build(deps): bump the dependencies group with 18 updates by dependabot[bot] · Pull Request #4041 · jooby-project/jooby

dependabot · 2026-11-06T00:10:22Z

Bumps the dependencies group with 18 updates:

Package	From	To
io.netty:netty-bom	`4.2.19.Final`	`4.2.20.Final`
io.netty:netty-codec-http2	`4.2.19.Final`	`4.2.20.Final`
io.netty:netty-transport-native-epoll	`4.2.19.Final`	`4.2.20.Final`
io.netty:netty-transport-native-kqueue	`4.2.19.Final`	`4.2.20.Final`
io.netty:netty-transport-native-io_uring	`4.2.19.Final`	`4.2.20.Final`
io.swagger.core.v3:swagger-annotations	`2.2.55`	`3.0.0`
io.swagger.core.v3:swagger-models	`2.2.55`	`3.0.0`
com.google.guava:guava	`33.7.2-jre`	`33.8.0-jre`
org.apache.maven.plugins:maven-enforcer-plugin	`3.6.3`	`3.7.0`
com.diffplug.spotless:spotless-maven-plugin	`3.10.4`	`3.11.0`
com.puppycrawl.tools:checkstyle	`14.3.0`	`14.4.0`
org.mozilla:rhino	`1.9.1`	`1.9.2`
net.bytebuddy:byte-buddy	`1.18.16`	`1.18.17`
dev.langchain4j:langchain4j-bom	`1.22.0`	`1.23.0`
io.github.classgraph:classgraph	`5.0.0`	`5.0.1`
gg.jte:jte	`3.2.4`	`3.2.5`
gg.jte:jte-models	`3.2.4`	`3.2.5`
software.amazon.awssdk:bom	`2.57.4`	`2.57.8`

Updates io.netty:netty-bom from 4.2.19.Final to 4.2.20.Final

Release notes

Sourced from io.netty:netty-bom's releases.

netty-4.2.20.Final

Security Fixes

https://github.com/netty/netty/security/advisories/GHSA-m77g-r4c7-3w77 - out-of-bounds read in netty-buffer

https://github.com/netty/netty/security/advisories/GHSA-v2v6-vch9-4pcg - inefficient CPU computation in netty-codec-http3

https://github.com/netty/netty/security/advisories/GHSA-rx4g-qxm6-238r - out-of-bounds read in netty-buffer

https://github.com/netty/netty/security/advisories/GHSA-cqmg-wc9g-fpj8 - insufficient entropy in netty-resolver-dns

https://github.com/netty/netty/security/advisories/GHSA-hc9x-r52h-gh4x - unbounded memory usage in netty-codec-http2

https://github.com/netty/netty/security/advisories/GHSA-42mp-m8rq-6rgj - insufficient control character neutralization in netty-codec-http

https://github.com/netty/netty/security/advisories/GHSA-w53r-xhgx-8582 - use-after-free in netty-codec-classes-quic

https://github.com/netty/netty/security/advisories/GHSA-qhw9-p586-v948 - out-of-bounds read in netty-buffer

https://github.com/netty/netty/security/advisories/GHSA-84gx-4cj4-rm7q - unbounded memory usage in netty-codec-mqtt

https://github.com/netty/netty/security/advisories/GHSA-6xv6-9mgg-mfvc - mTLS auth bypass via session resumption in netty-handler and netty-codec-quic

What's Changed

IoUring: Fix empty writev submissions after sendmsg_zc by @dreamlike-ocean in netty/netty#17782

Do not let a negatively cached search domain shadow a positive one by @akilegaspi in netty/netty#17623

Fix musl verify job by @normanmaurer in netty/netty#17801

Reject Redis lines that start with LF by @yawkat in netty/netty#17793

Choose server key types from client's signature algorithms for TLS 1.3 by @eager-signal in netty/netty#17764

Port 4.2: LocalChannel: Deliver data written by the peer before it closed (#17814) by @normanmaurer in netty/netty#17816

Validate padding of HEADERS frames without priority by @bryce-anderson in netty/netty#17817

Don't spin in SslHandler.wrapMultiple(...) when the engine consumes nothing by @allthingssecurity in netty/netty#17728

Preserve invalid SNI names in ReferenceCountedOpenSslEngine by @gavinbunney in netty/netty#17781

Optimize redundant bounds checking in ByteBuf.setBytes by @vpelikh in netty/netty#17023

Respect SETTINGS_QPACK_BLOCKED_STREAMS for unacknowledged QPACK entries by @allthingssecurity in netty/netty#17754

Release the DNS response when a query future loses a cancel race by @watson-ryan in netty/netty#17475

Lazily instantiate VarHandle JCTools queues via holder class by @arnabnandy7 in netty/netty#17750

Keep reading a closed QUIC stream until the end of its input by @allthingssecurity in netty/netty#17755

Throw UnsupportedOperationException from AdaptiveByteBuf.memoryAddress() without an address by @normanmaurer in netty/netty#17820

HAProxyMessage: validate the length of all TLV types by @yawkat in netty/netty#17834

Fix HpackDynamicTable losing entries when filled to capacity by @yawkat in netty/netty#17831

