You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@iggy.apache.org by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/22 20:26:03 UTC
[PR] chore(deps): Bump the java group across 1 directory with 5 updates [iggy]
dependabot[bot] opened a new pull request, #4267:
URL: https://github.com/apache/iggy/pull/4267
Bumps the java group with 5 updates in the /foreign/java directory:
| Package | From | To |
| --- | --- | --- |
| [io.netty:netty-buffer](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` |
| [io.netty:netty-transport](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` |
| [io.netty:netty-handler](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` |
| [io.netty:netty-codec](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` |
| [io.netty:netty-resolver-dns-native-macos](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` |
| [io.netty:netty-transport](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` |
| [io.netty:netty-handler](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` |
| [io.netty:netty-codec](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` |
| [io.netty:netty-resolver-dns-native-macos](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` |
Updates `io.netty:netty-buffer` from 4.2.17.Final to 4.2.18.Final
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/netty/netty/releases">io.netty:netty-buffer's releases</a>.</em></p>
<blockquote>
<h2>netty-4.2.18.Final</h2>
<h2>Security fixes</h2>
<ul>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-rmcw-9fcq-wjq7">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code> (SPDY)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-pvjx-v7vp-62vq">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-8352-h356-c9qh">CVE-2026-XXXXX</a> : denial of service vector in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jj3c-mwvr-9g52">CVE-2026-XXXXX</a> : improper certificate validation in <code>io.netty:netty-handler-ssl-ocsp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-ghg5-c4jg-8q5j">CVE-2026-XXXXX</a> : memory leak in <code>io.netty:netty-codec-stomp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-q9pg-8h3j-8hvm">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hmf3-49g9-g7qq">CVE-2026-XXXXX</a> : denial of service vector in <code>io.netty:netty-codec-stomp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-wxrh-4rgq-pjcg">CVE-2026-XXXXX</a> : parser desync/response smuggling in <code>io.netty:netty-codec-memcache</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-495p-pchh-r4mc">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-v5p2-hmgx-3xrx">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-f64r-x647-cg8w">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-pq4x-537v-r54q">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-smtp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-j58c-g352-8h4p">CVE-2026-XXXXX</a> : memory leak in <code>io.netty:netty-codec-haproxy</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-h75q-xqrh-59rf">CVE-2026-XXXXX</a> : request smuggling in <code>io.netty:netty-codec-http</code> (RTSP)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-rq4j-fc47-9698">CVE-2026-XXXXX</a> : request smuggling in <code>io.netty:netty-codec-http</code> (HTTP/1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jgph-cgq3-c627">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code> (HTTP/1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hfr2-x62w-v49h">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code> and in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-mj35-3qqm-q387">CVE-2026-XXXXX</a> : improper hostname verification in <code>io.netty:netty-codec-classes-quic</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-r4xx-7fpg-j8xg">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-redis</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-3jrc-fchc-59pw">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-j4mg-hqgv-34qc">CVE-2026-XXXXX</a> : request smuggling vector in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jqf3-r9ww-c5x8">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-mqtt</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-5vh9-c45f-rf7p">CVE-2026-XXXXX</a> : improper CRLF neutralization in <code>io.netty:netty-codec-smtp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jhjp-5q4f-8wr2">CVE-2026-XXXXX</a> : improper certificate validation in <code>io.netty:netty-handler-ssl-ocsp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-8whp-c7w8-2m72">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
</ul>
<h2>Compatibility Notes</h2>
<p>A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.</p>
<p>Two specific changes are worth calling out:</p>
<p><strong>QUIC now explicitly requires <code>X509ExtendedTrustManager</code> when hostname verification is enabled.</strong>
Previously, when configuring QUIC with an endpoint identification algorithm and an <code>X509TrustManager</code>, hostname verification would be silently skipped.
