDecoder: fix v2 header framing with a non-zero reader index by <a href="https://github.com/yawkat";><code>@yawkat</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17832";>netty/netty#17832</a></li> <li>IpSubnetFilter: Add tests for overlapping rules by <a href="https://github.com/Raghuvardhan-Reddy78";><code>@Raghuvardhan-Reddy78</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17765";>netty/netty#17765</a></li> <li>Avoid allocating NIO buffer views in AdaptiveByteBuf.setBytes(int, ByteBuf, int, int) by <a href="https://github.com/lhotari";><code>@lhotari</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17840";>netty/netty#17840</a></li> <li>Skip JNDI nameserver lookup on IBM i by <a href="https://github.com/manish-9245";><code>@manish-9245</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17872";>netty/netty#17872</a></li> <li>Reset the h2c upgrade stream if the request can not be converted by <a href="https://github.com/yawkat";><code>@yawkat</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17869";>netty/netty#17869</a></li> <li>Don't size ZstdDecoder output buffers from the frame content size by <a href="https://github.com/Raghuvardhan-Reddy78";><code>@Raghuvardhan-Reddy78</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17896";>netty/netty#17896</a></li> <li>Fix NPE in Http2FrameCodec when h2c upgrade fails by <a href="https://github.com/yawkat";><code>@yawkat</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17871";>netty/netty#17871</a></li> <li>Allow adaptive allocator magazine cleanup in BlockHound by <a href="https://github.com/cj848";><code>@cj848</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17849";>netty/netty#17849</a></li> <li>GroupsConverter: fix the x25519mlkem768 group name by <a href="https://github.com/normanmaurer";><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17898";>netty/netty#17898</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/netty/netty/commit/4fb6a5f308382b4bee1bff3ef80b45ea8b35166d";><code>4fb6a5f</code></a> [maven-release-plugin] prepare release netty-4.2.20.Final</li> <li><a href="https://github.com/netty/netty/commit/3da0f5a9ee1fc0da0db9666d181f4b8ec79b0b5b";><code>3da0f5a</code></a> Reject all control characters and DEL in HTTP request line tokens</li> <li><a href="https://github.com/netty/netty/commit/464cfd75ef948fb7c28d929630c4b6d670847cdd";><code>464cfd7</code></a> TLS/QUIC: Scope session resumption via a derived session_id_context</li> <li><a href="https://github.com/netty/netty/commit/b85fb0adfaef547c76f2a2d956b54bd3984b33b1";><code>b85fb0a</code></a> Don't preallocate the SUBACK and UNSUBACK reason code lists from the remainin...</li> <li><a href="https://github.com/netty/netty/commit/c2196f906d9b0e3f40f4eb4a5cb0326d5c22cb7d";><code>c2196f9</code></a> Check the index before every numeric accessor on Unpooled buffers</li> <li><a href="https://github.com/netty/netty/commit/dbf089b5acf01261c1f59fe03d1de59ecf4f0d36";><code>dbf089b</code></a> Fix use-after-free when QuicheQuicConnection.free() races an offloaded SSL task</li> <li><a href="https://github.com/netty/netty/commit/52ce8c5ee0f1fcfc1ae6e0b3fd0013d361e9fcd8";><code>52ce8c5</code></a> Bound outstandingRemoteSettingsQueue to prevent unbounded heap growth</li> <li><a href="https://github.com/netty/netty/commit/d576bd90d21f5cc317a51da134ea70e35a132b5b";><code>d576bd9</code></a> Add 0x20 case randomization and DNS cookie support to DnsNameResolver</li> <li><a href="https://github.com/netty/netty/commit/fb4736fee4067f01307dc01bbf0d6220120c9c74";><code>fb4736f</code></a> Check bounds in ByteBuf string accessors</li> <li><a href="https://github.com/netty/netty/commit/debfda5ec768a3c3b2f5a98a0cc886399111f9c0";><code>debfda5</code></a> QPACK: Don't decode the name of Insert With Literal Name again for every valu...</li> <li>Additional commits viewable in <a href="https://github.com/netty/netty/compare/netty-4.2.10.Final...netty-4.2.20.Final";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