Make AdaptiveByteBuf.memoryAddress() faster by @lhotari in netty/netty#17767

Validate bzip2 Huffman code lengths before building decode tables by @Raghuvardhan-Reddy78 in netty/netty#17812

Validate header values on DefaultHeaders.copy(), bulk add, entry setValue and ReadOnlyHttpHeaders by @normanmaurer in netty/netty#17841

Throw DecompressionException on JdkZlib preset dictionary mismatch by @yawkat in netty/netty#17838

Reject HTTP version numbers that overflow int by @yawkat in netty/netty#17836

Apply certificate list size floor by @arnabnandy7 in netty/netty#17674

HAProxyMessageEncoder: encode v1 PROXY UNKNOWN headers by @yawkat in netty/netty#17837

HAProxyMessage: decode TLVs with an empty value at the end of the header by @yawkat in netty/netty#17835

Reject invalid content-length in PUSH_PROMISE with a stream error by @yawkat in netty/netty#17867

Honor maxAllocation for brotli in DelegatingDecompressorFrameListener by @yawkat in netty/netty#17866

HAProxyMessageDecoder: fix v2 header framing with a non-zero reader index by @yawkat in netty/netty#17832

IpSubnetFilter: Add tests for overlapping rules by @Raghuvardhan-Reddy78 in netty/netty#17765

Avoid allocating NIO buffer views in AdaptiveByteBuf.setBytes(int, ByteBuf, int, int) by @lhotari in netty/netty#17840

Skip JNDI nameserver lookup on IBM i by @manish-9245 in netty/netty#17872

Reset the h2c upgrade stream if the request can not be converted by @yawkat in netty/netty#17869

Don't size ZstdDecoder output buffers from the frame content size by @Raghuvardhan-Reddy78 in netty/netty#17896

Fix NPE in Http2FrameCodec when h2c upgrade fails by @yawkat in netty/netty#17871

Allow adaptive allocator magazine cleanup in BlockHound by @cj848 in netty/netty#17849

GroupsConverter: fix the x25519mlkem768 group name by @normanmaurer in netty/netty#17898

... (truncated)

Commits

4fb6a5f [maven-release-plugin] prepare release netty-4.2.20.Final
3da0f5a Reject all control characters and DEL in HTTP request line tokens
464cfd7 TLS/QUIC: Scope session resumption via a derived session_id_context
b85fb0a Don't preallocate the SUBACK and UNSUBACK reason code lists from the remainin...
c2196f9 Check the index before every numeric accessor on Unpooled buffers
dbf089b Fix use-after-free when QuicheQuicConnection.free() races an offloaded SSL task
52ce8c5 Bound outstandingRemoteSettingsQueue to prevent unbounded heap growth
d576bd9 Add 0x20 case randomization and DNS cookie support to DnsNameResolver
fb4736f Check bounds in ByteBuf string accessors
debfda5 QPACK: Don't decode the name of Insert With Literal Name again for every valu...
Additional commits viewable in compare view

Updates io.netty:netty-codec-http2 from 4.2.19.Final to 4.2.20.Final

Release notes

Sourced from io.netty:netty-codec-http2's releases.

netty-4.2.20.Final

Security Fixes

https://github.com/netty/netty/security/advisories/GHSA-m77g-r4c7-3w77 - out-of-bounds read in netty-buffer

https://github.com/netty/netty/security/advisories/GHSA-v2v6-vch9-4pcg - inefficient CPU computation in netty-codec-http3

https://github.com/netty/netty/security/advisories/GHSA-rx4g-qxm6-238r - out-of-bounds read in netty-buffer

https://github.com/netty/netty/security/advisories/GHSA-cqmg-wc9g-fpj8 - insufficient entropy in netty-resolver-dns

https://github.com/netty/netty/security/advisories/GHSA-hc9x-r52h-gh4x - unbounded memory usage in netty-codec-http2

https://github.com/netty/netty/security/advisories/GHSA-42mp-m8rq-6rgj - insufficient control character neutralization in netty-codec-http

https://github.com/netty/netty/security/advisories/GHSA-w53r-xhgx-8582 - use-after-free in netty-codec-classes-quic

https://github.com/netty/netty/security/advisories/GHSA-qhw9-p586-v948 - out-of-bounds read in netty-buffer

https://github.com/netty/netty/security/advisories/GHSA-84gx-4cj4-rm7q - unbounded memory usage in netty-codec-mqtt

https://github.com/netty/netty/security/advisories/GHSA-6xv6-9mgg-mfvc - mTLS auth bypass via session resumption in netty-handler and netty-codec-quic

What's Changed

IoUring: Fix empty writev submissions after sendmsg_zc by @dreamlike-ocean in netty/netty#17782

Do not let a negatively cached search domain shadow a positive one by @akilegaspi in netty/netty#17623

Fix musl verify job by @normanmaurer in netty/netty#17801

Reject Redis lines that start with LF by @yawkat in netty/netty#17793

Choose server key types from client's signature algorithms for TLS 1.3 by @eager-signal in netty/netty#17764

Port 4.2: LocalChannel: Deliver data written by the peer before it closed (#17814) by @normanmaurer in netty/netty#17816

Validate padding of HEADERS frames without priority by @bryce-anderson in netty/netty#17817

Don't spin in SslHandler.wrapMultiple(...) when the engine consumes nothing by @allthingssecurity in netty/netty#17728