This is now considered a misconfiguration and an exception will be thrown.</p>
<p><strong>HTTP/2 header <em>value</em> validation is now enabled by default.</strong>
HTTP/2 header <em>name</em> validation has always been enabled by default, with an option to disable it, but HTTP/2 header <em>value</em> validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.</p>
<h2>What's Changed</h2>
<ul>
<li>Use X509ExtendedTrustManager in SSLErrorTest by <a href="https://github.com/normanmaurer"><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17221">netty/netty#17221</a></li>
<li>Update setup-testlens to v1.9.4 by <a href="https://github.com/marcphilipp"><code>@marcphilipp</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17223">netty/netty#17223</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/netty/netty/commit/2521f494432e27415a567d3a81a9eb907abf20b3"><code>2521f49</code></a> [maven-release-plugin] prepare release netty-4.2.18.Final</li>
<li><a href="https://github.com/netty/netty/commit/6fd53272cbce5c461b8b4e15101687fedce30fd7"><code>6fd5327</code></a> HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...</li>
<li><a href="https://github.com/netty/netty/commit/c44a052228bc4e5aa816686a6628410f037dad7c"><code>c44a052</code></a> SPDY: SpdySessionHandler must limit the concurrent streams</li>
<li><a href="https://github.com/netty/netty/commit/374d965d6f7f63318adcddbb474c0d5198bfaa53"><code>374d965</code></a> HTTP: Limit the maximum number of concurrent pipelined requests</li>
<li><a href="https://github.com/netty/netty/commit/7e8b325cd2d5dc04eaa5a0c13ebfec173b9bedf7"><code>7e8b325</code></a> HTTP/2: Limit HPACK encoding table size</li>
<li><a href="https://github.com/netty/netty/commit/e3ebf70348918febe7cda9bfa1c0ee040a157c07"><code>e3ebf70</code></a> OCSP: Correctly handle that <code>nextUpdate</code> is optional</li>
<li><a href="https://github.com/netty/netty/commit/5388535e1d0c285b6081f53c054bee0e6536a610"><code>5388535</code></a> STOMP: Correctly release partial content on handler removal</li>
<li><a href="https://github.com/netty/netty/commit/3a80f5a3b1f3fdc14e5269c27aac0d67075db245"><code>3a80f5a</code></a> WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...</li>
<li><a href="https://github.com/netty/netty/commit/1b6ea48c89a32f36edbc717861580bc563389b63"><code>1b6ea48</code></a> HTTP3: Correctly handle ":authority" and "host" headers</li>
<li><a href="https://github.com/netty/netty/commit/3630659c817e848e4cc4f11703dc36adc80d537a"><code>3630659</code></a> STOMP codec content-length long-to-int truncation causes infinite decode loop...</li>
<li>Additional commits viewable in <a href="https://github.com/netty/netty/compare/netty-4.2.17.Final...netty-4.2.18.Final">compare view</a></li>
</ul>
</details>
<br />
Updates `io.netty:netty-transport` from 4.2.17.Final to 4.2.18.Final
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/netty/netty/releases">io.netty:netty-transport's releases</a>.</em></p>
<blockquote>
<h2>netty-4.2.18.Final</h2>
<h2>Security fixes</h2>
<ul>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-rmcw-9fcq-wjq7">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code> (SPDY)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-pvjx-v7vp-62vq">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-8352-h356-c9qh">CVE-2026-XXXXX</a> : denial of service vector in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jj3c-mwvr-9g52">CVE-2026-XXXXX</a> : improper certificate validation in <code>io.netty:netty-handler-ssl-ocsp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-ghg5-c4jg-8q5j">CVE-2026-XXXXX</a> : memory leak in <code>io.netty:netty-codec-stomp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-q9pg-8h3j-8hvm">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hmf3-49g9-g7qq">CVE-2026-XXXXX</a> : denial of service vector in <code>io.netty:netty-codec-stomp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-wxrh-4rgq-pjcg">CVE-2026-XXXXX</a> : parser desync/response smuggling in <code>io.netty:netty-codec-memcache</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-495p-pchh-r4mc">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-v5p2-hmgx-3xrx">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-f64r-x647-cg8w">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-pq4x-537v-r54q">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-smtp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-j58c-g352-8h4p">CVE-2026-XXXXX</a> : memory leak in <code>io.netty:netty-codec-haproxy</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-h75q-xqrh-59rf">CVE-2026-XXXXX</a> : request smuggling in <code>io.netty:netty-codec-http</code> (RTSP)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-rq4j-fc47-9698">CVE-2026-XXXXX</a> : request smuggling in <code>io.netty:netty-codec-http</code> (HTTP/1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jgph-cgq3-c627">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code> (HTTP/1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hfr2-x62w-v49h">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code> and in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-mj35-3qqm-q387">CVE-2026-XXXXX</a> : improper hostname verification in <code>io.netty:netty-codec-classes-quic</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-r4xx-7fpg-j8xg">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-redis</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-3jrc-fchc-59pw">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-j4mg-hqgv-34qc">CVE-2026-XXXXX</a> : request smuggling vector in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jqf3-r9ww-c5x8">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-mqtt</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-5vh9-c45f-rf7p">CVE-2026-XXXXX</a> : improper CRLF neutralization in <code>io.netty:netty-codec-smtp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jhjp-5q4f-8wr2">CVE-2026-XXXXX</a> : improper certificate validation in <code>io.netty:netty-handler-ssl-ocsp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-8whp-c7w8-2m72">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
</ul>
<h2>Compatibility Notes</h2>
<p>A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.</p>
<p>Two specific changes are worth calling out:</p>
<p><strong>QUIC now explicitly requires <code>X509ExtendedTrustManager</code> when hostname verification is enabled.</strong>
Previously, when configuring QUIC with an endpoint identification algorithm and an <code>X509TrustManager</code>, hostname verification would be silently skipped.
