Skip to content

Commit 647f551

Browse files
fix(deps): bump io.netty minimum version to 4.2.16.Final
Resolves GHSA-q4f6-jm68-57ww (Dependabot alert #111): HttpContentEncoder unbounded per-connection queue growth via HTTP/1.1 pipelining in io.netty:netty-codec-http. Co-Authored-By: Catarina Pinheiro Correia <catarina.correia@getyourguide.com>
1 parent 850a009 commit 647f551

1 file changed

Lines changed: 5 additions & 4 deletions

File tree

build.gradle

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -49,13 +49,14 @@ subprojects {
4949
because('GHSA-rv64-5gf8-9qq8 / GHSA-x4m4-345f-5h5g / GHSA-24j9-x2wg-9qv6 / GHSA-gx5v-xp9w-j4cg: Apache Tomcat < 11.0.22 vulnerabilities')
5050
}
5151
if (requested.group == 'io.netty'
52-
&& requested.version != null && requested.version < '4.2.15.Final') {
53-
useVersion('4.2.15.Final')
52+
&& requested.version != null && requested.version < '4.2.16.Final') {
53+
useVersion('4.2.16.Final')
5454
because('GHSA-38f8-5428-x5cv: HTTP Request Smuggling in io.netty:netty-codec-http via malformed Transfer-Encoding headers; ' +
5555
'GHSA-3qp7-7mw8-wx86 / GHSA-c2rx-5r8w-8xr2 / GHSA-cmm3-54f8-px4j / GHSA-x4gw-5cx5-pgmh / GHSA-676x-f7gg-47vc / ' +
5656
'GHSA-5pvg-856g-cp85 / GHSA-4grm-h2qv-h6w6 / GHSA-c653-97m9-rcg9 / GHSA-563q-j3cm-6jxm / GHSA-hvcg-qmg6-jm4c / ' +
57-
'GHSA-cq4q-cv5g-r8q5 / GHSA-c2gf-v879-257j / GHSA-5x3r-wrvg-rp6q / GHSA-xmv7-r254-6q78 / GHSA-w573-9ffj-6ff9: ' +
58-
'multiple Netty vulnerabilities fixed in 4.2.15.Final')
57+
'GHSA-cq4q-cv5g-r8q5 / GHSA-c2gf-v879-257j / GHSA-5x3r-wrvg-rp6q / GHSA-xmv7-r254-6q78 / GHSA-w573-9ffj-6ff9 / ' +
58+
'GHSA-q4f6-jm68-57ww: multiple Netty vulnerabilities fixed in 4.2.16.Final ' +
59+
'(GHSA-q4f6-jm68-57ww: HttpContentEncoder unbounded per-connection queue growth via HTTP/1.1 pipelining)')
5960
}
6061
}
6162
}

0 commit comments

Comments
 (0)