Preserve invalid SNI names in ReferenceCountedOpenSslEngine by @gavinbunney in netty/netty#17781

Optimize redundant bounds checking in ByteBuf.setBytes by @vpelikh in netty/netty#17023

Respect SETTINGS_QPACK_BLOCKED_STREAMS for unacknowledged QPACK entries by @allthingssecurity in netty/netty#17754

Release the DNS response when a query future loses a cancel race by @watson-ryan in netty/netty#17475

Lazily instantiate VarHandle JCTools queues via holder class by @arnabnandy7 in netty/netty#17750

Keep reading a closed QUIC stream until the end of its input by @allthingssecurity in netty/netty#17755

Throw UnsupportedOperationException from AdaptiveByteBuf.memoryAddress() without an address by @normanmaurer in netty/netty#17820

HAProxyMessage: validate the length of all TLV types by @yawkat in netty/netty#17834

Fix HpackDynamicTable losing entries when filled to capacity by @yawkat in netty/netty#17831

Make AdaptiveByteBuf.memoryAddress() faster by @lhotari in netty/netty#17767

Validate bzip2 Huffman code lengths before building decode tables by @Raghuvardhan-Reddy78 in netty/netty#17812

Validate header values on DefaultHeaders.copy(), bulk add, entry setValue and ReadOnlyHttpHeaders by @normanmaurer in netty/netty#17841

Throw DecompressionException on JdkZlib preset dictionary mismatch by @yawkat in netty/netty#17838

Reject HTTP version numbers that overflow int by @yawkat in netty/netty#17836

Apply certificate list size floor by @arnabnandy7 in netty/netty#17674

HAProxyMessageEncoder: encode v1 PROXY UNKNOWN headers by @yawkat in netty/netty#17837

HAProxyMessage: decode TLVs with an empty value at the end of the header by @yawkat in netty/netty#17835

Reject invalid content-length in PUSH_PROMISE with a stream error by @yawkat in netty/netty#17867

Honor maxAllocation for brotli in DelegatingDecompressorFrameListener by @yawkat in netty/netty#17866

HAProxyMessageDecoder: fix v2 header framing with a non-zero reader index by @yawkat in netty/netty#17832

IpSubnetFilter: Add tests for overlapping rules by @Raghuvardhan-Reddy78 in netty/netty#17765

Avoid allocating NIO buffer views in AdaptiveByteBuf.setBytes(int, ByteBuf, int, int) by @lhotari in netty/netty#17840

Skip JNDI nameserver lookup on IBM i by @manish-9245 in netty/netty#17872

Reset the h2c upgrade stream if the request can not be converted by @yawkat in netty/netty#17869

Don't size ZstdDecoder output buffers from the frame content size by @Raghuvardhan-Reddy78 in netty/netty#17896

Fix NPE in Http2FrameCodec when h2c upgrade fails by @yawkat in netty/netty#17871

Allow adaptive allocator magazine cleanup in BlockHound by @cj848 in netty/netty#17849

GroupsConverter: fix the x25519mlkem768 group name by @normanmaurer in netty/netty#17898

... (truncated)

Commits

4fb6a5f [maven-release-plugin] prepare release netty-4.2.20.Final
3da0f5a Reject all control characters and DEL in HTTP request line tokens
464cfd7 TLS/QUIC: Scope session resumption via a derived session_id_context
b85fb0a Don't preallocate the SUBACK and UNSUBACK reason code lists from the remainin...
c2196f9 Check the index before every numeric accessor on Unpooled buffers
dbf089b Fix use-after-free when QuicheQuicConnection.free() races an offloaded SSL task
52ce8c5 Bound outstandingRemoteSettingsQueue to prevent unbounded heap growth
d576bd9 Add 0x20 case randomization and DNS cookie support to DnsNameResolver
fb4736f Check bounds in ByteBuf string accessors
debfda5 QPACK: Don't decode the name of Insert With Literal Name again for every valu...
Additional commits viewable in compare view

Updates io.netty:netty-transport-native-epoll from 4.2.19.Final to 4.2.20.Final

Release notes

Sourced from io.netty:netty-transport-native-epoll's releases.

netty-4.2.20.Final

Security Fixes

https://github.com/netty/netty/security/advisories/GHSA-m77g-r4c7-3w77 - out-of-bounds read in netty-buffer

https://github.com/netty/netty/security/advisories/GHSA-v2v6-vch9-4pcg - inefficient CPU computation in netty-codec-http3

https://github.com/netty/netty/security/advisories/GHSA-rx4g-qxm6-238r - out-of-bounds read in netty-buffer

https://github.com/netty/netty/security/advisories/GHSA-cqmg-wc9g-fpj8 - insufficient entropy in netty-resolver-dns

https://github.com/netty/netty/security/advisories/GHSA-hc9x-r52h-gh4x - unbounded memory usage in netty-codec-http2

https://github.com/netty/netty/security/advisories/GHSA-42mp-m8rq-6rgj - insufficient control character neutralization in netty-codec-http

https://github.com/netty/netty/security/advisories/GHSA-w53r-xhgx-8582 - use-after-free in netty-codec-classes-quic

https://github.com/netty/netty/security/advisories/GHSA-qhw9-p586-v948 - out-of-bounds read in netty-buffer

https://github.com/netty/netty/security/advisories/GHSA-84gx-4cj4-rm7q - unbounded memory usage in netty-codec-mqtt

https://github.com/netty/netty/security/advisories/GHSA-6xv6-9mgg-mfvc - mTLS auth bypass via session resumption in netty-handler and netty-codec-quic