This is now considered a misconfiguration and an exception will be thrown.</p>
<p><strong>HTTP/2 header <em>value</em> validation is now enabled by default.</strong>
HTTP/2 header <em>name</em> validation has always been enabled by default, with an option to disable it, but HTTP/2 header <em>value</em> validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.</p>
<h2>What's Changed</h2>
<ul>
<li>Use X509ExtendedTrustManager in SSLErrorTest by <a href="https://github.com/normanmaurer"><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17221">netty/netty#17221</a></li>
<li>Update setup-testlens to v1.9.4 by <a href="https://github.com/marcphilipp"><code>@marcphilipp</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17223">netty/netty#17223</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/netty/netty/commit/2521f494432e27415a567d3a81a9eb907abf20b3"><code>2521f49</code></a> [maven-release-plugin] prepare release netty-4.2.18.Final</li>
<li><a href="https://github.com/netty/netty/commit/6fd53272cbce5c461b8b4e15101687fedce30fd7"><code>6fd5327</code></a> HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...</li>
<li><a href="https://github.com/netty/netty/commit/c44a052228bc4e5aa816686a6628410f037dad7c"><code>c44a052</code></a> SPDY: SpdySessionHandler must limit the concurrent streams</li>
<li><a href="https://github.com/netty/netty/commit/374d965d6f7f63318adcddbb474c0d5198bfaa53"><code>374d965</code></a> HTTP: Limit the maximum number of concurrent pipelined requests</li>
<li><a href="https://github.com/netty/netty/commit/7e8b325cd2d5dc04eaa5a0c13ebfec173b9bedf7"><code>7e8b325</code></a> HTTP/2: Limit HPACK encoding table size</li>
<li><a href="https://github.com/netty/netty/commit/e3ebf70348918febe7cda9bfa1c0ee040a157c07"><code>e3ebf70</code></a> OCSP: Correctly handle that <code>nextUpdate</code> is optional</li>
<li><a href="https://github.com/netty/netty/commit/5388535e1d0c285b6081f53c054bee0e6536a610"><code>5388535</code></a> STOMP: Correctly release partial content on handler removal</li>
<li><a href="https://github.com/netty/netty/commit/3a80f5a3b1f3fdc14e5269c27aac0d67075db245"><code>3a80f5a</code></a> WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...</li>
<li><a href="https://github.com/netty/netty/commit/1b6ea48c89a32f36edbc717861580bc563389b63"><code>1b6ea48</code></a> HTTP3: Correctly handle ":authority" and "host" headers</li>
<li><a href="https://github.com/netty/netty/commit/3630659c817e848e4cc4f11703dc36adc80d537a"><code>3630659</code></a> STOMP codec content-length long-to-int truncation causes infinite decode loop...</li>
<li>Additional commits viewable in <a href="https://github.com/netty/netty/compare/netty-4.2.17.Final...netty-4.2.18.Final">compare view</a></li>
</ul>
</details>
<br />
Updates `io.netty:netty-handler` from 4.2.17.Final to 4.2.18.Final
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/netty/netty/releases">io.netty:netty-handler's releases</a>.</em></p>
<blockquote>
<h2>netty-4.2.18.Final</h2>
<h2>Security fixes</h2>
<ul>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-rmcw-9fcq-wjq7">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code> (SPDY)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-pvjx-v7vp-62vq">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-8352-h356-c9qh">CVE-2026-XXXXX</a> : denial of service vector in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jj3c-mwvr-9g52">CVE-2026-XXXXX</a> : improper certificate validation in <code>io.netty:netty-handler-ssl-ocsp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-ghg5-c4jg-8q5j">CVE-2026-XXXXX</a> : memory leak in <code>io.netty:netty-codec-stomp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-q9pg-8h3j-8hvm">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hmf3-49g9-g7qq">CVE-2026-XXXXX</a> : denial of service vector in <code>io.netty:netty-codec-stomp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-wxrh-4rgq-pjcg">CVE-2026-XXXXX</a> : parser desync/response smuggling in <code>io.netty:netty-codec-memcache</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-495p-pchh-r4mc">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-v5p2-hmgx-3xrx">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-f64r-x647-cg8w">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-pq4x-537v-r54q">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-smtp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-j58c-g352-8h4p">CVE-2026-XXXXX</a> : memory leak in <code>io.netty:netty-codec-haproxy</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-h75q-xqrh-59rf">CVE-2026-XXXXX</a> : request smuggling in <code>io.netty:netty-codec-http</code> (RTSP)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-rq4j-fc47-9698">CVE-2026-XXXXX</a> : request smuggling in <code>io.netty:netty-codec-http</code> (HTTP/1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jgph-cgq3-c627">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code> (HTTP/1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hfr2-x62w-v49h">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code> and in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-mj35-3qqm-q387">CVE-2026-XXXXX</a> : improper hostname verification in <code>io.netty:netty-codec-classes-quic</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-r4xx-7fpg-j8xg">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-redis</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-3jrc-fchc-59pw">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-j4mg-hqgv-34qc">CVE-2026-XXXXX</a> : request smuggling vector in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jqf3-r9ww-c5x8">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-mqtt</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-5vh9-c45f-rf7p">CVE-2026-XXXXX</a> : improper CRLF neutralization in <code>io.netty:netty-codec-smtp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jhjp-5q4f-8wr2">CVE-2026-XXXXX</a> : improper certificate validation in <code>io.netty:netty-handler-ssl-ocsp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-8whp-c7w8-2m72">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
</ul>
<h2>Compatibility Notes</h2>
<p>A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.</p>
<p>Two specific changes are worth calling out:</p>
<p><strong>QUIC now explicitly requires <code>X509ExtendedTrustManager</code> when hostname verification is enabled.</strong>
Previously, when configuring QUIC with an endpoint identification algorithm and an <code>X509TrustManager</code>, hostname verification would be silently skipped.
