Skip to content

Commit ba0e5be

Browse files
authored
Bump nettyVersion to 4.2.16.Final (#1455)
Fixes CVE-2026-44891, CVE-2026-55831, CVE-2026-55833 flagged in TeamCity build LabKey_267Release_Premium_GitExtraPostgres/4106377. ## Rationale TeamCity build LabKey_267Release_Premium_GitExtraPostgres/4106377 flagged netty-buffer 4.2.15.Final for CVE-2026-44891, CVE-2026-55831, and CVE-2026-55833 (all HIGH, CVSS 7.5). Fixed upstream in netty 4.2.16.Final. ## Related Pull Requests - <!-- list of links to related pull requests (replace this comment) --> ## Changes - Bump `nettyVersion` from 4.2.15.Final to 4.2.16.Final in `gradle.properties` - OWASP dependency-check build run locally, confirmed clean <!-- list of standard tasks (remove this comment to enable) ## Tasks 📍 - [ ] Claude Code Review - [ ] Manual Testing - [ ] Test Automation - [ ] Verify Fix -->
1 parent d58fda7 commit ba0e5be

1 file changed

Lines changed: 2 additions & 2 deletions

File tree

gradle.properties

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -260,8 +260,8 @@ microsoftGraphVersion=6.65.0
260260

261261
mssqlJdbcVersion=13.4.0.jre11
262262

263-
# Netty - transitive dependency via azure-core-http-netty; force for CVE-2026-33871, CVE-2026-33870, plus CVE-2026-45674 and CVE-2026-47691 (and 20 related) fixed in 4.2.15.Final
264-
nettyVersion=4.2.15.Final
263+
# Netty - transitive dependency via azure-core-http-netty; force for CVE-2026-33871, CVE-2026-33870, CVE-2026-45674, CVE-2026-47691 (and 20 related) fixed in 4.2.15.Final, plus CVE-2026-44891, CVE-2026-55831, CVE-2026-55833 fixed in 4.2.16.Final
264+
nettyVersion=4.2.16.Final
265265
# Reactor - transitive dependency via azure-core; force for version consistency across modules
266266
reactorCoreVersion=3.8.1
267267

0 commit comments

Comments
 (0)