What's Changed

IoUring: Fix empty writev submissions after sendmsg_zc by @dreamlike-ocean in netty/netty#17782

Do not let a negatively cached search domain shadow a positive one by @akilegaspi in netty/netty#17623

Fix musl verify job by @normanmaurer in netty/netty#17801

Reject Redis lines that start with LF by @yawkat in netty/netty#17793

Choose server key types from client's signature algorithms for TLS 1.3 by @eager-signal in netty/netty#17764

Port 4.2: LocalChannel: Deliver data written by the peer before it closed (#17814) by @normanmaurer in netty/netty#17816

Validate padding of HEADERS frames without priority by @bryce-anderson in netty/netty#17817

Don't spin in SslHandler.wrapMultiple(...) when the engine consumes nothing by @allthingssecurity in netty/netty#17728

Preserve invalid SNI names in ReferenceCountedOpenSslEngine by @gavinbunney in netty/netty#17781

Optimize redundant bounds checking in ByteBuf.setBytes by @vpelikh in netty/netty#17023

Respect SETTINGS_QPACK_BLOCKED_STREAMS for unacknowledged QPACK entries by @allthingssecurity in netty/netty#17754

Release the DNS response when a query future loses a cancel race by @watson-ryan in netty/netty#17475

Lazily instantiate VarHandle JCTools queues via holder class by @arnabnandy7 in netty/netty#17750

Keep reading a closed QUIC stream until the end of its input by @allthingssecurity in netty/netty#17755

Throw UnsupportedOperationException from AdaptiveByteBuf.memoryAddress() without an address by @normanmaurer in netty/netty#17820

HAProxyMessage: validate the length of all TLV types by @yawkat in netty/netty#17834

Fix HpackDynamicTable losing entries when filled to capacity by @yawkat in netty/netty#17831

Make AdaptiveByteBuf.memoryAddress() faster by @lhotari in netty/netty#17767

Validate bzip2 Huffman code lengths before building decode tables by @Raghuvardhan-Reddy78 in netty/netty#17812

Validate header values on DefaultHeaders.copy(), bulk add, entry setValue and ReadOnlyHttpHeaders by @normanmaurer in netty/netty#17841

Throw DecompressionException on JdkZlib preset dictionary mismatch by @yawkat in netty/netty#17838

Reject HTTP version numbers that overflow int by @yawkat in netty/netty#17836

Apply certificate list size floor by @arnabnandy7 in netty/netty#17674

HAProxyMessageEncoder: encode v1 PROXY UNKNOWN headers by @yawkat in netty/netty#17837

HAProxyMessage: decode TLVs with an empty value at the end of the header by @yawkat in netty/netty#17835

Reject invalid content-length in PUSH_PROMISE with a stream error by @yawkat in netty/netty#17867

Honor maxAllocation for brotli in DelegatingDecompressorFrameListener by @yawkat in netty/netty#17866

HAProxyMessageDecoder: fix v2 header framing with a non-zero reader index by @yawkat in netty/netty#17832

IpSubnetFilter: Add tests for overlapping rules by @Raghuvardhan-Reddy78 in netty/netty#17765

Avoid allocating NIO buffer views in AdaptiveByteBuf.setBytes(int, ByteBuf, int, int) by @lhotari in netty/netty#17840

Skip JNDI nameserver lookup on IBM i by @manish-9245 in netty/netty#17872

Reset the h2c upgrade stream if the request can not be converted by @yawkat in netty/netty#17869

Don't size ZstdDecoder output buffers from the frame content size by @Raghuvardhan-Reddy78 in netty/netty#17896

Fix NPE in Http2FrameCodec when h2c upgrade fails by @yawkat in netty/netty#17871

Allow adaptive allocator magazine cleanup in BlockHound by @cj848 in netty/netty#17849

GroupsConverter: fix the x25519mlkem768 group name by @normanmaurer in netty/netty#17898

... (truncated)

Commits

4fb6a5f [maven-release-plugin] prepare release netty-4.2.20.Final
3da0f5a Reject all control characters and DEL in HTTP request line tokens
464cfd7 TLS/QUIC: Scope session resumption via a derived session_id_context
b85fb0a Don't preallocate the SUBACK and UNSUBACK reason code lists from the remainin...
c2196f9 Check the index before every numeric accessor on Unpooled buffers
dbf089b Fix use-after-free when QuicheQuicConnection.free() races an offloaded SSL task
52ce8c5 Bound outstandingRemoteSettingsQueue to prevent unbounded heap growth
d576bd9 Add 0x20 case randomization and DNS cookie support to DnsNameResolver
fb4736f Check bounds in ByteBuf string accessors
debfda5 QPACK: Don't decode the name of Insert With Literal Name again for every valu...
Additional commits viewable in compare view

Updates io.netty:netty-transport-native-kqueue from 4.2.19.Final to 4.2.20.Final

Release notes

Sourced from io.netty:netty-transport-native-kqueue's releases.