This is now considered a misconfiguration and an exception will be thrown.</p>
<p><strong>HTTP/2 header <em>value</em> validation is now enabled by default.</strong>
HTTP/2 header <em>name</em> validation has always been enabled by default, with an option to disable it, but HTTP/2 header <em>value</em> validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.</p>
<h2>What's Changed</h2>
<ul>
<li>Use X509ExtendedTrustManager in SSLErrorTest by <a href="https://github.com/normanmaurer"><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17221">netty/netty#17221</a></li>
<li>Update setup-testlens to v1.9.4 by <a href="https://github.com/marcphilipp"><code>@marcphilipp</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17223">netty/netty#17223</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/netty/netty/commit/2521f494432e27415a567d3a81a9eb907abf20b3"><code>2521f49</code></a> [maven-release-plugin] prepare release netty-4.2.18.Final</li>
<li><a href="https://github.com/netty/netty/commit/6fd53272cbce5c461b8b4e15101687fedce30fd7"><code>6fd5327</code></a> HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...</li>
<li><a href="https://github.com/netty/netty/commit/c44a052228bc4e5aa816686a6628410f037dad7c"><code>c44a052</code></a> SPDY: SpdySessionHandler must limit the concurrent streams</li>
<li><a href="https://github.com/netty/netty/commit/374d965d6f7f63318adcddbb474c0d5198bfaa53"><code>374d965</code></a> HTTP: Limit the maximum number of concurrent pipelined requests</li>
<li><a href="https://github.com/netty/netty/commit/7e8b325cd2d5dc04eaa5a0c13ebfec173b9bedf7"><code>7e8b325</code></a> HTTP/2: Limit HPACK encoding table size</li>
<li><a href="https://github.com/netty/netty/commit/e3ebf70348918febe7cda9bfa1c0ee040a157c07"><code>e3ebf70</code></a> OCSP: Correctly handle that <code>nextUpdate</code> is optional</li>
<li><a href="https://github.com/netty/netty/commit/5388535e1d0c285b6081f53c054bee0e6536a610"><code>5388535</code></a> STOMP: Correctly release partial content on handler removal</li>
<li><a href="https://github.com/netty/netty/commit/3a80f5a3b1f3fdc14e5269c27aac0d67075db245"><code>3a80f5a</code></a> WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...</li>
<li><a href="https://github.com/netty/netty/commit/1b6ea48c89a32f36edbc717861580bc563389b63"><code>1b6ea48</code></a> HTTP3: Correctly handle ":authority" and "host" headers</li>
<li><a href="https://github.com/netty/netty/commit/3630659c817e848e4cc4f11703dc36adc80d537a"><code>3630659</code></a> STOMP codec content-length long-to-int truncation causes infinite decode loop...</li>
<li>Additional commits viewable in <a href="https://github.com/netty/netty/compare/netty-4.2.17.Final...netty-4.2.18.Final">compare view</a></li>
</ul>
</details>
<br />
Updates `io.netty:netty-codec` from 4.2.17.Final to 4.2.18.Final
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/netty/netty/releases">io.netty:netty-codec's releases</a>.</em></p>
<blockquote>
<h2>netty-4.2.18.Final</h2>
<h2>Security fixes</h2>
<ul>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-rmcw-9fcq-wjq7">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code> (SPDY)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-pvjx-v7vp-62vq">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-8352-h356-c9qh">CVE-2026-XXXXX</a> : denial of service vector in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jj3c-mwvr-9g52">CVE-2026-XXXXX</a> : improper certificate validation in <code>io.netty:netty-handler-ssl-ocsp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-ghg5-c4jg-8q5j">CVE-2026-XXXXX</a> : memory leak in <code>io.netty:netty-codec-stomp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-q9pg-8h3j-8hvm">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hmf3-49g9-g7qq">CVE-2026-XXXXX</a> : denial of service vector in <code>io.netty:netty-codec-stomp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-wxrh-4rgq-pjcg">CVE-2026-XXXXX</a> : parser desync/response smuggling in <code>io.netty:netty-codec-memcache</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-495p-pchh-r4mc">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-v5p2-hmgx-3xrx">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-f64r-x647-cg8w">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-pq4x-537v-r54q">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-smtp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-j58c-g352-8h4p">CVE-2026-XXXXX</a> : memory leak in <code>io.netty:netty-codec-haproxy</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-h75q-xqrh-59rf">CVE-2026-XXXXX</a> : request smuggling in <code>io.netty:netty-codec-http</code> (RTSP)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-rq4j-fc47-9698">CVE-2026-XXXXX</a> : request smuggling in <code>io.netty:netty-codec-http</code> (HTTP/1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jgph-cgq3-c627">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code> (HTTP/1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hfr2-x62w-v49h">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code> and in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-mj35-3qqm-q387">CVE-2026-XXXXX</a> : improper hostname verification in <code>io.netty:netty-codec-classes-quic</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-r4xx-7fpg-j8xg">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-redis</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-3jrc-fchc-59pw">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-j4mg-hqgv-34qc">CVE-2026-XXXXX</a> : request smuggling vector in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jqf3-r9ww-c5x8">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-mqtt</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-5vh9-c45f-rf7p">CVE-2026-XXXXX</a> : improper CRLF neutralization in <code>io.netty:netty-codec-smtp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jhjp-5q4f-8wr2">CVE-2026-XXXXX</a> : improper certificate validation in <code>io.netty:netty-handler-ssl-ocsp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-8whp-c7w8-2m72">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
</ul>
<h2>Compatibility Notes</h2>
<p>A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.</p>
<p>Two specific changes are worth calling out:</p>
<p><strong>QUIC now explicitly requires <code>X509ExtendedTrustManager</code> when hostname verification is enabled.</strong>
Previously, when configuring QUIC with an endpoint identification algorithm and an <code>X509TrustManager</code>, hostname verification would be silently skipped.
