Bump the netty group across 1 directory with 10 updates by dependabot[bot] · Pull Request #6941 · aws/aws-sdk-java-v2

dependabot · 2026-05-06T18:29:01Z

Bumps the netty group with 10 updates in the / directory:

Package	From	To
io.netty:netty-handler	`4.1.133.Final`	`4.2.13.Final`
io.netty:netty-transport	`4.1.133.Final`	`4.2.13.Final`
io.netty:netty-codec-http	`4.1.133.Final`	`4.2.13.Final`
io.netty:netty-codec-http2	`4.1.133.Final`	`4.2.13.Final`
io.netty:netty-codec	`4.1.133.Final`	`4.2.13.Final`
io.netty:netty-common	`4.1.133.Final`	`4.2.13.Final`
io.netty:netty-buffer	`4.1.133.Final`	`4.2.13.Final`
io.netty:netty-resolver	`4.1.133.Final`	`4.2.13.Final`
io.netty:netty-resolver-dns	`4.1.133.Final`	`4.2.13.Final`
io.netty:netty-transport-classes-epoll	`4.1.133.Final`	`4.2.13.Final`

Updates io.netty:netty-handler from 4.1.133.Final to 4.2.13.Final

Release notes

Sourced from io.netty:netty-handler's releases.

netty-4.2.13.Final

CVEs Fixed

CVE-2026-42586 (netty-codec-redis)

CVE-2026-42578 (netty-handler-proxy)

CVE-2026-42577 (netty-transport-native-epoll)

CVE-2026-42587 (netty-codec-http, netty-codec-http2)

CVE-2026-41417 (netty-codec-http)

CVE-2026-42581 (netty-codec-http)

CVE-2026-42580 (netty-codec-http)

CVE-2026-42585 (netty-codec-http)

CVE-2026-42579 (netty-codec-dns)

CVE-2026-42582 (netty-codec-http3)

CVE-2026-42583 (netty-codec, netty-codec-compression)

CVE-2026-42584 (netty-codec-http)

CVE-2026-44248 (netty-codec-mqtt)

What's Changed

Kqueue: sendfile EINTR doesn't advance offset — data duplication by @normanmaurer in netty/netty#16544

Replace usage of strerror with thread-safe alternative by @normanmaurer in netty/netty#16547

Fix implementation of strerror_r_xsi for GNU by @normanmaurer in netty/netty#16546

Lazy init ArrayList in DefaultHeaders.getAll by @doom369 in netty/netty#16526

Less logging in AWS-LC build by @chrisvest in netty/netty#16565

Ensure the CRYPTO_BUFFER_POOL is also freed when we fail creating the SSLContext by @normanmaurer in netty/netty#16545

Auto-port 4.2: Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by @netty-project-bot in netty/netty#16543

Avoid leak in PemReader on OutOfDirectMemoryError by @raipc in netty/netty#16551

IoUring: Disable test while we debug to unblock other builds by @normanmaurer in netty/netty#16581

Include user properties and subscription IDs in MqttProperties#isEmpty by @ShadowySpirits in netty/netty#16575

Native DNS resolver: Guard against malloc failures by @normanmaurer in netty/netty#16559

Auto-port 4.2: Increase timeouts for QuicChannelConnectTest by @netty-project-bot in netty/netty#16578

Fix parsing HTTP chunks with multiple extensions by @chrisvest in netty/netty#16579

Bump org.codehaus.plexus:plexus-utils from 3.4.2 to 4.0.3 in /codec-native-quic by @dependabot[bot] in netty/netty#16572

Revert to PR build to Ubuntu 22.04 by @chrisvest in netty/netty#16595

Native transports: Correctly create pipe when pipe2 is not supported by @normanmaurer in netty/netty#16592

Epoll: Cleanup code to always return negative value on failure by @normanmaurer in netty/netty#16591

Fix component search fast path by @yawkat in netty/netty#16548

Stabilize read-only toStringMultipleThreads1 by @chrisvest in netty/netty#16608

Stabilize more AbstractByteBufTests by @chrisvest in netty/netty#16611

Remove note about needing 256-bit for PQC by @chrisvest in netty/netty#16605

Stabilize testSessionInvalidate for Conscrypt by @chrisvest in netty/netty#16615

Quic: Correctly handle SSL_CTX_new failures by @normanmaurer in netty/netty#16622