netty-4.2.20.Final

Security Fixes

https://github.com/netty/netty/security/advisories/GHSA-m77g-r4c7-3w77 - out-of-bounds read in netty-buffer

https://github.com/netty/netty/security/advisories/GHSA-v2v6-vch9-4pcg - inefficient CPU computation in netty-codec-http3

https://github.com/netty/netty/security/advisories/GHSA-rx4g-qxm6-238r - out-of-bounds read in netty-buffer

https://github.com/netty/netty/security/advisories/GHSA-cqmg-wc9g-fpj8 - insufficient entropy in netty-resolver-dns

https://github.com/netty/netty/security/advisories/GHSA-hc9x-r52h-gh4x - unbounded memory usage in netty-codec-http2

https://github.com/netty/netty/security/advisories/GHSA-42mp-m8rq-6rgj - insufficient control character neutralization in netty-codec-http

https://github.com/netty/netty/security/advisories/GHSA-w53r-xhgx-8582 - use-after-free in netty-codec-classes-quic

https://github.com/netty/netty/security/advisories/GHSA-qhw9-p586-v948 - out-of-bounds read in netty-buffer

https://github.com/netty/netty/security/advisories/GHSA-84gx-4cj4-rm7q - unbounded memory usage in netty-codec-mqtt

https://github.com/netty/netty/security/advisories/GHSA-6xv6-9mgg-mfvc - mTLS auth bypass via session resumption in netty-handler and netty-codec-quic

What's Changed

IoUring: Fix empty writev submissions after sendmsg_zc by @dreamlike-ocean in netty/netty#17782

Do not let a negatively cached search domain shadow a positive one by @akilegaspi in netty/netty#17623

Fix musl verify job by @normanmaurer in netty/netty#17801

Reject Redis lines that start with LF by @yawkat in netty/netty#17793

Choose server key types from client's signature algorithms for TLS 1.3 by @eager-signal in netty/netty#17764

Port 4.2: LocalChannel: Deliver data written by the peer before it closed (#17814) by @normanmaurer in netty/netty#17816

Validate padding of HEADERS frames without priority by @bryce-anderson in netty/netty#17817

Don't spin in SslHandler.wrapMultiple(...) when the engine consumes nothing by @allthingssecurity in netty/netty#17728

Preserve invalid SNI names in ReferenceCountedOpenSslEngine by @gavinbunney in netty/netty#17781

Optimize redundant bounds checking in ByteBuf.setBytes by @vpelikh in netty/netty#17023

Respect SETTINGS_QPACK_BLOCKED_STREAMS for unacknowledged QPACK entries by @allthingssecurity in netty/netty#17754

Release the DNS response when a query future loses a cancel race by @watson-ryan in netty/netty#17475

Lazily instantiate VarHandle JCTools queues via holder class by @arnabnandy7 in netty/netty#17750

Keep reading a closed QUIC stream until the end of its input by @allthingssecurity in netty/netty#17755

Throw UnsupportedOperationException from AdaptiveByteBuf.memoryAddress() without an address by @normanmaurer in netty/netty#17820

HAProxyMessage: validate the length of all TLV types by @yawkat in netty/netty#17834

Fix HpackDynamicTable losing entries when filled to capacity by @yawkat in netty/netty#17831

Make AdaptiveByteBuf.memoryAddress() faster by @lhotari in netty/netty#17767

Validate bzip2 Huffman code lengths before building decode tables by @Raghuvardhan-Reddy78 in netty/netty#17812

Validate header values on DefaultHeaders.copy(), bulk add, entry setValue and ReadOnlyHttpHeaders by @normanmaurer in netty/netty#17841

Throw DecompressionException on JdkZlib preset dictionary mismatch by @yawkat in netty/netty#17838

Reject HTTP version numbers that overflow int by @yawkat in netty/netty#17836

Apply certificate list size floor by @arnabnandy7 in netty/netty#17674

HAProxyMessageEncoder: encode v1 PROXY UNKNOWN headers by @yawkat in netty/netty#17837

HAProxyMessage: decode TLVs with an empty value at the end of the header by @yawkat in netty/netty#17835

Reject invalid content-length in PUSH_PROMISE with a stream error by @yawkat in netty/netty#17867

Honor maxAllocation for brotli in DelegatingDecompressorFrameListener by @yawkat in netty/netty#17866

HAProxyMessageDecoder: fix v2 header framing with a non-zero reader index by @yawkat in netty/netty#17832

IpSubnetFilter: Add tests for overlapping rules by @Raghuvardhan-Reddy78 in netty/netty#17765

Avoid allocating NIO buffer views in AdaptiveByteBuf.setBytes(int, ByteBuf, int, int) by @lhotari in netty/netty#17840

Skip JNDI nameserver lookup on IBM i by @manish-9245 in netty/netty#17872

Reset the h2c upgrade stream if the request can not be converted by @yawkat in netty/netty#17869

Don't size ZstdDecoder output buffers from the frame content size by @Raghuvardhan-Reddy78 in netty/netty#17896

Fix NPE in Http2FrameCodec when h2c upgrade fails by @yawkat in netty/netty#17871

Allow adaptive allocator magazine cleanup in BlockHound by @cj848 in netty/netty#17849