This is now considered a misconfiguration and an exception will be thrown.</p>
<p><strong>HTTP/2 header <em>value</em> validation is now enabled by default.</strong>
HTTP/2 header <em>name</em> validation has always been enabled by default, with an option to disable it, but HTTP/2 header <em>value</em> validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.</p>
<h2>What's Changed</h2>
<ul>
<li>Use X509ExtendedTrustManager in SSLErrorTest by <a href="https://github.com/normanmaurer"><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17221">netty/netty#17221</a></li>
<li>Update setup-testlens to v1.9.4 by <a href="https://github.com/marcphilipp"><code>@marcphilipp</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17223">netty/netty#17223</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/netty/netty/commit/2521f494432e27415a567d3a81a9eb907abf20b3"><code>2521f49</code></a> [maven-release-plugin] prepare release netty-4.2.18.Final</li>
<li><a href="https://github.com/netty/netty/commit/6fd53272cbce5c461b8b4e15101687fedce30fd7"><code>6fd5327</code></a> HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...</li>
<li><a href="https://github.com/netty/netty/commit/c44a052228bc4e5aa816686a6628410f037dad7c"><code>c44a052</code></a> SPDY: SpdySessionHandler must limit the concurrent streams</li>
<li><a href="https://github.com/netty/netty/commit/374d965d6f7f63318adcddbb474c0d5198bfaa53"><code>374d965</code></a> HTTP: Limit the maximum number of concurrent pipelined requests</li>
<li><a href="https://github.com/netty/netty/commit/7e8b325cd2d5dc04eaa5a0c13ebfec173b9bedf7"><code>7e8b325</code></a> HTTP/2: Limit HPACK encoding table size</li>
<li><a href="https://github.com/netty/netty/commit/e3ebf70348918febe7cda9bfa1c0ee040a157c07"><code>e3ebf70</code></a> OCSP: Correctly handle that <code>nextUpdate</code> is optional</li>
<li><a href="https://github.com/netty/netty/commit/5388535e1d0c285b6081f53c054bee0e6536a610"><code>5388535</code></a> STOMP: Correctly release partial content on handler removal</li>
<li><a href="https://github.com/netty/netty/commit/3a80f5a3b1f3fdc14e5269c27aac0d67075db245"><code>3a80f5a</code></a> WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...</li>
<li><a href="https://github.com/netty/netty/commit/1b6ea48c89a32f36edbc717861580bc563389b63"><code>1b6ea48</code></a> HTTP3: Correctly handle ":authority" and "host" headers</li>
<li><a href="https://github.com/netty/netty/commit/3630659c817e848e4cc4f11703dc36adc80d537a"><code>3630659</code></a> STOMP codec content-length long-to-int truncation causes infinite decode loop...</li>
<li>Additional commits viewable in <a href="https://github.com/netty/netty/compare/netty-4.2.17.Final...netty-4.2.18.Final">compare view</a></li>
</ul>
</details>
<br />
Updates `io.netty:netty-resolver-dns-native-macos` from 4.2.17.Final to 4.2.18.Final
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/netty/netty/releases">io.netty:netty-resolver-dns-native-macos's releases</a>.</em></p>
<blockquote>
<h2>netty-4.2.18.Final</h2>
<h2>Security fixes</h2>
<ul>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-rmcw-9fcq-wjq7">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code> (SPDY)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-pvjx-v7vp-62vq">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-8352-h356-c9qh">CVE-2026-XXXXX</a> : denial of service vector in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jj3c-mwvr-9g52">CVE-2026-XXXXX</a> : improper certificate validation in <code>io.netty:netty-handler-ssl-ocsp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-ghg5-c4jg-8q5j">CVE-2026-XXXXX</a> : memory leak in <code>io.netty:netty-codec-stomp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-q9pg-8h3j-8hvm">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hmf3-49g9-g7qq">CVE-2026-XXXXX</a> : denial of service vector in <code>io.netty:netty-codec-stomp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-wxrh-4rgq-pjcg">CVE-2026-XXXXX</a> : parser desync/response smuggling in <code>io.netty:netty-codec-memcache</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-495p-pchh-r4mc">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-v5p2-hmgx-3xrx">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-f64r-x647-cg8w">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-pq4x-537v-r54q">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-smtp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-j58c-g352-8h4p">CVE-2026-XXXXX</a> : memory leak in <code>io.netty:netty-codec-haproxy</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-h75q-xqrh-59rf">CVE-2026-XXXXX</a> : request smuggling in <code>io.netty:netty-codec-http</code> (RTSP)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-rq4j-fc47-9698">CVE-2026-XXXXX</a> : request smuggling in <code>io.netty:netty-codec-http</code> (HTTP/1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jgph-cgq3-c627">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code> (HTTP/1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hfr2-x62w-v49h">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code> and in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-mj35-3qqm-q387">CVE-2026-XXXXX</a> : improper hostname verification in <code>io.netty:netty-codec-classes-quic</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-r4xx-7fpg-j8xg">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-redis</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-3jrc-fchc-59pw">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-j4mg-hqgv-34qc">CVE-2026-XXXXX</a> : request smuggling vector in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jqf3-r9ww-c5x8">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-mqtt</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-5vh9-c45f-rf7p">CVE-2026-XXXXX</a> : improper CRLF neutralization in <code>io.netty:netty-codec-smtp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jhjp-5q4f-8wr2">CVE-2026-XXXXX</a> : improper certificate validation in <code>io.netty:netty-handler-ssl-ocsp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-8whp-c7w8-2m72">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
</ul>
<h2>Compatibility Notes</h2>
<p>A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.</p>
<p>Two specific changes are worth calling out:</p>
<p><strong>QUIC now explicitly requires <code>X509ExtendedTrustManager</code> when hostname verification is enabled.</strong>
Previously, when configuring QUIC with an endpoint identification algorithm and an <code>X509TrustManager</code>, hostname verification would be silently skipped.
