You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tinkerpop.apache.org by co...@apache.org on 2026/07/29 21:09:11 UTC
(tinkerpop) 01/02: Bump Netty to 4.1.136.Final
This is an automated email from the ASF dual-hosted git repository.
Cole-Greer pushed a commit to branch 3.7-dependencies
in repository https://gitbox.apache.org/repos/asf/tinkerpop.git
commit 8cfcb736acec59d0f9966767cb31aed7cd96b069
Author: Cole Greer <co...@colegreer.ca>
AuthorDate: Wed Jul 29 11:40:23 2026 -0700
Bump Netty to 4.1.136.Final
Upgrades netty.version to 4.1.136.Final to pick up numerous security
fixes accumulated since 4.1.125.Final (HTTP request smuggling, DoS,
XXE, and other CVEs). Bumps bouncycastle.version 1.69 -> 1.70 to stay
aligned with the bcpkix-jdk15on version Netty itself pins for optional
SelfSignedCertificate support.
Fixes HttpHandlerUtilTest, which used a placeholder URI containing a
space ("some uri"). Netty's hardened HttpUtil.validateRequestLineTokens
now rejects such URIs; updated the fixture to a valid URI ("/some-uri")
since the tests exercise serializer/deserializer behavior, not URI
parsing.
Updates NOTICE files in gremlin-console, gremlin-driver, and
gremlin-server to reflect the new Netty version.
Assisted-by: Kiro:claude-sonnet-5 [code] [execute_bash] [fs_write]
---
CHANGELOG.asciidoc | 1 +
gremlin-console/src/main/static/NOTICE | 2 +-
gremlin-driver/src/main/static/NOTICE | 2 +-
gremlin-server/src/main/static/NOTICE | 2 +-
.../tinkerpop/gremlin/server/handler/HttpHandlerUtilTest.java | 6 +++---
pom.xml | 4 ++--
6 files changed, 9 insertions(+), 8 deletions(-)
diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc
index 37f9e7e4c5..b1824b0b80 100644
--- a/CHANGELOG.asciidoc
+++ b/CHANGELOG.asciidoc
@@ -35,6 +35,7 @@ image::https://raw.githubusercontent.com/apache/tinkerpop/master/docs/static/ima
* Fixed `hasId()` to only unroll a collection when it is supplied as the single argument, aligning its behavior with `g.V()`/`g.E()`.
* Allowed float literals without a leading digit (e.g. `.5`, `.5f`, `.5d`) in the Gremlin grammar to better match Groovy.
* Fixed conjoin has incorrect null handling.
+* Bump Netty to 4.1.136.
* Removed the Mono dependency from the `gremlin-dotnet` build/release process, using `dotnet pack`/`dotnet nuget push` instead of `mono nuget.exe`.
* Expanded `gremlin-python` CI matrix to test against Python 3.9, 3.10, 3.11, 3.12, and 3.13.
* Add Node 26 support for `gremlin-javascript` and `gremlint`.