GroupsConverter: fix the x25519mlkem768 group name by @normanmaurer in netty/netty#17898

... (truncated)

Commits

4fb6a5f [maven-release-plugin] prepare release netty-4.2.20.Final
3da0f5a Reject all control characters and DEL in HTTP request line tokens
464cfd7 TLS/QUIC: Scope session resumption via a derived session_id_context
b85fb0a Don't preallocate the SUBACK and UNSUBACK reason code lists from the remainin...
c2196f9 Check the index before every numeric accessor on Unpooled buffers
dbf089b Fix use-after-free when QuicheQuicConnection.free() races an offloaded SSL task
52ce8c5 Bound outstandingRemoteSettingsQueue to prevent unbounded heap growth
d576bd9 Add 0x20 case randomization and DNS cookie support to DnsNameResolver
fb4736f Check bounds in ByteBuf string accessors
debfda5 QPACK: Don't decode the name of Insert With Literal Name again for every valu...
Additional commits viewable in compare view

Updates io.netty:netty-transport-native-io_uring from 4.2.19.Final to 4.2.20.Final

Release notes

Sourced from io.netty:netty-transport-native-io_uring's releases.

netty-4.2.20.Final

Security Fixes

https://github.com/netty/netty/security/advisories/GHSA-m77g-r4c7-3w77 - out-of-bounds read in netty-buffer

https://github.com/netty/netty/security/advisories/GHSA-v2v6-vch9-4pcg - inefficient CPU computation in netty-codec-http3

https://github.com/netty/netty/security/advisories/GHSA-rx4g-qxm6-238r - out-of-bounds read in netty-buffer

https://github.com/netty/netty/security/advisories/GHSA-cqmg-wc9g-fpj8 - insufficient entropy in netty-resolver-dns

https://github.com/netty/netty/security/advisories/GHSA-hc9x-r52h-gh4x - unbounded memory usage in netty-codec-http2

https://github.com/netty/netty/security/advisories/GHSA-42mp-m8rq-6rgj - insufficient control character neutralization in netty-codec-http

https://github.com/netty/netty/security/advisories/GHSA-w53r-xhgx-8582 - use-after-free in netty-codec-classes-quic

https://github.com/netty/netty/security/advisories/GHSA-qhw9-p586-v948 - out-of-bounds read in netty-buffer

https://github.com/netty/netty/security/advisories/GHSA-84gx-4cj4-rm7q - unbounded memory usage in netty-codec-mqtt

https://github.com/netty/netty/security/advisories/GHSA-6xv6-9mgg-mfvc - mTLS auth bypass via session resumption in netty-handler and netty-codec-quic

What's Changed

IoUring: Fix empty writev submissions after sendmsg_zc by @dreamlike-ocean in netty/netty#17782

Do not let a negatively cached search domain shadow a positive one by @akilegaspi in netty/netty#17623

Fix musl verify job by @normanmaurer in netty/netty#17801

Reject Redis lines that start with LF by @yawkat in netty/netty#17793

Choose server key types from client's signature algorithms for TLS 1.3 by @eager-signal in netty/netty#17764

Port 4.2: LocalChannel: Deliver data written by the peer before it closed (#17814) by @normanmaurer in netty/netty#17816

Validate padding of HEADERS frames without priority by @bryce-anderson in netty/netty#17817

Don't spin in SslHandler.wrapMultiple(...) when the engine consumes nothing by @allthingssecurity in netty/netty#17728

Preserve invalid SNI names in ReferenceCountedOpenSslEngine by @gavinbunney in netty/netty#17781

Optimize redundant bounds checking in ByteBuf.setBytes by @vpelikh in netty/netty#17023

Respect SETTINGS_QPACK_BLOCKED_STREAMS for unacknowledged QPACK entries by @allthingssecurity in netty/netty#17754

Release the DNS response when a query future loses a cancel race by @watson-ryan in netty/netty#17475

Lazily instantiate VarHandle JCTools queues via holder class by @arnabnandy7 in netty/netty#17750

Keep reading a closed QUIC stream until the end of its input by @allthingssecurity in netty/netty#17755

Throw UnsupportedOperationException from AdaptiveByteBuf.memoryAddress() without an address by @normanmaurer in netty/netty#17820

HAProxyMessage: validate the length of all TLV types by @yawkat in netty/netty#17834

Fix HpackDynamicTable losing entries when filled to capacity by @yawkat in netty/netty#17831

Make AdaptiveByteBuf.memoryAddress() faster by @lhotari in netty/netty#17767

Validate bzip2 Huffman code lengths before building decode tables by @Raghuvardhan-Reddy78 in netty/netty#17812

Validate header values on DefaultHeaders.copy(), bulk add, entry setValue and ReadOnlyHttpHeaders by @normanmaurer in netty/netty#17841

Throw DecompressionException on JdkZlib preset dictionary mismatch by @yawkat in netty/netty#17838

Reject HTTP version numbers that overflow int by @yawkat in netty/netty#17836

Apply certificate list size floor by @arnabnandy7 in netty/netty#17674

HAProxyMessageEncoder: encode v1 PROXY UNKNOWN headers by @yawkat in netty/netty#17837

HAProxyMessage: decode TLVs with an empty value at the end of the header by @yawkat in netty/netty#17835