This is now considered a misconfiguration and an exception will be thrown.</p>
<p><strong>HTTP/2 header <em>value</em> validation is now enabled by default.</strong>
HTTP/2 header <em>name</em> validation has always been enabled by default, with an option to disable it, but HTTP/2 header <em>value</em> validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.</p>
<h2>What's Changed</h2>
<ul>
<li>Use X509ExtendedTrustManager in SSLErrorTest by <a href="https://github.com/normanmaurer"><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17221">netty/netty#17221</a></li>
<li>Update setup-testlens to v1.9.4 by <a href="https://github.com/marcphilipp"><code>@marcphilipp</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17223">netty/netty#17223</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/netty/netty/commit/2521f494432e27415a567d3a81a9eb907abf20b3"><code>2521f49</code></a> [maven-release-plugin] prepare release netty-4.2.18.Final</li>
<li><a href="https://github.com/netty/netty/commit/6fd53272cbce5c461b8b4e15101687fedce30fd7"><code>6fd5327</code></a> HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...</li>
<li><a href="https://github.com/netty/netty/commit/c44a052228bc4e5aa816686a6628410f037dad7c"><code>c44a052</code></a> SPDY: SpdySessionHandler must limit the concurrent streams</li>
<li><a href="https://github.com/netty/netty/commit/374d965d6f7f63318adcddbb474c0d5198bfaa53"><code>374d965</code></a> HTTP: Limit the maximum number of concurrent pipelined requests</li>
<li><a href="https://github.com/netty/netty/commit/7e8b325cd2d5dc04eaa5a0c13ebfec173b9bedf7"><code>7e8b325</code></a> HTTP/2: Limit HPACK encoding table size</li>
<li><a href="https://github.com/netty/netty/commit/e3ebf70348918febe7cda9bfa1c0ee040a157c07"><code>e3ebf70</code></a> OCSP: Correctly handle that <code>nextUpdate</code> is optional</li>
<li><a href="https://github.com/netty/netty/commit/5388535e1d0c285b6081f53c054bee0e6536a610"><code>5388535</code></a> STOMP: Correctly release partial content on handler removal</li>
<li><a href="https://github.com/netty/netty/commit/3a80f5a3b1f3fdc14e5269c27aac0d67075db245"><code>3a80f5a</code></a> WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...</li>
<li><a href="https://github.com/netty/netty/commit/1b6ea48c89a32f36edbc717861580bc563389b63"><code>1b6ea48</code></a> HTTP3: Correctly handle ":authority" and "host" headers</li>
<li><a href="https://github.com/netty/netty/commit/3630659c817e848e4cc4f11703dc36adc80d537a"><code>3630659</code></a> STOMP codec content-length long-to-int truncation causes infinite decode loop...</li>
<li>Additional commits viewable in <a href="https://github.com/netty/netty/compare/netty-4.2.17.Final...netty-4.2.18.Final">compare view</a></li>
</ul>
</details>
<br />
Updates `io.netty:netty-transport` from 4.2.17.Final to 4.2.18.Final
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/netty/netty/releases">io.netty:netty-transport's releases</a>.</em></p>
<blockquote>
<h2>netty-4.2.18.Final</h2>
<h2>Security fixes</h2>
<ul>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-rmcw-9fcq-wjq7">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code> (SPDY)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-pvjx-v7vp-62vq">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-8352-h356-c9qh">CVE-2026-XXXXX</a> : denial of service vector in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jj3c-mwvr-9g52">CVE-2026-XXXXX</a> : improper certificate validation in <code>io.netty:netty-handler-ssl-ocsp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-ghg5-c4jg-8q5j">CVE-2026-XXXXX</a> : memory leak in <code>io.netty:netty-codec-stomp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-q9pg-8h3j-8hvm">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hmf3-49g9-g7qq">CVE-2026-XXXXX</a> : denial of service vector in <code>io.netty:netty-codec-stomp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-wxrh-4rgq-pjcg">CVE-2026-XXXXX</a> : parser desync/response smuggling in <code>io.netty:netty-codec-memcache</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-495p-pchh-r4mc">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-v5p2-hmgx-3xrx">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-f64r-x647-cg8w">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-pq4x-537v-r54q">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-smtp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-j58c-g352-8h4p">CVE-2026-XXXXX</a> : memory leak in <code>io.netty:netty-codec-haproxy</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-h75q-xqrh-59rf">CVE-2026-XXXXX</a> : request smuggling in <code>io.netty:netty-codec-http</code> (RTSP)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-rq4j-fc47-9698">CVE-2026-XXXXX</a> : request smuggling in <code>io.netty:netty-codec-http</code> (HTTP/1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jgph-cgq3-c627">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code> (HTTP/1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hfr2-x62w-v49h">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code> and in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-mj35-3qqm-q387">CVE-2026-XXXXX</a> : improper hostname verification in <code>io.netty:netty-codec-classes-quic</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-r4xx-7fpg-j8xg">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-redis</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-3jrc-fchc-59pw">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-j4mg-hqgv-34qc">CVE-2026-XXXXX</a> : request smuggling vector in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jqf3-r9ww-c5x8">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-mqtt</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-5vh9-c45f-rf7p">CVE-2026-XXXXX</a> : improper CRLF neutralization in <code>io.netty:netty-codec-smtp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jhjp-5q4f-8wr2">CVE-2026-XXXXX</a> : improper certificate validation in <code>io.netty:netty-handler-ssl-ocsp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-8whp-c7w8-2m72">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
</ul>
<h2>Compatibility Notes</h2>
<p>A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.</p>
<p>Two specific changes are worth calling out:</p>
<p><strong>QUIC now explicitly requires <code>X509ExtendedTrustManager</code> when hostname verification is enabled.</strong>
Previously, when configuring QUIC with an endpoint identification algorithm and an <code>X509TrustManager</code>, hostname verification would be silently skipped.
