Skip to content

Commit b37ee67

Browse files
ZachChubaZachChuba
authored
Upgrade netty to 4.1.127.Final
And netty-tcnative to 2.0.74.Final. Removes CVE-2025-58057 from security reports.
1 parent 7d5749f commit b37ee67

File tree

4 files changed

+32
-31
lines changed

4 files changed

+32
-31
lines changed

‎MODULE.bazel‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -23,20 +23,20 @@ IO_GRPC_GRPC_JAVA_ARTIFACTS = [
2323
"com.google.truth:truth:1.4.2",
2424
"com.squareup.okhttp:okhttp:2.7.5",
2525
"com.squareup.okio:okio:2.10.0", # 3.0+ needs swapping to -jvm; need work to avoid flag-day
26-
"io.netty:netty-buffer:4.1.124.Final",
27-
"io.netty:netty-codec-http2:4.1.124.Final",
28-
"io.netty:netty-codec-http:4.1.124.Final",
29-
"io.netty:netty-codec-socks:4.1.124.Final",
30-
"io.netty:netty-codec:4.1.124.Final",
31-
"io.netty:netty-common:4.1.124.Final",
32-
"io.netty:netty-handler-proxy:4.1.124.Final",
33-
"io.netty:netty-handler:4.1.124.Final",
34-
"io.netty:netty-resolver:4.1.124.Final",
35-
"io.netty:netty-tcnative-boringssl-static:2.0.70.Final",
36-
"io.netty:netty-tcnative-classes:2.0.70.Final",
37-
"io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.1.124.Final",
38-
"io.netty:netty-transport-native-unix-common:4.1.124.Final",
39-
"io.netty:netty-transport:4.1.124.Final",
26+
"io.netty:netty-buffer:4.1.127.Final",
27+
"io.netty:netty-codec-http2:4.1.127.Final",
28+
"io.netty:netty-codec-http:4.1.127.Final",
29+
"io.netty:netty-codec-socks:4.1.127.Final",
30+
"io.netty:netty-codec:4.1.127.Final",
31+
"io.netty:netty-common:4.1.127.Final",
32+
"io.netty:netty-handler-proxy:4.1.127.Final",
33+
"io.netty:netty-handler:4.1.127.Final",
34+
"io.netty:netty-resolver:4.1.127.Final",
35+
"io.netty:netty-tcnative-boringssl-static:2.0.74.Final",
36+
"io.netty:netty-tcnative-classes:2.0.74.Final",
37+
"io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.1.127.Final",
38+
"io.netty:netty-transport-native-unix-common:4.1.127.Final",
39+
"io.netty:netty-transport:4.1.127.Final",
4040
"io.opencensus:opencensus-api:0.31.0",
4141
"io.opencensus:opencensus-contrib-grpc-metrics:0.31.0",
4242
"io.perfmark:perfmark-api:0.27.0",

‎SECURITY.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -397,7 +397,8 @@ grpc-netty version | netty-handler version | netty-tcnative-boringssl-static ver
397397
1.60.x-1.66.x | 4.1.100.Final | 2.0.61.Final
398398
1.67.x-1.70.x | 4.1.110.Final | 2.0.65.Final
399399
1.71.x-1.74.x | 4.1.110.Final | 2.0.70.Final
400-
1.75.x- | 4.1.124.Final | 2.0.72.Final
400+
1.75.x-1.76.x | 4.1.124.Final | 2.0.72.Final
401+
1.77.x- | 4.1.127.Final | 2.0.74.Final
401402

402403
_(grpc-netty-shaded avoids issues with keeping these versions in sync.)_
403404

‎gradle/libs.versions.toml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[versions]
2-
netty = '4.1.124.Final'
2+
netty = '4.1.127.Final'
33
# Keep the following references of tcnative version in sync whenever it's updated:
44
# SECURITY.md
5-
nettytcnative = '2.0.72.Final'
5+
nettytcnative = '2.0.74.Final'
66
opencensus = "0.31.1"
77
# Not upgrading to 4.x as it is not yet ABI compatible.
88
# https://github.com/protocolbuffers/protobuf/issues/17247

‎repositories.bzl‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -27,20 +27,20 @@ IO_GRPC_GRPC_JAVA_ARTIFACTS = [
2727
"com.google.truth:truth:1.4.2",
2828
"com.squareup.okhttp:okhttp:2.7.5",
2929
"com.squareup.okio:okio:2.10.0", # 3.0+ needs swapping to -jvm; need work to avoid flag-day
30-
"io.netty:netty-buffer:4.1.124.Final",
31-
"io.netty:netty-codec-http2:4.1.124.Final",
32-
"io.netty:netty-codec-http:4.1.124.Final",
33-
"io.netty:netty-codec-socks:4.1.124.Final",
34-
"io.netty:netty-codec:4.1.124.Final",
35-
"io.netty:netty-common:4.1.124.Final",
36-
"io.netty:netty-handler-proxy:4.1.124.Final",
37-
"io.netty:netty-handler:4.1.124.Final",
38-
"io.netty:netty-resolver:4.1.124.Final",
39-
"io.netty:netty-tcnative-boringssl-static:2.0.70.Final",
40-
"io.netty:netty-tcnative-classes:2.0.70.Final",
41-
"io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.1.124.Final",
42-
"io.netty:netty-transport-native-unix-common:4.1.124.Final",
43-
"io.netty:netty-transport:4.1.124.Final",
30+
"io.netty:netty-buffer:4.1.127.Final",
31+
"io.netty:netty-codec-http2:4.1.127.Final",
32+
"io.netty:netty-codec-http:4.1.127.Final",
33+
"io.netty:netty-codec-socks:4.1.127.Final",
34+
"io.netty:netty-codec:4.1.127.Final",
35+
"io.netty:netty-common:4.1.127.Final",
36+
"io.netty:netty-handler-proxy:4.1.127.Final",
37+
"io.netty:netty-handler:4.1.127.Final",
38+
"io.netty:netty-resolver:4.1.127.Final",
39+
"io.netty:netty-tcnative-boringssl-static:2.0.74.Final",
40+
"io.netty:netty-tcnative-classes:2.0.74.Final",
41+
"io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.1.127.Final",
42+
"io.netty:netty-transport-native-unix-common:4.1.127.Final",
43+
"io.netty:netty-transport:4.1.127.Final",
4444
"io.opencensus:opencensus-api:0.31.0",
4545
"io.opencensus:opencensus-contrib-grpc-metrics:0.31.0",
4646
"io.perfmark:perfmark-api:0.27.0",

0 commit comments

Comments
 (0)