diff --git a/gremlin-console/src/main/static/NOTICE b/gremlin-console/src/main/static/NOTICE
index 2be233e054..3e2a2b66e1 100644
--- a/gremlin-console/src/main/static/NOTICE
+++ b/gremlin-console/src/main/static/NOTICE
@@ -86,7 +86,7 @@ JavaTuples 1.2
Copyright (c) 2010, The JAVATUPLES team (http://www.javatuples.org)
------------------------------------------------------------------------
-Netty 4.1.125.Final
+Netty 4.1.136.Final
------------------------------------------------------------------------
Copyright 2014 The Netty Project
diff --git a/gremlin-driver/src/main/static/NOTICE b/gremlin-driver/src/main/static/NOTICE
index a5c48466be..81c56e1758 100644
--- a/gremlin-driver/src/main/static/NOTICE
+++ b/gremlin-driver/src/main/static/NOTICE
@@ -49,7 +49,7 @@ JavaTuples 1.2
Copyright (c) 2010, The JAVATUPLES team (http://www.javatuples.org)
------------------------------------------------------------------------
-Netty 4.1.125.Final
+Netty 4.1.136.Final
------------------------------------------------------------------------
Copyright 2014 The Netty Project
diff --git a/gremlin-server/src/main/static/NOTICE b/gremlin-server/src/main/static/NOTICE
index 80f72cbbaf..5209d71d80 100644
--- a/gremlin-server/src/main/static/NOTICE
+++ b/gremlin-server/src/main/static/NOTICE
@@ -87,7 +87,7 @@ LongAdder), which was released with the following comments:
http://creativecommons.org/publicdomain/zero/1.0/
------------------------------------------------------------------------
-Netty 4.1.125.Final
+Netty 4.1.136.Final
------------------------------------------------------------------------
Copyright 2014 The Netty Project
diff --git a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/handler/HttpHandlerUtilTest.java b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/handler/HttpHandlerUtilTest.java
index c67988c9b5..8ef5b05e6b 100644
--- a/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/handler/HttpHandlerUtilTest.java
+++ b/gremlin-server/src/test/java/org/apache/tinkerpop/gremlin/server/handler/HttpHandlerUtilTest.java
@@ -69,7 +69,7 @@ public class HttpHandlerUtilTest {
final HttpHeaders headers = new DefaultHttpHeaders();
headers.add(HttpHeaderNames.CONTENT_TYPE, SerTokens.MIME_GRAPHBINARY_V1);
- final FullHttpRequest httpRequest = new DefaultFullHttpRequest(HttpVersion.HTTP_1_1, HttpMethod.POST, "some uri",
+ final FullHttpRequest httpRequest = new DefaultFullHttpRequest(HttpVersion.HTTP_1_1, HttpMethod.POST, "some-uri",
buffer, headers, new DefaultHttpHeaders());
final Map<String, MessageSerializer<?>> serializers = new HashMap<>();
@@ -96,7 +96,7 @@ public class HttpHandlerUtilTest {
final HttpHeaders headers = new DefaultHttpHeaders();
headers.add(HttpHeaderNames.CONTENT_TYPE, SerTokens.MIME_GRAPHBINARY_V1);
- final FullHttpRequest httpRequest = new DefaultFullHttpRequest(HttpVersion.HTTP_1_1, HttpMethod.POST, "some uri",
+ final FullHttpRequest httpRequest = new DefaultFullHttpRequest(HttpVersion.HTTP_1_1, HttpMethod.POST, "some-uri",
buffer, headers, new DefaultHttpHeaders());
final Map<String, MessageSerializer<?>> serializers = new HashMap<>();
@@ -119,7 +119,7 @@ public class HttpHandlerUtilTest {
final HttpHeaders headers = new DefaultHttpHeaders();
headers.add(HttpHeaderNames.CONTENT_TYPE, SerTokens.MIME_JSON);
- final FullHttpRequest httpRequest = new DefaultFullHttpRequest(HttpVersion.HTTP_1_1, HttpMethod.POST, "some uri",
+ final FullHttpRequest httpRequest = new DefaultFullHttpRequest(HttpVersion.HTTP_1_1, HttpMethod.POST, "some-uri",
buffer, headers, new DefaultHttpHeaders());
final Map<String, MessageSerializer<?>> serializers = new HashMap<>();
diff --git a/pom.xml b/pom.xml
index 6e33f515f0..434cfcd2aa 100644
--- a/pom.xml
+++ b/pom.xml
@@ -174,12 +174,12 @@ limitations under the License.
<logback.version>1.2.13</logback.version>
<metrics.version>3.0.2</metrics.version>
<mockito.version>3.10.0</mockito.version>
- <netty.version>4.1.125.Final</netty.version>
+ <netty.version>4.1.136.Final</netty.version>
<slf4j.version>1.7.25</slf4j.version>
<snakeyaml.version>2.0</snakeyaml.version>
<spark.version>3.3.2</spark.version>
<!-- Version aligned with Netty's optional bcpkix dependency used for SelfSignedCertificate -->
- <bouncycastle.version>1.69</bouncycastle.version>
+ <bouncycastle.version>1.70</bouncycastle.version>
<ayza.version>10.0.0</ayza.version>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>