(pulsar) branch master updated: [fix][sec] Upgrade Async HTTP Client to 3.0.14 and Netty Reactive Streams to 2.0.20 (#26764)

[lh...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

lhotari pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/pulsar.git


The following commit(s) were added to refs/heads/master by this push:
     new 95cdea86d53a [fix][sec] Upgrade Async HTTP Client to 3.0.14 and Netty Reactive Streams to 2.0.20 (#26764)
95cdea86d53a is described below

commit 95cdea86d53a3e7fcb5822f6349ddf0e11a65038
Author: Lari Hotari <lh...@users.noreply.github.com>
AuthorDate: Wed Sep 30 04:23:09 2026 +0300

    [fix][sec] Upgrade Async HTTP Client to 3.0.14 and Netty Reactive Streams to 2.0.20 (#26764)
---
 distribution/server/src/assemble/LICENSE.bin.txt | 4 ++--
 distribution/shell/src/assemble/LICENSE.bin.txt  | 4 ++--
 gradle/libs.versions.toml                        | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/distribution/server/src/assemble/LICENSE.bin.txt b/distribution/server/src/assemble/LICENSE.bin.txt
index cdc300891a84..1fab8a7091a5 100644
--- a/distribution/server/src/assemble/LICENSE.bin.txt
+++ b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -274,7 +274,7 @@ The Apache Software License, Version 2.0
     - com.google.guava-failureaccess-1.0.3.jar
     - com.google.guava-listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
  * J2ObjC Annotations -- com.google.j2objc-j2objc-annotations-3.1.jar
- * Netty Reactive Streams -- com.typesafe.netty-netty-reactive-streams-2.0.19.jar
+ * Netty Reactive Streams -- com.typesafe.netty-netty-reactive-streams-2.0.20.jar
  * Swagger
     - io.swagger.core.v3-swagger-annotations-jakarta-2.2.55.jar
  * slog -- io.github.merlimat.slog-slog-0.10.0.jar
@@ -393,7 +393,7 @@ The Apache Software License, Version 2.0
  * AirCompressor
     - io.airlift-aircompressor-2.0.3.jar
  * AsyncHttpClient
-    - org.asynchttpclient-async-http-client-3.0.13.jar
+    - org.asynchttpclient-async-http-client-3.0.14.jar
  * Jetty
     - org.eclipse.jetty-jetty-alpn-client-12.1.13.jar
     - org.eclipse.jetty-jetty-alpn-conscrypt-server-12.1.13.jar
diff --git a/distribution/shell/src/assemble/LICENSE.bin.txt b/distribution/shell/src/assemble/LICENSE.bin.txt
index 846f58e62274..758cc3ce8709 100644
--- a/distribution/shell/src/assemble/LICENSE.bin.txt
+++ b/distribution/shell/src/assemble/LICENSE.bin.txt
@@ -333,7 +333,7 @@ The Apache Software License, Version 2.0
     - failureaccess-1.0.3.jar
     - listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
  * J2ObjC Annotations -- j2objc-annotations-3.1.jar
- * Netty Reactive Streams -- netty-reactive-streams-2.0.19.jar
+ * Netty Reactive Streams -- netty-reactive-streams-2.0.20.jar
  * Swagger -- swagger-annotations-jakarta-2.2.55.jar
  * DataSketches
     - datasketches-java-7.0.1.jar
@@ -405,7 +405,7 @@ The Apache Software License, Version 2.0
   * AirCompressor
      - aircompressor-2.0.3.jar
  * AsyncHttpClient
-    - async-http-client-3.0.13.jar
+    - async-http-client-3.0.14.jar
  * Jetty
     - jetty-alpn-client-12.1.13.jar
     - jetty-client-12.1.13.jar
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 1a023eef4e16..4ef6775a6038 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -84,7 +84,7 @@ snakeyaml = "2.7"
 # Vert.x
 vertx = "4.5.32"
 # Networking / HTTP
-asynchttpclient = "3.0.13"
+asynchttpclient = "3.0.14"
 conscrypt = "2.6.3"
 okhttp3 = "5.5.0"
 okio = "3.18.1"
@@ -138,7 +138,7 @@ java-semver = "0.10.2"
 # oshi is capped at 6.x: at 7.0.0 the oshi-core-java11 artifact became a pom-only
 # relocation stub pointing at com.github.oshi:oshi-core, which is a coordinate change
 oshi = "6.12.0"
-netty-reactive-streams = "2.0.19"
+netty-reactive-streams = "2.0.20"
 # 9.2.0+ is required for CronType.SPRING53 (Spring 5.3+ cron syntax)
 cron-utils = "9.2.1"
 failsafe = "3.3.2"