Reject invalid content-length in PUSH_PROMISE with a stream error by @yawkat in netty/netty#17867

Honor maxAllocation for brotli in DelegatingDecompressorFrameListener by @yawkat in netty/netty#17866

HAProxyMessageDecoder: fix v2 header framing with a non-zero reader index by @yawkat in netty/netty#17832

IpSubnetFilter: Add tests for overlapping rules by @Raghuvardhan-Reddy78 in netty/netty#17765

Avoid allocating NIO buffer views in AdaptiveByteBuf.setBytes(int, ByteBuf, int, int) by @lhotari in netty/netty#17840

Skip JNDI nameserver lookup on IBM i by @manish-9245 in netty/netty#17872

Reset the h2c upgrade stream if the request can not be converted by @yawkat in netty/netty#17869

Don't size ZstdDecoder output buffers from the frame content size by @Raghuvardhan-Reddy78 in netty/netty#17896

Fix NPE in Http2FrameCodec when h2c upgrade fails by @yawkat in netty/netty#17871

Allow adaptive allocator magazine cleanup in BlockHound by @cj848 in netty/netty#17849

GroupsConverter: fix the x25519mlkem768 group name by @normanmaurer in netty/netty#17898

Bumps the dependencies group with 18 updates: | Package | From | To | | --- | --- | --- | | [io.netty:netty-bom](https://github.com/netty/netty) | `4.2.19.Final` | `4.2.20.Final` | | [io.netty:netty-codec-http2](https://github.com/netty/netty) | `4.2.19.Final` | `4.2.20.Final` | | [io.netty:netty-transport-native-epoll](https://github.com/netty/netty) | `4.2.19.Final` | `4.2.20.Final` | | [io.netty:netty-transport-native-kqueue](https://github.com/netty/netty) | `4.2.19.Final` | `4.2.20.Final` | | [io.netty:netty-transport-native-io_uring](https://github.com/netty/netty) | `4.2.19.Final` | `4.2.20.Final` | | io.swagger.core.v3:swagger-annotations | `2.2.55` | `3.0.0` | | io.swagger.core.v3:swagger-models | `2.2.55` | `3.0.0` | | [com.google.guava:guava](https://github.com/google/guava) | `33.7.2-jre` | `33.8.0-jre` | | [org.apache.maven.plugins:maven-enforcer-plugin](https://github.com/apache/maven-enforcer) | `3.6.3` | `3.7.0` | | [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) | `3.10.4` | `3.11.0` | | [com.puppycrawl.tools:checkstyle](https://github.com/checkstyle/checkstyle) | `14.3.0` | `14.4.0` | | [org.mozilla:rhino](https://github.com/mozilla/rhino) | `1.9.1` | `1.9.2` | | [net.bytebuddy:byte-buddy](https://github.com/raphw/byte-buddy) | `1.18.16` | `1.18.17` | | [dev.langchain4j:langchain4j-bom](https://github.com/langchain4j/langchain4j) | `1.22.0` | `1.23.0` | | [io.github.classgraph:classgraph](https://github.com/classgraph/classgraph) | `5.0.0` | `5.0.1` | | [gg.jte:jte](https://github.com/casid/jte) | `3.2.4` | `3.2.5` | | [gg.jte:jte-models](https://github.com/casid/jte) | `3.2.4` | `3.2.5` | | software.amazon.awssdk:bom | `2.57.4` | `2.57.8` | Updates `io.netty:netty-bom` from 4.2.19.Final to 4.2.20.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.19.Final...netty-4.2.20.Final) Updates `io.netty:netty-codec-http2` from 4.2.19.Final to 4.2.20.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.19.Final...netty-4.2.20.Final) Updates `io.netty:netty-transport-native-epoll` from 4.2.19.Final to 4.2.20.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.19.Final...netty-4.2.20.Final) Updates `io.netty:netty-transport-native-kqueue` from 4.2.19.Final to 4.2.20.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.19.Final...netty-4.2.20.Final) Updates `io.netty:netty-transport-native-io_uring` from 4.2.19.Final to 4.2.20.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.19.Final...netty-4.2.20.Final) Updates `io.swagger.core.v3:swagger-annotations` from 2.2.55 to 3.0.0 Updates `io.swagger.core.v3:swagger-models` from 2.2.55 to 3.0.0 Updates `io.swagger.core.v3:swagger-models` from 2.2.55 to 3.0.0 Updates `com.google.guava:guava` from 33.7.2-jre to 33.8.0-jre - [Release notes](https://github.com/google/guava/releases) - [Commits](https://github.com/google/guava/commits) Updates `org.apache.maven.plugins:maven-enforcer-plugin` from 3.6.3 to 3.7.0 - [Release notes](https://github.com/apache/maven-enforcer/releases) - [Commits](apache/maven-enforcer@enforcer-3.6.3...enforcer-3.7.0) Updates `com.diffplug.spotless:spotless-maven-plugin` from 3.10.4 to 3.11.0 - [Release notes](https://github.com/diffplug/spotless/releases) - [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md) - [Commits](diffplug/spotless@maven/3.10.4...maven/3.11.0) Updates `io.netty:netty-codec-http2` from 4.2.19.Final to 4.2.20.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.19.Final...netty-4.2.20.Final) Updates `io.netty:netty-transport-native-epoll` from 4.2.19.Final to 4.2.20.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.19.Final...netty-4.2.20.Final) Updates `io.netty:netty-transport-native-kqueue` from 4.2.19.Final to 4.2.20.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.19.Final...netty-4.2.20.Final) Updates `io.netty:netty-transport-native-io_uring` from 4.2.19.Final to 4.2.20.