Make LocalIoHandle public by @rdicroce in netty/netty#16621

Quic: Fix shadowing of variable which leads to incorrectly handling errors by @normanmaurer in netty/netty#16623

Auto-port 4.2: Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by @netty-project-bot in netty/netty#16629

Fix shutdownInput bug in kqueue for empty recv buffer by @chrisvest in netty/netty#16630

fix FFM address semantics in directBufferAddress by @dreamlike-ocean in netty/netty#16603

HTTP2: Ensure HTTP2 preface is always send as first message by @normanmaurer in netty/netty#16636

Move Http2FrameCodecSubClassTest to correct package by @normanmaurer in netty/netty#16640

Kqueue: Fix usage of LOCAL_PEERPID by @normanmaurer in netty/netty#16637

Avoid ArrayQueue allocation in HttpServerCodec by @doom369 in netty/netty#16596

Fix file descriptor reuse bug in kqueue by @chrisvest in netty/netty#16650

... (truncated)

Commits

b3844c8 [maven-release-plugin] prepare release netty-4.2.13.Final
82f47fa Merge commit from fork
ada0999 Merge commit from fork
b4051e2 Fix BrotliDecoder not forwarding all decompressed chunks
67207c1 Merge commit from fork
541ca7c Merge commit from fork
943edb3 Fix codec-dns tests
6459a28 Merge commit from fork
b4ba61b Fix checkstyle in HttpObjectDecoder
977661f Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-transport from 4.1.133.Final to 4.2.13.Final

Release notes

Sourced from io.netty:netty-transport's releases.

netty-4.2.13.Final

CVEs Fixed

CVE-2026-42586 (netty-codec-redis)

CVE-2026-42578 (netty-handler-proxy)

CVE-2026-42577 (netty-transport-native-epoll)

CVE-2026-42587 (netty-codec-http, netty-codec-http2)

CVE-2026-41417 (netty-codec-http)

CVE-2026-42581 (netty-codec-http)

CVE-2026-42580 (netty-codec-http)

CVE-2026-42585 (netty-codec-http)

CVE-2026-42579 (netty-codec-dns)

CVE-2026-42582 (netty-codec-http3)

CVE-2026-42583 (netty-codec, netty-codec-compression)

CVE-2026-42584 (netty-codec-http)

CVE-2026-44248 (netty-codec-mqtt)

What's Changed

Kqueue: sendfile EINTR doesn't advance offset — data duplication by @normanmaurer in netty/netty#16544

Replace usage of strerror with thread-safe alternative by @normanmaurer in netty/netty#16547

Fix implementation of strerror_r_xsi for GNU by @normanmaurer in netty/netty#16546

Lazy init ArrayList in DefaultHeaders.getAll by @doom369 in netty/netty#16526

Less logging in AWS-LC build by @chrisvest in netty/netty#16565

Ensure the CRYPTO_BUFFER_POOL is also freed when we fail creating the SSLContext by @normanmaurer in netty/netty#16545

Auto-port 4.2: Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by @netty-project-bot in netty/netty#16543

Avoid leak in PemReader on OutOfDirectMemoryError by @raipc in netty/netty#16551

IoUring: Disable test while we debug to unblock other builds by @normanmaurer in netty/netty#16581

Include user properties and subscription IDs in MqttProperties#isEmpty by @ShadowySpirits in netty/netty#16575

Native DNS resolver: Guard against malloc failures by @normanmaurer in netty/netty#16559

Auto-port 4.2: Increase timeouts for QuicChannelConnectTest by @netty-project-bot in netty/netty#16578

Fix parsing HTTP chunks with multiple extensions by @chrisvest in netty/netty#16579

Bump org.codehaus.plexus:plexus-utils from 3.4.2 to 4.0.3 in /codec-native-quic by @dependabot[bot] in netty/netty#16572

