Repository navigation
Bump Netty to 4.1.135.Final to fix CVE-2026-45416 and CVE-2026-44249 - #1389
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
ezhang6811
approved these changes
Jun 10, 2026
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1389 +/- ##
=============================================
- Coverage 85.71% 59.35% -26.37%
- Complexity 19 1106 +1087
=============================================
Files 3 98 +95
Lines 49 6256 +6207
Branches 5 898 +893
=============================================
+ Hits 42 3713 +3671
- Misses 3 2232 +2229
- Partials 4 311 +307 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
srprash
approved these changes
Jun 10, 2026
2 tasks
wangzlei
added a commit
that referenced
this pull request
Jun 17, 2026
## Summary Cherry-pick 12 commits from `main` onto `release/v2.28.x` in preparation for the v2.28.2 release. ### Included commits (in cherry-pick order) - c6f8eaa Align CompactConsoleLogRecordExporter with OTLP backend schema (#1358) - ed1150c feat(di): add Dynamic Instrumentation (opt-in, default off) (#1384) - 6bb7a97 Bump Netty to 4.1.135.Final to fix CVE-2026-45416 and CVE-2026-44249 (#1389) - 0bb3540 ci(claude-review): dedupe findings across pushes and reduce noise (#1387) - d307352 fix(di): interrupt poller threads on stop and harden flaky concurrency test (#1388) - 78364c2 feat(serviceevents): add ServiceEvents instrumentation (#1386) - 81bb002 ci(claude-review): use runtime API for author check (#1390) - 513b153 refactor(debugger): remove unused instrumentation_name field from DI (#1391) - 80b12ce serviceevents: remove adaptive sampling, default to always, cap call_path (#1392) - e48f812 serviceevents: use comma delimiter for LATENCY_THRESHOLDS (match Python/JS) (#1393) - cbb1dd7 fix(serviceevents): replace Java 9+ APIs so the agent starts on Java 8 (#1394) - 0e62f0a fix: exclude DI's bundled ASM so instrumentation works on Java 25 (#1395) The post-release version-bump commit (`e2e859b`) is intentionally excluded; the `Pre-release: Update version to 2.28.2` commit will be added separately following the standard release workflow. ## Test plan - [ ] CI passes on the release branch - [ ] Verify CHANGELOG `Unreleased` section reflects the changes shipping in v2.28.2 --------- Co-authored-by: Miqueas Herrera <vherremi@amazon.com> Co-authored-by: Prashant Srivastava <50466688+srprash@users.noreply.github.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Steve Liu <liustve@amazon.com> Co-authored-by: Mohamed Asaker <asakem@amazon.com> Co-authored-by: Vastin <3690049+vastin@users.noreply.github.com> Co-authored-by: ADOT Patch workflow <adot-patch-workflow@github.com>
2 tasks
vastin
added a commit
that referenced
this pull request
Jun 26, 2026
## Summary - Bump `jackson-bom` from 2.21.1 → 2.21.4, fixing CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518 ([release notes](https://github.com/FasterXML/jackson-databind/blob/2.21/release-notes/VERSION-2.x)) - Suppress CVE-2026-54515 in trivyignore (no fix in 2.21.x yet — Trivy DB references 2.21.5 which has not been released) - Remove expired Netty CVE suppressions (already fixed by 4.1.135.Final bump in #1389) ## Test plan - [ ] PR build Trivy image scan passes - [ ] If Trivy still flags CVE-2026-54514 or CVE-2026-54517 (stale Trivy DB), add suppressions for those as well
wangzlei
pushed a commit
that referenced
this pull request
Aug 19, 2026
## Description of changes Bumps Netty from `4.1.136.Final` to `4.1.137.Final` to fix **CVE-2026-59903**. The Trivy image scan in `pr-build` currently fails on: | Library | Vulnerability | Severity | Installed | Fixed | |---|---|---|---|---| | `io.netty:netty-codec-http` | `CVE-2026-59903` | MEDIUM | 4.1.136.Final | 4.2.17.Final, **4.1.137.Final** | This blocks **every** PR, not any individual change, since the finding comes from a bundled dependency. It is currently the sole reason `all-pr-checks-pass` fails on open PRs (for example #1434, where the only failing step in `Build on ubuntu-latest` is "Perform image scan"). Bumping is preferred over a `trivyignore` suppression here because a patch release with the fix is already available, consistent with #1432 (4.1.136.Final), #1389 (4.1.135.Final), and #1374 (4.1.133.Final). ### Files changed - `dependencyManagement/build.gradle.kts` — `netty-bom` - `appsignals-tests/images/http-clients/netty-http-client/build.gradle.kts` — `netty-all` - `appsignals-tests/images/http-servers/netty-server/build.gradle.kts` — `netty-all` The two contract-test app pins are bumped alongside the BOM to keep them in sync, matching #1432. ## Test plan Verified locally before pushing: - `netty-bom`, `netty-all`, and `netty-codec-http` 4.1.137.Final are all published on Maven Central. - Gradle configuration succeeds (`:dependencyManagement:help` → `BUILD SUCCESSFUL`). - Dependency resolution confirms the new version takes effect, including upgrading transitives: ``` io.netty:netty-all:4.1.137.Final io.netty:netty-codec-http:4.1.137.Final io.netty:netty-codec-http:4.1.100.Final -> 4.1.137.Final (c) ``` CI provides the authoritative verification: the `pr-build` image scan should now pass, and the netty contract tests exercise the upgraded version. ## By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.
haneric00
pushed a commit
that referenced
this pull request
Aug 26, 2026
## Description of changes Bumps Netty from `4.1.136.Final` to `4.1.137.Final` to fix **CVE-2026-59903**. The Trivy image scan in `pr-build` currently fails on: | Library | Vulnerability | Severity | Installed | Fixed | |---|---|---|---|---| | `io.netty:netty-codec-http` | `CVE-2026-59903` | MEDIUM | 4.1.136.Final | 4.2.17.Final, **4.1.137.Final** | This blocks **every** PR, not any individual change, since the finding comes from a bundled dependency. It is currently the sole reason `all-pr-checks-pass` fails on open PRs (for example #1434, where the only failing step in `Build on ubuntu-latest` is "Perform image scan"). Bumping is preferred over a `trivyignore` suppression here because a patch release with the fix is already available, consistent with #1432 (4.1.136.Final), #1389 (4.1.135.Final), and #1374 (4.1.133.Final). ### Files changed - `dependencyManagement/build.gradle.kts` — `netty-bom` - `appsignals-tests/images/http-clients/netty-http-client/build.gradle.kts` — `netty-all` - `appsignals-tests/images/http-servers/netty-server/build.gradle.kts` — `netty-all` The two contract-test app pins are bumped alongside the BOM to keep them in sync, matching #1432. ## Test plan Verified locally before pushing: - `netty-bom`, `netty-all`, and `netty-codec-http` 4.1.137.Final are all published on Maven Central. - Gradle configuration succeeds (`:dependencyManagement:help` → `BUILD SUCCESSFUL`). - Dependency resolution confirms the new version takes effect, including upgrading transitives: ``` io.netty:netty-all:4.1.137.Final io.netty:netty-codec-http:4.1.137.Final io.netty:netty-codec-http:4.1.100.Final -> 4.1.137.Final (c) ``` CI provides the authoritative verification: the `pr-build` image scan should now pass, and the netty contract tests exercise the upgraded version. ## By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
io.netty:netty-bomto4.1.135.FinalindependencyManagement/build.gradle.ktsto fix CVE-2026-45416 and CVE-2026-44249.netty-server,netty-http-client) from4.1.94.Finalto4.1.135.Finalso the test fleet stays aligned with the BOM.