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.19.Final...netty-4.2.20.Final) Updates `com.puppycrawl.tools:checkstyle` from 14.3.0 to 14.4.0 - [Release notes](https://github.com/checkstyle/checkstyle/releases) - [Commits](checkstyle/checkstyle@checkstyle-14.3.0...checkstyle-14.4.0) Updates `org.mozilla:rhino` from 1.9.1 to 1.9.2 - [Release notes](https://github.com/mozilla/rhino/releases) - [Changelog](https://github.com/mozilla/rhino/blob/master/RELEASE-NOTES.md) - [Commits](https://github.com/mozilla/rhino/commits) Updates `net.bytebuddy:byte-buddy` from 1.18.16 to 1.18.17 - [Release notes](https://github.com/raphw/byte-buddy/releases) - [Changelog](https://github.com/raphw/byte-buddy/blob/master/release-notes.md) - [Commits](raphw/byte-buddy@byte-buddy-1.18.16...byte-buddy-1.18.17) Updates `dev.langchain4j:langchain4j-bom` from 1.22.0 to 1.23.0 - [Release notes](https://github.com/langchain4j/langchain4j/releases) - [Commits](langchain4j/langchain4j@1.22.0...1.23.0) Updates `io.github.classgraph:classgraph` from 5.0.0 to 5.0.1 - [Release notes](https://github.com/classgraph/classgraph/releases) - [Commits](classgraph/classgraph@classgraph-5.0.0...classgraph-5.0.1) Updates `gg.jte:jte` from 3.2.4 to 3.2.5 - [Release notes](https://github.com/casid/jte/releases) - [Commits](casid/jte@3.2.4...3.2.5) Updates `gg.jte:jte-models` from 3.2.4 to 3.2.5 - [Release notes](https://github.com/casid/jte/releases) - [Commits](casid/jte@3.2.4...3.2.5) Updates `gg.jte:jte-models` from 3.2.4 to 3.2.5 - [Release notes](https://github.com/casid/jte/releases) - [Commits](casid/jte@3.2.4...3.2.5) Updates `software.amazon.awssdk:bom` from 2.57.4 to 2.57.8 --- updated-dependencies: - dependency-name: io.netty:netty-bom dependency-version: 4.2.20.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.netty:netty-codec-http2 dependency-version: 4.2.20.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.netty:netty-transport-native-epoll dependency-version: 4.2.20.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.netty:netty-transport-native-kqueue dependency-version: 4.2.20.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.netty:netty-transport-native-io_uring dependency-version: 4.2.20.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.swagger.core.v3:swagger-annotations dependency-version: 3.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dependencies - dependency-name: io.swagger.core.v3:swagger-models dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies - dependency-name: io.swagger.core.v3:swagger-models dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies - dependency-name: com.google.guava:guava dependency-version: 33.8.0-jre dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: org.apache.maven.plugins:maven-enforcer-plugin dependency-version: 3.7.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: com.diffplug.spotless:spotless-maven-plugin dependency-version: 3.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: io.netty:netty-codec-http2 dependency-version: 4.2.20.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.netty:netty-transport-native-epoll dependency-version: 4.2.20.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.netty:netty-transport-native-kqueue dependency-version: 4.2.20.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.netty:netty-transport-native-io_uring dependency-version: 4.2.20.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: com.puppycrawl.tools:checkstyle dependency-version: 14.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: org.mozilla:rhino dependency-version: 1.9.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: net.bytebuddy:byte-buddy dependency-version: 1.18.17 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: dev.langchain4j:langchain4j-bom dependency-version: 1.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: io.github.classgraph:classgraph dependency-version: 5.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: gg.jte:jte dependency-version: 3.2.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: gg.jte:jte-models dependency-version: 3.2.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: gg.jte:jte-models dependency-version: 3.2.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: software.amazon.awssdk:bom dependency-version: 2.57.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Nov 6, 2026

jknack added this to the 4.6.1 milestone Nov 8, 2026

jknack merged commit 9eba228 into main Nov 8, 2026
0 of 2 checks passed

dependabot Bot deleted the dependabot/maven/dependencies-0a7b8eb1ed branch November 8, 2026 15:06

Navigation Menu

Repository navigation

build(deps): bump the dependencies group with 18 updates - #4041

build(deps): bump the dependencies group with 18 updates#4041
jknack merged 1 commit into
mainfrom
dependabot/maven/dependencies-0a7b8eb1ed

dependabot Bot commented on behalf of github Nov 6, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Nov 6, 2026

netty-4.2.20.Final

Security Fixes

What's Changed

netty-4.2.20.Final

Security Fixes

What's Changed

netty-4.2.20.Final

Security Fixes

What's Changed

netty-4.2.20.Final

Security Fixes

What's Changed

netty-4.2.20.Final

Security Fixes

What's Changed

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant