)]}'
{
  "commit": "617edd5ea5a96d413c71f34eff3534efa70e6fee",
  "tree": "99385d5960689acd94b43de5100828714255e808",
  "parents": [
    "e82ba4e939eeb962d86248131df1737b65c60564"
  ],
  "author": {
    "name": "dependabot[bot]",
    "email": "49699333+dependabot[bot]@users.noreply.github.com",
    "time": "Mon Oct 19 18:20:45 2026 +0200"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Mon Oct 19 18:20:45 2026 +0200"
  },
  "message": "MINOR: Bump io.netty:netty-bom from 4.2.17.Final to 4.2.19.Final (#1365)\n\nBumps [io.netty:netty-bom](https://github.com/netty/netty) from\n4.2.17.Final to 4.2.19.Final.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/netty/netty/releases\"\u003eio.netty:netty-bom\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003enetty-4.2.19.Final\u003c/h2\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eNote that \u003ca\nhref\u003d\"https://netty.io/news/2026/09/09/4-1-EOL-announcement.html\"\u003eNetty\n4.1 will be End-of-Life on July 1st, 2027\u003c/a\u003e.\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eWe strongly recommend upgrading to this version to get the following\nsecurity fixes:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/security/advisories/GHSA-frq3-7pw6-36cg\"\u003eCVE-2026-XXXXX\u003c/a\u003e\n: parser desync in \u003ccode\u003eio.netty:netty-codec-haproxy\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/security/advisories/GHSA-6g26-xhvx-g5w3\"\u003eCVE-2026-XXXXX\u003c/a\u003e\n: improper CRLF neutralization (request/response smuggling) in\n\u003ccode\u003eio.netty:netty-codec-http\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/security/advisories/GHSA-x9f7-rg73-4rp6\"\u003eCVE-2026-XXXXX\u003c/a\u003e\n: origin validation error in \u003ccode\u003eio.netty:netty-codec-http\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/security/advisories/GHSA-2p3h-phr9-jf38\"\u003eCVE-2026-XXXXX\u003c/a\u003e\n: unbounded resource consumption in\n\u003ccode\u003eio.netty:netty-codec-http2\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/security/advisories/GHSA-vwgc-hvc9-2j59\"\u003eCVE-2026-XXXXX\u003c/a\u003e\n: request/response smuggling in\n\u003ccode\u003eio.netty:netty-codec-http\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/security/advisories/GHSA-m3w2-2657-46g8\"\u003eCVE-2026-XXXXX\u003c/a\u003e\n: time-of-check/time-of-use error in\n\u003ccode\u003eio.netty:netty-handler-ssl-ocsp\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/security/advisories/GHSA-jp47-57pp-4qpp\"\u003eCVE-2026-XXXXX\u003c/a\u003e\n: SNI routing bypass in \u003ccode\u003eio.netty:netty-handler\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/security/advisories/GHSA-35qr-v9mm-35c5\"\u003eCVE-2026-XXXXX\u003c/a\u003e\n: unbounded resource consumption in\n\u003ccode\u003eio.netty:netty-codec-xml\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/security/advisories/GHSA-5h6f-wp3f-6hmv\"\u003eCVE-2026-XXXXX\u003c/a\u003e\n: unbounded resource consumption in\n\u003ccode\u003eio.netty:netty-codec-base\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/security/advisories/GHSA-x436-m93c-g2q9\"\u003eCVE-2026-XXXXX\u003c/a\u003e\n: unbounded resource consumption in\n\u003ccode\u003eio.netty:netty-codec-http\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/security/advisories/GHSA-c7hc-m259-xhcr\"\u003eCVE-2026-XXXXX\u003c/a\u003e\n: input misinterpretation in\n\u003ccode\u003eio.netty:netty-codec-socks\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/security/advisories/GHSA-268p-9r42-7qp4\"\u003eCVE-2026-XXXXX\u003c/a\u003e\n: improper access control in \u003ccode\u003eio.netty:netty-handler\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/security/advisories/GHSA-3h79-3wcf-5whr\"\u003eCVE-2026-XXXXX\u003c/a\u003e\n: unbounded resource consumption in\n\u003ccode\u003eio.netty:netty-codec-dns\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/security/advisories/GHSA-25w5-4jgp-m94q\"\u003eCVE-2026-XXXXX\u003c/a\u003e\n: unbounded resource consumption in\n\u003ccode\u003eio.netty:netty-codec-http3\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/security/advisories/GHSA-x2j7-6j3j-5vwj\"\u003eCVE-2026-XXXXX\u003c/a\u003e\n: use-after-free in\n\u003ccode\u003eio.netty:netty-transport-classes-io_uring\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/security/advisories/GHSA-79q2-mhf4-2j6j\"\u003eCVE-2026-XXXXX\u003c/a\u003e\n: memory leak in\n\u003ccode\u003eio.netty:netty-transport-native-io_uring\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eNote that due to overwhelming strain on the CVE infrastructure, we\nhave not gotten a single CVE number assigned to these reports in time\nfor our release.\nThe advisories will be published without.\u003c/p\u003e\n\u003cp\u003eSpecific changes worth calling out:\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eValidation in\n\u003ccode\u003eFileUpload.setContentType\u003c/code\u003e.\u003c/strong\u003e\nPreviously, the \u003ccode\u003eFileUpload.setContentType\u003c/code\u003e methods did not\nvalidate their inputs.\nThey now throw an \u003ccode\u003eIllegaalArgumentException\u003c/code\u003e if the given\nstring is not formatted as a plausible MIME content type.\u003c/p\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eperf: Use LinkedHashSet to deduplicate search domains by \u003ca\nhref\u003d\"https://github.com/JunggiKim\"\u003e\u003ccode\u003e@​JunggiKim\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/netty/netty/pull/17400\"\u003enetty/netty#17400\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eHandle non-positive skip lengths in ByteBufInputStream by \u003ca\nhref\u003d\"https://github.com/cuishuang\"\u003e\u003ccode\u003e@​cuishuang\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/netty/netty/pull/17388\"\u003enetty/netty#17388\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAvoid double promise allocation in SslHandler.wrap() by \u003ca\nhref\u003d\"https://github.com/doom369\"\u003e\u003ccode\u003e@​doom369\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/netty/netty/pull/17382\"\u003enetty/netty#17382\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSocket: Add half-closure tests to SocketHalfClosedTest by \u003ca\nhref\u003d\"https://github.com/rajan-github\"\u003e\u003ccode\u003e@​rajan-github\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/netty/netty/pull/17394\"\u003enetty/netty#17394\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eHttpUtil.getCharset() must accept whitespace before the next\nContent-Type parameter by \u003ca\nhref\u003d\"https://github.com/hunseonglee\"\u003e\u003ccode\u003e@​hunseonglee\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/netty/netty/pull/17386\"\u003enetty/netty#17386\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ecodec-dns: Add SMIMEA, CDS, CDNSKEY, OPENPGPKEY, CSYNC, ZONEMD\nrecords by \u003ca\nhref\u003d\"https://github.com/hyperxpro\"\u003e\u003ccode\u003e@​hyperxpro\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/netty/netty/pull/17373\"\u003enetty/netty#17373\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003etransport: Avoid io_uring completion callback allocation by \u003ca\nhref\u003d\"https://github.com/massiccio\"\u003e\u003ccode\u003e@​massiccio\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/netty/netty/pull/17457\"\u003enetty/netty#17457\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eQUIC: Ensure writable events reflect stream capacity by \u003ca\nhref\u003d\"https://github.com/yawkat\"\u003e\u003ccode\u003e@​yawkat\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/netty/netty/pull/17431\"\u003enetty/netty#17431\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eOcspServerCertificateValidatorTest: Fix possible leak in test by \u003ca\nhref\u003d\"https://github.com/normanmaurer\"\u003e\u003ccode\u003e@​normanmaurer\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/netty/netty/pull/17469\"\u003enetty/netty#17469\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUse github to download cmake and also remove tar file after\nunpacking by \u003ca\nhref\u003d\"https://github.com/normanmaurer\"\u003e\u003ccode\u003e@​normanmaurer\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/netty/netty/pull/17482\"\u003enetty/netty#17482\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild: Upgrade GitHub Actions to fix Node.js 20 deprecation warnings\nby \u003ca\nhref\u003d\"https://github.com/normanmaurer\"\u003e\u003ccode\u003e@​normanmaurer\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/netty/netty/pull/17484\"\u003enetty/netty#17484\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eHttpUtil.getMimeType() must not include whitespace before the next\nContent-Type parameter by \u003ca\nhref\u003d\"https://github.com/ohchanKyu\"\u003e\u003ccode\u003e@​ohchanKyu\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/netty/netty/pull/17456\"\u003enetty/netty#17456\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix buffer leak when recvmmsg returns single UDP_GRO batch by \u003ca\nhref\u003d\"https://github.com/octa-one\"\u003e\u003ccode\u003e@​octa-one\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/netty/netty/pull/17493\"\u003enetty/netty#17493\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eGuard ChunkedWriteHandler.doFlush() against re-entrant invocation\nfrom user code by \u003ca\nhref\u003d\"https://github.com/fudianchn\"\u003e\u003ccode\u003e@​fudianchn\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/netty/netty/pull/17438\"\u003enetty/netty#17438\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd regression test for close() cascade reentering flush() by \u003ca\nhref\u003d\"https://github.com/normanmaurer\"\u003e\u003ccode\u003e@​normanmaurer\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/netty/netty/pull/17497\"\u003enetty/netty#17497\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix UDP_GRO segment size is lost when reading with recvmmsg by \u003ca\nhref\u003d\"https://github.com/octa-one\"\u003e\u003ccode\u003e@​octa-one\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/netty/netty/pull/17492\"\u003enetty/netty#17492\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/commit/64cc10f38ea5f5bd7eae48507817c66680d0afdc\"\u003e\u003ccode\u003e64cc10f\u003c/code\u003e\u003c/a\u003e\n[maven-release-plugin] prepare release netty-4.2.19.Final\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/commit/e863e6965c44ec4d7a84e3edfec032b0dbd0fe75\"\u003e\u003ccode\u003ee863e69\u003c/code\u003e\u003c/a\u003e\nFix io_uring domain socket fd leak on multi-fd SCM_RIGHTS messages\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/commit/d82c6c34d38bbfaf3600ec61a608985e5e15bfb1\"\u003e\u003ccode\u003ed82c6c3\u003c/code\u003e\u003c/a\u003e\nFix IP allow-list bypass from ruleType-blind dedup in\nIpSubnetFilter\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/commit/bccc62a8c349119dded45df67f6688c3ae5d33b0\"\u003e\u003ccode\u003ebccc62a\u003c/code\u003e\u003c/a\u003e\nBound domain-name decode buffer to avoid quadratic allocation\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/commit/6b02cd33b27dcf02adc31df32a59b7e4ecdf2697\"\u003e\u003ccode\u003e6b02cd3\u003c/code\u003e\u003c/a\u003e\nFix wrong nextBid computation in IoUringBufferRing for\nRECVSEND_BUNDLE\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/commit/ef3a3e1d532f97a81bce4d6f34b570153796c6da\"\u003e\u003ccode\u003eef3a3e1\u003c/code\u003e\u003c/a\u003e\nFix sign-extension bug in SocksInitRequestDecoder NMETHODS field\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/commit/4cacdf08e48b36bb95af960d8adb94ce4923c1a1\"\u003e\u003ccode\u003e4cacdf0\u003c/code\u003e\u003c/a\u003e\nFix quadratic CPU usage in XmlFrameDecoder when an element is never\nbalanced\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/commit/20f3aaebd87b45569f59c3af9a7ef2a2f290379b\"\u003e\u003ccode\u003e20f3aae\u003c/code\u003e\u003c/a\u003e\nFail closed on zero-length handshake records in\nSslClientHelloHandler\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/commit/c3f7088e9b4b24e65a454ff6765c6fb8f3fc5df4\"\u003e\u003ccode\u003ec3f7088\u003c/code\u003e\u003c/a\u003e\nNetty OcspServerCertificateValidator still delivers buffered data from a\nrevo...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/netty/netty/commit/4029f071642e20ad6a290198eaca1832d183fa5e\"\u003e\u003ccode\u003e4029f07\u003c/code\u003e\u003c/a\u003e\nCorrectly handle multiple Content-Length\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/netty/netty/compare/netty-4.2.17.Final...netty-4.2.19.Final\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dio.netty:netty-bom\u0026package-manager\u003dmaven\u0026previous-version\u003d4.2.17.Final\u0026new-version\u003d4.2.19.Final)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "582889b689e893d565bc39426e6971b23ce8f017",
      "old_mode": 33188,
      "old_path": "pom.xml",
      "new_id": "bfecd505c7dd4b85e1c06f09a05cd8d6bab94f7e",
      "new_mode": 33188,
      "new_path": "pom.xml"
    }
  ]
}