Revert to PR build to Ubuntu 22.04 by @chrisvest in netty/netty#16595

Native transports: Correctly create pipe when pipe2 is not supported by @normanmaurer in netty/netty#16592

Epoll: Cleanup code to always return negative value on failure by @normanmaurer in netty/netty#16591

Fix component search fast path by @yawkat in netty/netty#16548

Stabilize read-only toStringMultipleThreads1 by @chrisvest in netty/netty#16608

Stabilize more AbstractByteBufTests by @chrisvest in netty/netty#16611

Remove note about needing 256-bit for PQC by @chrisvest in netty/netty#16605

Stabilize testSessionInvalidate for Conscrypt by @chrisvest in netty/netty#16615

Quic: Correctly handle SSL_CTX_new failures by @normanmaurer in netty/netty#16622

Make LocalIoHandle public by @rdicroce in netty/netty#16621

Quic: Fix shadowing of variable which leads to incorrectly handling errors by @normanmaurer in netty/netty#16623

Auto-port 4.2: Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by @netty-project-bot in netty/netty#16629

Fix shutdownInput bug in kqueue for empty recv buffer by @chrisvest in netty/netty#16630

fix FFM address semantics in directBufferAddress by @dreamlike-ocean in netty/netty#16603

HTTP2: Ensure HTTP2 preface is always send as first message by @normanmaurer in netty/netty#16636

Move Http2FrameCodecSubClassTest to correct package by @normanmaurer in netty/netty#16640

Kqueue: Fix usage of LOCAL_PEERPID by @normanmaurer in netty/netty#16637

Avoid ArrayQueue allocation in HttpServerCodec by @doom369 in netty/netty#16596

Fix file descriptor reuse bug in kqueue by @chrisvest in netty/netty#16650

... (truncated)

Commits

b3844c8 [maven-release-plugin] prepare release netty-4.2.13.Final
82f47fa Merge commit from fork
ada0999 Merge commit from fork
b4051e2 Fix BrotliDecoder not forwarding all decompressed chunks
67207c1 Merge commit from fork
541ca7c Merge commit from fork
943edb3 Fix codec-dns tests
6459a28 Merge commit from fork
b4ba61b Fix checkstyle in HttpObjectDecoder
977661f Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-codec-http from 4.1.133.Final to 4.2.13.Final

Release notes

Sourced from io.netty:netty-codec-http's releases.

netty-4.2.13.Final

CVEs Fixed

CVE-2026-42586 (netty-codec-redis)

CVE-2026-42578 (netty-handler-proxy)

CVE-2026-42577 (netty-transport-native-epoll)

CVE-2026-42587 (netty-codec-http, netty-codec-http2)

CVE-2026-41417 (netty-codec-http)

CVE-2026-42581 (netty-codec-http)

CVE-2026-42580 (netty-codec-http)

CVE-2026-42585 (netty-codec-http)

CVE-2026-42579 (netty-codec-dns)

CVE-2026-42582 (netty-codec-http3)

CVE-2026-42583 (netty-codec, netty-codec-compression)

CVE-2026-42584 (netty-codec-http)

CVE-2026-44248 (netty-codec-mqtt)

What's Changed

Kqueue: sendfile EINTR doesn't advance offset — data duplication by @normanmaurer in netty/netty#16544

Replace usage of strerror with thread-safe alternative by @normanmaurer in netty/netty#16547

Fix implementation of strerror_r_xsi for GNU by @normanmaurer in netty/netty#16546

Lazy init ArrayList in DefaultHeaders.getAll by @doom369 in netty/netty#16526

Less logging in AWS-LC build by @chrisvest in netty/netty#16565

Ensure the CRYPTO_BUFFER_POOL is also freed when we fail creating the SSLContext by @normanmaurer in netty/netty#16545

Auto-port 4.2: Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by @netty-project-bot in netty/netty#16543

Avoid leak in PemReader on OutOfDirectMemoryError by @raipc in netty/netty#16551

IoUring: Disable test while we debug to unblock other builds by @normanmaurer in netty/netty#16581

Include user properties and subscription IDs in MqttProperties#isEmpty by @ShadowySpirits in netty/netty#16575

Native DNS resolver: Guard against malloc failures by @normanmaurer in netty/netty#16559

Auto-port 4.2: Increase timeouts for QuicChannelConnectTest by @netty-project-bot in netty/netty#16578

Fix parsing HTTP chunks with multiple extensions by @chrisvest in netty/netty#16579

Bump org.codehaus.plexus:plexus-utils from 3.4.2 to 4.0.3 in /codec-native-quic by @dependabot[bot] in netty/netty#16572

Revert to PR build to Ubuntu 22.04 by @chrisvest in netty/netty#16595

Native transports: Correctly create pipe when pipe2 is not supported by @normanmaurer in netty/netty#16592

Epoll: Cleanup code to always return negative value on failure by @normanmaurer in netty/netty#16591

Fix component search fast path by @yawkat in netty/netty#16548

Stabilize read-only toStringMultipleThreads1 by @chrisvest in netty/netty#16608

Stabilize more AbstractByteBufTests by @chrisvest in netty/netty#16611

Remove note about needing 256-bit for PQC by @chrisvest in netty/netty#16605

Stabilize testSessionInvalidate for Conscrypt by @chrisvest in netty/netty#16615

Quic: Correctly handle SSL_CTX_new failures by @normanmaurer in netty/netty#16622

Make LocalIoHandle public by @rdicroce in netty/netty#16621

Quic: Fix shadowing of variable which leads to incorrectly handling errors by @normanmaurer in netty/netty#16623

Auto-port 4.2: Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by @netty-project-bot in netty/netty#16629

Fix shutdownInput bug in kqueue for empty recv buffer by @chrisvest in netty/netty#16630

fix FFM address semantics in directBufferAddress by @dreamlike-ocean in netty/netty#16603

HTTP2: Ensure HTTP2 preface is always send as first message by @normanmaurer in netty/netty#16636

Move Http2FrameCodecSubClassTest to correct package by @normanmaurer in netty/netty#16640

Kqueue: Fix usage of LOCAL_PEERPID by @normanmaurer in netty/netty#16637

Avoid ArrayQueue allocation in HttpServerCodec by @doom369 in netty/netty#16596

Fix file descriptor reuse bug in kqueue by @chrisvest in netty/netty#16650

... (truncated)

Commits

b3844c8 [maven-release-plugin] prepare release netty-4.2.13.Final
82f47fa Merge commit from fork
ada0999 Merge commit from fork
b4051e2 Fix BrotliDecoder not forwarding all decompressed chunks
67207c1 Merge commit from fork
541ca7c Merge commit from fork
943edb3 Fix codec-dns tests
6459a28 Merge commit from fork
b4ba61b Fix checkstyle in HttpObjectDecoder
977661f Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-codec-http2 from 4.1.133.Final to 4.2.13.Final

Release notes

Sourced from io.netty:netty-codec-http2's releases.

netty-4.2.13.Final

CVEs Fixed

CVE-2026-42586 (netty-codec-redis)

CVE-2026-42578 (netty-handler-proxy)

CVE-2026-42577 (netty-transport-native-epoll)

CVE-2026-42587 (netty-codec-http, netty-codec-http2)

CVE-2026-41417 (netty-codec-http)

CVE-2026-42581 (netty-codec-http)

CVE-2026-42580 (netty-codec-http)

CVE-2026-42585 (netty-codec-http)

CVE-2026-42579 (netty-codec-dns)

CVE-2026-42582 (netty-codec-http3)

CVE-2026-42583 (netty-codec, netty-codec-compression)

CVE-2026-42584 (netty-codec-http)

CVE-2026-44248 (netty-codec-mqtt)

What's Changed

Kqueue: sendfile EINTR doesn't advance offset — data duplication by @normanmaurer in netty/netty#16544

Replace usage of strerror with thread-safe alternative by @normanmaurer in netty/netty#16547

Fix implementation of strerror_r_xsi for GNU by @normanmaurer in netty/netty#16546

Lazy init ArrayList in DefaultHeaders.getAll by @doom369 in netty/netty#16526

Less logging in AWS-LC build by @chrisvest in netty/netty#16565

Ensure the CRYPTO_BUFFER_POOL is also freed when we fail creating the SSLContext by @normanmaurer in netty/netty#16545

Auto-port 4.2: Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by @netty-project-bot in netty/netty#16543

Avoid leak in PemReader on OutOfDirectMemoryError by @raipc in netty/netty#16551

IoUring: Disable test while we debug to unblock other builds by @normanmaurer in netty/netty#16581

Include user properties and subscription IDs in MqttProperties#isEmpty by @ShadowySpirits in netty/netty#16575

Native DNS resolver: Guard against malloc failures by @normanmaurer in netty/netty#16559

Auto-port 4.2: Increase timeouts for QuicChannelConnectTest by @netty-project-bot in netty/netty#16578

Fix parsing HTTP chunks with multiple extensions by @chrisvest in netty/netty#16579

Bump org.codehaus.plexus:plexus-utils from 3.4.2 to 4.0.3 in /codec-native-quic by @dependabot[bot] in netty/netty#16572

Revert to PR build to Ubuntu 22.04 by @chrisvest in netty/netty#16595

Native transports: Correctly create pipe when pipe2 is not supported by @normanmaurer in netty/netty#16592

Epoll: Cleanup code to always return negative value on failure by @normanmaurer in netty/netty#16591

Fix component search fast path by @yawkat in netty/netty#16548

Stabilize read-only toStringMultipleThreads1 by @chrisvest in netty/netty#16608

Stabilize more AbstractByteBufTests by @chrisvest in netty/netty#16611

Remove note about needing 256-bit for PQC by @chrisvest in netty/netty#16605

Stabilize testSessionInvalidate for Conscrypt by @chrisvest in netty/netty#16615

Quic: Correctly handle SSL_CTX_new failures by @normanmaurer in netty/netty#16622

Make LocalIoHandle public by @rdicroce in netty/netty#16621

Quic: Fix shadowing of variable which leads to incorrectly handling errors by @normanmaurer in netty/netty#16623

Auto-port 4.2: Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by @netty-project-bot in netty/netty#16629

Fix shutdownInput bug in kqueue for empty recv buffer by @chrisvest in netty/netty#16630

fix FFM address semantics in directBufferAddress by @dreamlike-ocean in netty/netty#16603

HTTP2: Ensure HTTP2 preface is always send as first message by @normanmaurer in netty/netty#16636

Move Http2FrameCodecSubClassTest to correct package by @normanmaurer in netty/netty#16640

Kqueue: Fix usage of LOCAL_PEERPID by @normanmaurer in netty/netty#16637

Avoid ArrayQueue allocation in HttpServerCodec by @doom369 in netty/netty#16596

Fix file descriptor reuse bug in kqueue by @chrisvest in netty/netty#16650

... (truncated)

Commits

b3844c8 [maven-release-plugin] prepare release netty-4.2.13.Final
82f47fa Merge commit from fork
ada0999 Merge commit from fork
b4051e2 Fix BrotliDecoder not forwarding all decompressed chunks
67207c1 Merge commit from fork
541ca7c Merge commit from fork
943edb3 Fix codec-dns tests
6459a28 Merge commit from fork
b4ba61b Fix checkstyle in HttpObjectDecoder
977661f Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-codec from 4.1.133.Final to 4.2.13.Final

Release notes

Sourced from io.netty:netty-codec's releases.

netty-4.2.13.Final

CVEs Fixed

CVE-2026-42586 (netty-codec-redis)

CVE-2026-42578 (netty-handler-proxy)

CVE-2026-42577 (netty-transport-native-epoll)

CVE-2026-42587 (netty-codec-http, netty-codec-http2)

CVE-2026-41417 (netty-codec-http)

CVE-2026-42581 (netty-codec-http)

CVE-2026-42580 (netty-codec-http)

CVE-2026-42585 (netty-codec-http)

CVE-2026-42579 (netty-codec-dns)

CVE-2026-42582 (netty-codec-http3)

CVE-2026-42583 (netty-codec, netty-codec-compression)

CVE-2026-42584 (netty-codec-http)

CVE-2026-44248 (netty-codec-mqtt)

What's Changed

Kqueue: sendfile EINTR doesn't advance offset — data duplication by @normanmaurer in netty/netty#16544

Replace usage of strerror with thread-safe alternative by @normanmaurer in netty/netty#16547

Fix implementation of strerror_r_xsi for GNU by @normanmaurer in netty/netty#16546

Lazy init ArrayList in DefaultHeaders.getAll by @doom369 in netty/netty#16526

Less logging in AWS-LC build by @chrisvest in netty/netty#16565

Ensure the CRYPTO_BUFFER_POOL is also freed when we fail creating the SSLContext by @normanmaurer in netty/netty#16545

Auto-port 4.2: Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by @netty-project-bot in netty/netty#16543

Avoid leak in PemReader on OutOfDirectMemoryError by @raipc in netty/netty#16551

IoUring: Disable test while we debug to unblock other builds by @normanmaurer in netty/netty#16581

Include user properties and subscription IDs in MqttProperties#isEmpty by @ShadowySpirits in netty/netty#16575

Native DNS resolver: Guard against malloc failures by @normanmaurer in netty/netty#16559

Auto-port 4.2: Increase timeouts for QuicChannelConnectTest by @netty-project-bot in netty/netty#16578

Fix parsing HTTP chunks with multiple extensions by @chrisvest in netty/netty#16579

Bump org.codehaus.plexus:plexus-utils from 3.4.2 to 4.0.3 in /codec-native-quic by @dependabot[bot] in netty/netty#16572

Revert to PR build to Ubuntu 22.04 by @chrisvest in netty/netty#16595

Native transports: Correctly create pipe when pipe2 is not supported by @normanmaurer in netty/netty#16592

Epoll: Cleanup code to always return negative value on failure by @normanmaurer in netty/netty#16591

Fix component search fast path by @yawkat in netty/netty#16548

Stabilize read-only toStringMultipleThreads1 by @chrisvest in netty/netty#16608

Stabilize more AbstractByteBufTests by @chrisvest in netty/netty#16611

Remove note about needing 256-bit for PQC by @chrisvest in netty/netty#16605

Stabilize testSessionInvalidate for Conscrypt by @chrisvest in netty/netty#16615

Quic: Correctly handle SSL_CTX_new failures by @normanmaurer in netty/netty#16622

Make LocalIoHandle public by @rdicroce in netty/netty#16621

Quic: Fix shadowing of variable which leads to incorrectly handling errors by @normanmaurer in netty/netty#16623

Auto-port 4.2: Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by @netty-project-bot in netty/netty#16629

Fix shutdownInput bug in kqueue for empty recv buffer by @chrisvest in netty/netty#16630

fix FFM address semantics in directBufferAddress by @dreamlike-ocean in netty/netty#16603

HTTP2: Ensure HTTP2 preface is always send as first message by @normanmaurer in netty/netty#16636

Move Http2FrameCodecSubClassTest to correct package by @normanmaurer in netty/netty#16640

Kqueue: Fix usage of LOCAL_PEERPID by @normanmaurer in netty/netty#16637

Avoid ArrayQueue allocation in HttpServerCodec by @doom369 in netty/netty#16596

Fix file descriptor reuse bug in kqueue by @chrisvest in netty/netty#16650

... (truncated)

Commits

b3844c8 [maven-release-plugin] prepare release netty-4.2.13.Final
82f47fa Merge commit from fork
ada0999 Merge commit from fork
b4051e2 Fix BrotliDecoder not forwarding all decompressed chunks
67207c1 Merge commit from fork
541ca7c Merge commit from fork
943edb3 Fix codec-dns tests
6459a28 Merge commit from fork
b4ba61b Fix checkstyle in HttpObjectDecoder
977661f Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-common from 4.1.133.Final to 4.2.13.Final

Release notes

Sourced from io.netty:netty-common's releases.

netty-4.2.13.Final

CVEs Fixed

CVE-2026-42586 (netty-codec-redis)

CVE-2026-42578 (netty-handler-proxy)

CVE-2026-42577 (netty-transport-native-epoll)

CVE-2026-42587 (netty-codec-http, netty-codec-http2)

CVE-2026-41417 (netty-codec-http)

CVE-2026-42581 (netty-codec-http)

CVE-2026-42580 (netty-codec-http)

CVE-2026-42585 (netty-codec-http)

CVE-2026-42579 (netty-codec-dns)

CVE-2026-42582 (netty-codec-http3)

CVE-2026-42583 (netty-codec, netty-codec-compression)

CVE-2026-42584 (netty-codec-http)

CVE-2026-44248 (netty-codec-mqtt)

What's Changed

Kqueue: sendfile EINTR doesn't advance offset — data duplication by @normanmaurer in netty/netty#16544

Replace usage of strerror with thread-safe alternative by @normanmaurer in netty/netty#16547

Fix implementation of strerror_r_xsi for GNU by @normanmaurer in netty/netty#16546

Lazy init ArrayList in DefaultHeaders.getAll by @doom369 in netty/netty#16526

Less logging in AWS-LC build by @chrisvest in netty/netty#16565

Ensure the CRYPTO_BUFFER_POOL is also freed when we fail creating the SSLContext by @normanmaurer in netty/netty#16545

Auto-port 4.2: Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by @netty-project-bot in netty/netty#16543

Avoid leak in PemReader on OutOfDirectMemoryError by @raipc in netty/netty#16551

IoUring: Disable test while we debug to unblock other builds by @normanmaurer in netty/netty#16581

Include user properties and subscription IDs in MqttProperties#isEmpty by @ShadowySpirits in netty/netty#16575

Native DNS resolver: Guard against malloc failures by @normanmaurer in netty/netty#16559

Auto-port 4.2: Increase timeouts for QuicChannelConnectTest by @netty-project-bot in netty/netty#16578

Fix parsing HTTP chunks with multiple extensions by @chrisvest in netty/netty#16579

Bump org.codehaus.plexus:plexus-utils from 3.4.2 to 4.0.3 in /codec-native-quic by @dependabot[bot] in netty/netty#16572

Revert to PR build to Ubuntu 22.04 by @chrisvest in netty/netty#16595

Native transports: Correctly create pipe when pipe2 is not supported by @normanmaurer in netty/netty#16592

Epoll: Cleanup code to always return negative value on failure by @normanmaurer in netty/netty#16591

Fix component search fast path by @yawkat in netty/netty#16548

Stabilize read-only toStringMultipleThreads1 by @chrisvest in netty/netty#16608

Stabilize more AbstractByteBufTests by @chrisvest in netty/netty#16611

Remove note about needing 256-bit for PQC by @chrisvest in netty/netty#16605

Stabilize testSessionInvalidate for Conscrypt by @chrisvest in netty/netty#16615

Quic: Correctly handle SSL_CTX_new failures by @normanmaurer in netty/netty#16622

Make LocalIoHandle public by @rdicroce in netty/netty#16621

Quic: Fix shadowing of variable which leads to incorrectly handling errors by @normanmaurer in netty/netty#16623

Auto-port 4.2: Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by @netty-project-bot in netty/netty#16629

Fix shutdownInput bug in kqueue for empty recv buffer by @chrisvest in Description has been truncated

Bumps the netty group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [io.netty:netty-handler](https://github.com/netty/netty) | `4.1.133.Final` | `4.2.13.Final` | | [io.netty:netty-transport](https://github.com/netty/netty) | `4.1.133.Final` | `4.2.13.Final` | | [io.netty:netty-codec-http](https://github.com/netty/netty) | `4.1.133.Final` | `4.2.13.Final` | | [io.netty:netty-codec-http2](https://github.com/netty/netty) | `4.1.133.Final` | `4.2.13.Final` | | [io.netty:netty-codec](https://github.com/netty/netty) | `4.1.133.Final` | `4.2.13.Final` | | [io.netty:netty-common](https://github.com/netty/netty) | `4.1.133.Final` | `4.2.13.Final` | | [io.netty:netty-buffer](https://github.com/netty/netty) | `4.1.133.Final` | `4.2.13.Final` | | [io.netty:netty-resolver](https://github.com/netty/netty) | `4.1.133.Final` | `4.2.13.Final` | | [io.netty:netty-resolver-dns](https://github.com/netty/netty) | `4.1.133.Final` | `4.2.13.Final` | | [io.netty:netty-transport-classes-epoll](https://github.com/netty/netty) | `4.1.133.Final` | `4.2.13.Final` | Updates `io.netty:netty-handler` from 4.1.133.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.13.Final) Updates `io.netty:netty-transport` from 4.1.133.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.13.Final) Updates `io.netty:netty-codec-http` from 4.1.133.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.13.Final) Updates `io.netty:netty-codec-http2` from 4.1.133.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.13.Final) Updates `io.netty:netty-codec` from 4.1.133.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.13.Final) Updates `io.netty:netty-common` from 4.1.133.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.13.Final) Updates `io.netty:netty-buffer` from 4.1.133.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.13.Final) Updates `io.netty:netty-resolver` from 4.1.133.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.13.Final) Updates `io.netty:netty-resolver-dns` from 4.1.133.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.13.Final) Updates `io.netty:netty-transport-classes-epoll` from 4.1.133.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.13.Final) Updates `io.netty:netty-transport` from 4.1.133.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.13.Final) Updates `io.netty:netty-codec-http` from 4.1.133.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.13.Final) Updates `io.netty:netty-codec-http2` from 4.1.133.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.13.Final) Updates `io.netty:netty-codec` from 4.1.133.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.13.Final) Updates `io.netty:netty-common` from 4.1.133.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.13.Final) Updates `io.netty:netty-buffer` from 4.1.133.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.13.Final) Updates `io.netty:netty-resolver` from 4.1.133.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.13.Final) Updates `io.netty:netty-resolver-dns` from 4.1.133.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.13.Final) Updates `io.netty:netty-transport-classes-epoll` from 4.1.133.Final to 4.2.13.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.13.Final) --- updated-dependencies: - dependency-name: io.netty:netty-buffer dependency-version: 4.2.13.Final dependency-type: direct:development update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-buffer dependency-version: 4.2.13.Final dependency-type: direct:development update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-codec dependency-version: 4.2.13.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-codec dependency-version: 4.2.13.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-codec-http dependency-version: 4.2.13.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-codec-http dependency-version: 4.2.13.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-codec-http2 dependency-version: 4.2.13.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-codec-http2 dependency-version: 4.2.13.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-common dependency-version: 4.2.13.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-common dependency-version: 4.2.13.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-handler dependency-version: 4.2.13.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-resolver dependency-version: 4.2.13.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-resolver dependency-version: 4.2.13.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-resolver-dns dependency-version: 4.2.13.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-resolver-dns dependency-version: 4.2.13.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-transport dependency-version: 4.2.13.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-transport dependency-version: 4.2.13.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-transport-classes-epoll dependency-version: 4.2.13.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty - dependency-name: io.netty:netty-transport-classes-epoll dependency-version: 4.2.13.Final dependency-type: direct:production update-type: version-update:semver-minor dependency-group: netty ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the dependencies This issue is a problem in a dependency. label May 6, 2026

dependabot Bot requested a review from a team as a code owner May 6, 2026 18:29

dependabot Bot added java Pull requests that update java code dependencies This issue is a problem in a dependency. labels May 6, 2026

dependabot Bot force-pushed the dependabot/maven/netty-cc33cf776d branch from 3acd6b6 to 155a204 Compare May 6, 2026 19:34

bhoradc mentioned this pull request May 6, 2026

Restrict Dependabot Netty updates to patch versions only #6942

Open

12 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the netty group across 1 directory with 10 updates#6941

Bump the netty group across 1 directory with 10 updates#6941
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/maven/netty-cc33cf776d

dependabot Bot commented on behalf of github May 6, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

netty-4.2.13.Final

CVEs Fixed

What's Changed

netty-4.2.13.Final

CVEs Fixed

What's Changed

netty-4.2.13.Final

CVEs Fixed

What's Changed

netty-4.2.13.Final

CVEs Fixed

What's Changed

netty-4.2.13.Final

CVEs Fixed

What's Changed

netty-4.2.13.Final

CVEs Fixed

What's Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github May 6, 2026 •

edited

Loading