Bump Netty to 4.1.133.Final and update trivyignore (#1374)

*Issue #, if available:* #1372

*Description of changes:*
Bump netty to 4.1.133.Final to fix CVE-2026-41417. This CVE is low-risk
for end-users as no attacker-controlled input reaches `setUri()`.

Updated trivyignore to keep workflows unblocked until the next ADOT Java
release (in ~2 weeks).

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license.

Author: ezhang6811

.github/trivy/daily-scan.trivyignore.yaml

@@ -11,9 +11,6 @@
 #    expired_at: <required - YYYY-MM-DD>
 
 vulnerabilities:
-  - id: CVE-2026-33870
-    statement: "Netty HTTP/1.1 Request Smuggling. Fix: bump netty-bom to 4.1.132.Final. https://github.com/aws-observability/aws-otel-java-instrumentation/issues/1346"
-    expired_at: 2026-04-28
-  - id: CVE-2026-33871
-    statement: "Netty HTTP/2 CONTINUATION frame flood DoS. Fix: bump netty-bom to 4.1.132.Final. https://github.com/aws-observability/aws-otel-java-instrumentation/issues/1346"
-    expired_at: 2026-04-28
+  - id: CVE-2026-41417
+    statement: "Netty request-line validation bypass via setUri() enables CRLF injection/request smuggling. Low risk for ADOT Java agent (URIs are operator-configured, no attacker-controlled input reaches setUri()). Fix: bump netty-bom to 4.1.133.Final. https://nvd.nist.gov/vuln/detail/CVE-2026-41417"
+    expired_at: 2026-05-22

.github/trivy/pr-build.trivyignore.yaml

@@ -9,9 +9,6 @@
 #    expired_at: <required - YYYY-MM-DD>
 
 vulnerabilities:
-  - id: CVE-2026-33870
-    statement: "Netty HTTP/1.1 Request Smuggling. Fix: bump netty-bom to 4.1.132.Final. https://github.com/aws-observability/aws-otel-java-instrumentation/issues/1346"
-    expired_at: 2026-04-28
-  - id: CVE-2026-33871
-    statement: "Netty HTTP/2 CONTINUATION frame flood DoS. Fix: bump netty-bom to 4.1.132.Final. https://github.com/aws-observability/aws-otel-java-instrumentation/issues/1346"
-    expired_at: 2026-04-28
+  - id: CVE-2026-41417
+    statement: "Netty request-line validation bypass via setUri() enables CRLF injection/request smuggling. Low risk for ADOT Java agent (URIs are operator-configured, no attacker-controlled input reaches setUri()). Fix: bump netty-bom to 4.1.133.Final. https://nvd.nist.gov/vuln/detail/CVE-2026-41417"
+    expired_at: 2026-05-22

CHANGELOG.md

@@ -13,6 +13,8 @@ If your change does not need a CHANGELOG entry, add the "skip changelog" label t
 
 ## Unreleased
 
+- Bump Netty to 4.1.133.Final to fix CVE-2026-41417
+  ([#1374](https://github.com/aws-observability/aws-otel-java-instrumentation/pull/1374))
 - Support environment-configured endpoint visibility for HTTP operation names
   ([#1352](https://github.com/aws-observability/aws-otel-java-instrumentation/pull/1352))
 - Bump Netty to 4.1.132.Final to fix CVE-2026-33870 and CVE-2026-33871

dependencyManagement/build.gradle.kts

@@ -40,10 +40,8 @@ val dependencyBoms = listOf(
   "com.google.protobuf:protobuf-bom:3.25.1",
   "com.linecorp.armeria:armeria-bom:1.26.4",
   "io.grpc:grpc-bom:1.59.1",
-  // netty-bom pins to fix CVE-2026-33870 and CVE-2026-33871.
-  // Remove once https://github.com/aws/aws-sdk-java-v2/pull/6635 is released and
-  // AWS SDK for Java (v1) is upgraded to 1.12.796 at least.
-  "io.netty:netty-bom:4.1.132.Final",
+  // netty-bom pins to fix CVE-2026-41417
+  "io.netty:netty-bom:4.1.133.Final",
   "io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha:$otelAlphaVersion",
   "org.apache.logging.log4j:log4j-bom:2.21.1",
   "org.junit:junit-bom:5.10.1",