This is now considered a misconfiguration and an exception will be thrown.</p>
<p><strong>HTTP/2 header <em>value</em> validation is now enabled by default.</strong>
HTTP/2 header <em>name</em> validation has always been enabled by default, with an option to disable it, but HTTP/2 header <em>value</em> validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.</p>
<h2>What's Changed</h2>
<ul>
<li>Use X509ExtendedTrustManager in SSLErrorTest by <a href="https://github.com/normanmaurer"><code>@normanmaurer</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17221">netty/netty#17221</a></li>
<li>Update setup-testlens to v1.9.4 by <a href="https://github.com/marcphilipp"><code>@marcphilipp</code></a> in <a href="https://redirect.github.com/netty/netty/pull/17223">netty/netty#17223</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/netty/netty/commit/2521f494432e27415a567d3a81a9eb907abf20b3"><code>2521f49</code></a> [maven-release-plugin] prepare release netty-4.2.18.Final</li>
<li><a href="https://github.com/netty/netty/commit/6fd53272cbce5c461b8b4e15101687fedce30fd7"><code>6fd5327</code></a> HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...</li>
<li><a href="https://github.com/netty/netty/commit/c44a052228bc4e5aa816686a6628410f037dad7c"><code>c44a052</code></a> SPDY: SpdySessionHandler must limit the concurrent streams</li>
<li><a href="https://github.com/netty/netty/commit/374d965d6f7f63318adcddbb474c0d5198bfaa53"><code>374d965</code></a> HTTP: Limit the maximum number of concurrent pipelined requests</li>
<li><a href="https://github.com/netty/netty/commit/7e8b325cd2d5dc04eaa5a0c13ebfec173b9bedf7"><code>7e8b325</code></a> HTTP/2: Limit HPACK encoding table size</li>
<li><a href="https://github.com/netty/netty/commit/e3ebf70348918febe7cda9bfa1c0ee040a157c07"><code>e3ebf70</code></a> OCSP: Correctly handle that <code>nextUpdate</code> is optional</li>
<li><a href="https://github.com/netty/netty/commit/5388535e1d0c285b6081f53c054bee0e6536a610"><code>5388535</code></a> STOMP: Correctly release partial content on handler removal</li>
<li><a href="https://github.com/netty/netty/commit/3a80f5a3b1f3fdc14e5269c27aac0d67075db245"><code>3a80f5a</code></a> WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...</li>
<li><a href="https://github.com/netty/netty/commit/1b6ea48c89a32f36edbc717861580bc563389b63"><code>1b6ea48</code></a> HTTP3: Correctly handle ":authority" and "host" headers</li>
<li><a href="https://github.com/netty/netty/commit/3630659c817e848e4cc4f11703dc36adc80d537a"><code>3630659</code></a> STOMP codec content-length long-to-int truncation causes infinite decode loop...</li>
<li>Additional commits viewable in <a href="https://github.com/netty/netty/compare/netty-4.2.17.Final...netty-4.2.18.Final">compare view</a></li>
</ul>
</details>
<br />
Updates `io.netty:netty-handler` from 4.2.17.Final to 4.2.18.Final
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/netty/netty/releases">io.netty:netty-handler's releases</a>.</em></p>
<blockquote>
<h2>netty-4.2.18.Final</h2>
<h2>Security fixes</h2>
<ul>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-rmcw-9fcq-wjq7">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code> (SPDY)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-pvjx-v7vp-62vq">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-8352-h356-c9qh">CVE-2026-XXXXX</a> : denial of service vector in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jj3c-mwvr-9g52">CVE-2026-XXXXX</a> : improper certificate validation in <code>io.netty:netty-handler-ssl-ocsp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-ghg5-c4jg-8q5j">CVE-2026-XXXXX</a> : memory leak in <code>io.netty:netty-codec-stomp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-q9pg-8h3j-8hvm">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hmf3-49g9-g7qq">CVE-2026-XXXXX</a> : denial of service vector in <code>io.netty:netty-codec-stomp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-wxrh-4rgq-pjcg">CVE-2026-XXXXX</a> : parser desync/response smuggling in <code>io.netty:netty-codec-memcache</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-495p-pchh-r4mc">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-v5p2-hmgx-3xrx">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-f64r-x647-cg8w">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-pq4x-537v-r54q">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-smtp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-j58c-g352-8h4p">CVE-2026-XXXXX</a> : memory leak in <code>io.netty:netty-codec-haproxy</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-h75q-xqrh-59rf">CVE-2026-XXXXX</a> : request smuggling in <code>io.netty:netty-codec-http</code> (RTSP)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-rq4j-fc47-9698">CVE-2026-XXXXX</a> : request smuggling in <code>io.netty:netty-codec-http</code> (HTTP/1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jgph-cgq3-c627">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code> (HTTP/1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-hfr2-x62w-v49h">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http3</code> and in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-mj35-3qqm-q387">CVE-2026-XXXXX</a> : improper hostname verification in <code>io.netty:netty-codec-classes-quic</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-r4xx-7fpg-j8xg">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-redis</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-3jrc-fchc-59pw">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-j4mg-hqgv-34qc">CVE-2026-XXXXX</a> : request smuggling vector in <code>io.netty:netty-codec-http</code> (HTTP/1.1)</li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jqf3-r9ww-c5x8">CVE-2026-XXXXX</a> : unbounded resource usage in <code>io.netty:netty-codec-mqtt</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-5vh9-c45f-rf7p">CVE-2026-XXXXX</a> : improper CRLF neutralization in <code>io.netty:netty-codec-smtp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-jhjp-5q4f-8wr2">CVE-2026-XXXXX</a> : improper certificate validation in <code>io.netty:netty-handler-ssl-ocsp</code></li>
<li><a href="https://github.com/netty/netty/security/advisories/GHSA-8whp-c7w8-2m72">CVE-2026-XXXXX</a> : improper header validation in <code>io.netty:netty-codec-http2</code></li>
</ul>
<h2>Compatibility Notes</h2>
<p>A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.</p>
<p>Two specific changes are worth calling out:</p>
<p><strong>QUIC now explicitly requires <code>X509ExtendedTrustManager</code> when hostname verification is enabled.</strong>
Previously, when configuring QUIC with an endpoint identification algorithm and an <code>X509TrustManager</code>, hostname verification would be silently skipped.
This is now considered a misconfiguration and an exception will be thrown.</p>
<p><strong>HTTP/2 header <em>value</em> validation is now enabled by default.</strong>
HTTP/2 header <em>name</em> validation has always been enabled by default, with an option to disable it, but HTTP/2 header <em>value</em> validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.</p>
<h2>What's Changed</h2>
<ul>
<li>Use X509ExtendedTrustManager in SSLErrorTest by <a href="https://github.com/normanmaurer"><code>@norm...
_Description has been truncated_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore(deps): Bump the java group across 1 directory with 5 updates [iggy]
Posted by "hubcio (via GitHub)" <gi...@apache.org>.
hubcio merged PR #4267:
URL: https://github.com/apache/iggy/pull/4267
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] chore(deps): Bump the java group across 1 directory with 5 updates [iggy]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #4267:
URL: https://github.com/apache/iggy/pull/4267#issuecomment-5809944945
## [Codecov](https://app.codecov.io/gh/apache/iggy/pull/4267?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 87.65%. Comparing base ([`20d3237`](https://app.codecov.io/gh/apache/iggy/commit/20d3237935eafeb0eff72f1402ca7a0b1c7d2a65?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`1cf0279`](https://app.codecov.io/gh/apache/iggy/commit/1cf0279d69878d7e3d67fe1ea7c40d7a8047203c?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #4267 +/- ##
=========================================
Coverage 87.65% 87.65%
- Complexity 1575 1576 +1
=========================================
Files 1284 1284
Lines 225457 225457
Branches 188820 188820
=========================================
+ Hits 197625 197626 +1
+ Misses 23102 23101 -1
Partials 4730 4730
```
| [Components](https://app.codecov.io/gh/apache/iggy/pull/4267/components?src=pr&el=components&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [Rust Core](https://app.codecov.io/gh/apache/iggy/pull/4267/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `88.76% <ø> (ø)` | |
| [Java SDK](https://app.codecov.io/gh/apache/iggy/pull/4267/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `68.70% <ø> (+0.01%)` | :arrow_up: |
| [C# SDK](https://app.codecov.io/gh/apache/iggy/pull/4267/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `77.35% <ø> (ø)` | |
| [Python SDK](https://app.codecov.io/gh/apache/iggy/pull/4267/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `90.97% <ø> (ø)` | |
| [PHP SDK](https://app.codecov.io/gh/apache/iggy/pull/4267/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `85.67% <ø> (ø)` | |
| [Node SDK](https://app.codecov.io/gh/apache/iggy/pull/4267/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `96.36% <ø> (ø)` | |
| [Go SDK](https://app.codecov.io/gh/apache/iggy/pull/4267/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `70.05% <ø> (ø)` | |
[see 1 file with indirect coverage changes](https://app.codecov.io/gh/apache/iggy/pull/4267/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
</details>
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org