chore(deps): bump the maven group across 11 directories with 5 updates

[dependabot]

Bumps the maven group with 5 updates in the / directory:

Package	From	To
org.apache.logging.log4j:log4j-core	2.25.3	2.25.4
org.apache.tomcat:tomcat-catalina	9.0.113	9.0.117
org.codehaus.plexus:plexus-utils	3.3.0	3.6.1
org.apache.spark:spark-core_2.12	3.5.0	3.5.7
io.netty:netty-codec-http	4.1.119.Final	4.1.132.Final

Bumps the maven group with 2 updates in the /component-runtime-beam directory: org.apache.logging.log4j:log4j-core and org.apache.tomcat:tomcat-catalina.
Bumps the maven group with 2 updates in the /component-runtime-impl directory: org.apache.logging.log4j:log4j-core and org.apache.tomcat:tomcat-catalina.
Bumps the maven group with 1 update in the /component-runtime-testing/component-runtime-http-junit directory: io.netty:netty-codec-http.
Bumps the maven group with 2 updates in the /component-starter-server directory: org.apache.logging.log4j:log4j-core and org.apache.tomcat:tomcat-catalina.
Bumps the maven group with 2 updates in the /component-tools directory: org.apache.logging.log4j:log4j-core and org.apache.tomcat:tomcat-catalina.
Bumps the maven group with 2 updates in the /component-tools-webapp directory: org.apache.logging.log4j:log4j-core and org.apache.tomcat:tomcat-catalina.
Bumps the maven group with 2 updates in the /documentation directory: org.apache.logging.log4j:log4j-core and org.apache.tomcat:tomcat-catalina.
Bumps the maven group with 2 updates in the /reporting directory: org.apache.logging.log4j:log4j-core and org.apache.tomcat:tomcat-catalina.
Bumps the maven group with 2 updates in the /talend-component-maven-plugin directory: org.apache.logging.log4j:log4j-core and org.apache.tomcat:tomcat-catalina.
Bumps the maven group with 2 updates in the /vault-client directory: org.apache.logging.log4j:log4j-core and org.apache.tomcat:tomcat-catalina.

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.codehaus.plexus:plexus-utils from 3.3.0 to 3.6.1

Release notes

Sourced from org.codehaus.plexus:plexus-utils's releases.

3.6.1

💥 Breaking changes

• Do not exclude ".gitignore" and ".cvsignore" by default (#326) (#327) @​kwin

🚀 New features and improvements

• Do not exclude ".gitignore" and ".cvsignore" by default (#326) (#327) @​kwin
• [3.x] Add Automatic-Module-Name manifest entry (#324) @​cstamas

🐛 Bug Fixes

• Fix Zip Slip vulnerability in archive extraction (#296) (#304) @​slachiewicz

👻 Maintenance

• Remove obsolete and time consuming Java 7 issue #51 regression test (#328) @​slachiewicz
• [3.x] Add license to POM (#325) @​cstamas
• Move to Site 2.0 descriptor (#306) @​slachiewicz
• JUnit Jupiter best practices & tests cleanups (#303) @​slachiewicz

📦 Dependency updates

• Bump org.codehaus.plexus:plexus from 24 to 25 (#310) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 23 to 24 (#298) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 22 to 23 (#293) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 21 to 22 (#290) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 20 to 21 (#287) @dependabot[bot]
• Bump org.codehaus.plexus:plexus from 19 to 20 (#286) @dependabot[bot]
• Bump jmhVersion from 1.36 to 1.37 (#285) @dependabot[bot]

3.6.0

What's Changed

• [3.x] Fix false difference detected with CachingOutputStream/CachingWriter when streams are flushed by @​gnodet in codehaus-plexus/plexus-utils#253
• V3 changes to make external usage easier by @​Claudenw in codehaus-plexus/plexus-utils#277
• Bump parent pom to 19 and reformat sources by @​slachiewicz in codehaus-plexus/plexus-utils#280
• Convert to JUnit 5 with OpenRewrite by @​slachiewicz in codehaus-plexus/plexus-utils#281
• sync pom changes from master branch by @​slachiewicz in codehaus-plexus/plexus-utils#282

Full Changelog: codehaus-plexus/plexus-utils@plexus-utils-3.5.1...plexus-utils-3.6.0

3.5.1

🚀 New features and improvements

• Reading and writing files using Java NIO (#232) @​mkarg

🐛 Bug Fixes

... (truncated)

Commits

• c61982e [maven-release-plugin] prepare release plexus-utils-3.6.1
• 0614f94 Remove obsolete and time consuming Java 7 issue #51 regression test
• e3ca715 Do not exclude ".gitignore" and ".cvsignore" by default (#326)
• b16a390 [3.x] Add license to POM (#325)
• 6270530 [3.x] Add Automatic-Module-Name manifest entry (#324)
• 5d37b07 Fix release-drafter v7 branch filtering (#323)
• 27ec2e6 Use filter-by-range instead of filter-by-commitish (#321)
• 3b8cfed Fix release-drafter for 3.x branch (#319)
• 4d25130 Bump org.codehaus.plexus:plexus from 24 to 25
• c76c5a4 Move to Site 2.0 descriptor
• Additional commits viewable in compare view

Updates org.apache.spark:spark-core_2.12 from 3.5.0 to 3.5.7

Updates io.netty:netty-codec-http from 4.1.119.Final to 4.1.132.Final

Release notes

Sourced from io.netty:netty-codec-http's releases.

netty-4.1.132.Final

Security

• CVE-2026-33871, HTTP/2 CONTINUATION Frame Flood Denial of Service
• CVE-2026-33870, HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

What's Changed

• Fix Incorrect nanos-to-millis conversion in epoll_wait EINTR retry lo… by @​normanmaurer in netty/netty#16248
• Make RefCntOpenSslContext.deallocate more robust (#16253) by @​normanmaurer in netty/netty#16257
• Update to gcc for arm 10.3-2021.07 (#16255) by @​normanmaurer in netty/netty#16263
• HTTP2: Correctly account for padding when decompress by @​normanmaurer in netty/netty#16265
• Update JDK versions to latest patch releases (#16254) by @​normanmaurer in netty/netty#16267
• Backport 4.1: Automatic backporting workflow from 4.1 to 4.2 by @​github-actions[bot] in netty/netty#16274
• Backport 4.1: Backport PRs must be created with personal access tokens by @​chrisvest in netty/netty#16277
• Backport 4.1: Add more porting workflows by @​netty-project-bot in netty/netty#16284
• Backport 4.1: Some polishing of the porting workflows by @​netty-project-bot in netty/netty#16292
• Backport 4.1: Fix high-order bit aliasing in HttpUtil.validateToken by @​netty-project-bot in netty/netty#16303
• Auto-port 4.1: Support more branch freedom for auto-porting by @​netty-project-bot in netty/netty#16310
• fix: the precedence of + is higher than >> (#16312) by @​chrisvest in netty/netty#16316
• AdaptiveByteBufAllocator: make sure byteBuf.capacity() not greater th… by @​chrisvest in netty/netty#16320
• Auto-port 4.1: Fix flaky PooledByteBufAllocatorTest by @​netty-project-bot in netty/netty#16324
• Auto-port 4.1: Fix pooled arena accounting tests by @​netty-project-bot in netty/netty#16326
• Auto-port 4.1: Fix RunInFastThreadLocalThreadExtension by @​netty-project-bot in netty/netty#16328
• Auto-port 4.1: AdaptivePoolingAllocator: call unreserveMatchingBuddy(...) if byteBuf initialization failed by @​netty-project-bot in netty/netty#16331
• Auto-port 4.1: Mark LoggingHandlerTest with @​Isolated to fix flaky build by @​netty-project-bot in netty/netty#16340
• Auto-port 4.1: Fix flaky HTTP/2 test by @​netty-project-bot in netty/netty#16348
• Auto-port 4.1: Fix flaky RenegotiateTest by @​netty-project-bot in netty/netty#16355
• Auto-port 4.1: Fix HTTP/2 push frame test by @​netty-project-bot in netty/netty#16353
• SSL test: Don't depend on property value in test (#16346) by @​normanmaurer in netty/netty#16362
• Auto-port 4.1: Don't assume CertificateFactory is thread-safe by @​netty-project-bot in netty/netty#16364
• AdaptivePoolingAllocator: assign a more explicit value to BuddyChunk.freeListCapacity (#16334) by @​chrisvest in netty/netty#16368
• Auto-port 4.1: Add more diagnostic points to PooledByteBufAllocatorTest.createNewThr… by @​netty-project-bot in netty/netty#16372
• Fix leak in SniHandlerTest (#16367) by @​normanmaurer in netty/netty#16377
• Auto-port 4.1: Stabilize AbstractByteBufTest.testBytesInArrayMultipleThreads by @​netty-project-bot in netty/netty#16373
• Remove reference counting from size classed chunks (#16306) by @​chrisvest in netty/netty#16379
• Auto-port 4.1: Stabilize AbstractByteBufTest.testToStringMultipleThreads by @​netty-project-bot in netty/netty#16384
• Fix HttpObjectAggregator leaving connection stuck after 413 with AUTO… by @​samlandfried in netty/netty#16280
• Auto-port 4.1: Fix autoport fetching into the existing branch - again by @​netty-project-bot in netty/netty#16417
• Auto-port 4.1: Capture why threads get stuck in testCopyMultipleThreads0 by @​netty-project-bot in netty/netty#16419
• Auto-port 4.1: Remove unnecessary array access in DefaultAttributeMap.orderedCopyOnInsert by @​netty-project-bot in netty/netty#16421
• Auto-port 4.1: Whitelist JMH annotation processing in microbench module by @​netty-project-bot in netty/netty#16430
• Auto-port 4.1: HTTP2: Ensure preface is flushed in all cases by @​netty-project-bot in netty/netty#16432
• Auto-port 4.1: Fix UnsupportedOperationException in readTrailingHeaders by @​netty-project-bot in netty/netty#16437
• Auto-port 4.1: Fix client_max_window_bits parameter handling in permessage-deflate extension by @​netty-project-bot in netty/netty#16435
• Auto-port 4.1: Native transports: Fix possible fd leak when fcntl fails. by @​netty-project-bot in netty/netty#16446
• Auto-port 4.1: Kqueue: Fix undefined behaviour when GetStringUTFChars fails and SO_ACCEPTFILTER is supported by @​netty-project-bot in netty/netty#16448
• Auto-port 4.1: Kqueue: Possible overflow when using netty_kqueue_bsdsocket_setAcceptFilter(...) by @​netty-project-bot in netty/netty#16459
• Auto-port 4.1: Native transports: Fix undefined behaviour when GetStringUTFChars fails while open FD by @​netty-project-bot in netty/netty#16456
• Auto-port 4.1: Epoll: Add null checks for safety reasons by @​netty-project-bot in netty/netty#16463
• Auto-port 4.1: DnsNameResolver: Skip test if we can not bind TCP and UDP to the same port by @​netty-project-bot in netty/netty#16464

... (truncated)

Commits

• ec119d4 [maven-release-plugin] prepare release netty-4.1.132.Final
• 60e53c9 Stricter HTTP/1.1 chunk extension parsing (#16537)
• 9f47a7b Limit the number of Continuation frames per HTTP2 Headers (#13969)
• 10c1603 Auto-port 4.1: JdkZlibDecoder: accumulate decompressed output before firing c...
• df65997 Epoll: setTcpMg5Sig(...) might overflow (#16511) (#16520)
• 692ec87 Auto-port 4.1: AdaptivePoolingAllocator: Fix assertion for size class multipl...
• 3ac3f37 Auto-port 4.1: AdaptivePoolingAllocator: remove ensureAccessible() call in ...
• 5a0072b Auto-port 4.1: Epoll: Fix support for IP_RECVORIGDSTADDR (#16468)
• 779fce7 Auto-port 4.1: Epoll: Use correct value to initialize mmsghdr.msg_namelen (#1...
• 56d84e1 Auto-port 4.1: DnsNameResolver: Skip test if we can not bind TCP and UDP to t...
• Additional commits viewable in compare view

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates io.netty:netty-codec-http from 4.1.119.Final to 4.1.132.Final

Release notes

Sourced from io.netty:netty-codec-http's releases.

netty-4.1.132.Final

Security

• CVE-2026-33871, HTTP/2 CONTINUATION Frame Flood Denial of Service
• CVE-2026-33870, HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

What's Changed

• Fix Incorrect nanos-to-millis conversion in epoll_wait EINTR retry lo… by @​normanmaurer in netty/netty#16248
• Make RefCntOpenSslContext.deallocate more robust (#16253) by @​normanmaurer in netty/netty#16257
• Update to gcc for arm 10.3-2021.07 (#16255) by @​normanmaurer in netty/netty#16263
• HTTP2: Correctly account for padding when decompress by @​normanmaurer in netty/netty#16265
• Update JDK versions to latest patch releases (#16254) by @​normanmaurer in netty/netty#16267
• Backport 4.1: Automatic backporting workflow from 4.1 to 4.2 by @​github-actions[bot] in netty/netty#16274
• Backport 4.1: Backport PRs must be created with personal access tokens by @​chrisvest in netty/netty#16277
• Backport 4.1: Add more porting workflows by @​netty-project-bot in netty/netty#16284
• Backport 4.1: Some polishing of the porting workflows by @​netty-project-bot in netty/netty#16292
• Backport 4.1: Fix high-order bit aliasing in HttpUtil.validateToken by @​netty-project-bot in netty/netty#16303
• Auto-port 4.1: Support more branch freedom for auto-porting by @​netty-project-bot in netty/netty#16310
• fix: the precedence of + is higher than >> (#16312) by @​chrisvest in netty/netty#16316
• AdaptiveByteBufAllocator: make sure byteBuf.capacity() not greater th… by @​chrisvest in netty/netty#16320
• Auto-port 4.1: Fix flaky PooledByteBufAllocatorTest by @​netty-project-bot in netty/netty#16324
• Auto-port 4.1: Fix pooled arena accounting tests by @​netty-project-bot in netty/netty#16326
• Auto-port 4.1: Fix RunInFastThreadLocalThreadExtension by @​netty-project-bot in netty/netty#16328
• Auto-port 4.1: AdaptivePoolingAllocator: call unreserveMatchingBuddy(...) if byteBuf initialization failed by @​netty-project-bot in netty/netty#16331
• Auto-port 4.1: Mark LoggingHandlerTest with @​Isolated to fix flaky build by @​netty-project-bot in netty/netty#16340
• Auto-port 4.1: Fix flaky HTTP/2 test by @​netty-project-bot in netty/netty#16348
• Auto-port 4.1: Fix flaky RenegotiateTest by @​netty-project-bot in netty/netty#16355
• Auto-port 4.1: Fix HTTP/2 push frame test by @​netty-project-bot in netty/netty#16353
• SSL test: Don't depend on property value in test (#16346) by @​normanmaurer in netty/netty#16362
• Auto-port 4.1: Don't assume CertificateFactory is thread-safe by @​netty-project-bot in netty/netty#16364
• AdaptivePoolingAllocator: assign a more explicit value to BuddyChunk.freeListCapacity (#16334) by @​chrisvest in netty/netty#16368
• Auto-port 4.1: Add more diagnostic points to PooledByteBufAllocatorTest.createNewThr… by @​netty-project-bot in netty/netty#16372
• Fix leak in SniHandlerTest (#16367) by @​normanmaurer in netty/netty#16377
• Auto-port 4.1: Stabilize AbstractByteBufTest.testBytesInArrayMultipleThreads by @​netty-project-bot in netty/netty#16373
• Remove reference counting from size classed chunks (#16306) by @​chrisvest in netty/netty#16379
• Auto-port 4.1: Stabilize AbstractByteBufTest.testToStringMultipleThreads by @​netty-project-bot in netty/netty#16384
• Fix HttpObjectAggregator leaving connection stuck after 413 with AUTO… by @​samlandfried in netty/netty#16280
• Auto-port 4.1: Fix autoport fetching into the existing branch - again by @​netty-project-bot in netty/netty#16417
• Auto-port 4.1: Capture why threads get stuck in testCopyMultipleThreads0 by @​netty-project-bot in netty/netty#16419
• Auto-port 4.1: Remove unnecessary array access in DefaultAttributeMap.orderedCopyOnInsert by @​netty-project-bot in netty/netty#16421
• Auto-port 4.1: Whitelist JMH annotation processing in microbench module by @​netty-project-bot in netty/netty#16430
• Auto-port 4.1: HTTP2: Ensure preface is flushed in all cases by @​netty-project-bot in netty/netty#16432
• Auto-port 4.1: Fix UnsupportedOperationException in readTrailingHeaders by @​netty-project-bot in netty/netty#16437
• Auto-port 4.1: Fix client_max_window_bits parameter handling in permessage-deflate extension by @​netty-project-bot in netty/netty#16435
• Auto-port 4.1: Native transports: Fix possible fd leak when fcntl fails. by @​netty-project-bot in netty/netty#16446
• Auto-port 4.1: Kqueue: Fix undefined behaviour when GetStringUTFChars fails and SO_ACCEPTFILTER is supported by @​netty-project-bot in netty/netty#16448
• Auto-port 4.1: Kqueue: Possible overflow when using netty_kqueue_bsdsocket_setAcceptFilter(...) by @​netty-project-bot in netty/netty#16459
• Auto-port 4.1: Native transports: Fix undefined behaviour when GetStringUTFChars fails while open FD by @​netty-project-bot in netty/netty#16456
• Auto-port 4.1: Epoll: Add null checks for safety reasons by @​netty-project-bot in netty/netty#16463
• Auto-port 4.1: DnsNameResolver: Skip test if we can not bind TCP and UDP to the same port by @​netty-project-bot in netty/netty#16464

... (truncated)

Commits

• ec119d4 [maven-release-plugin] prepare release netty-4.1.132.Final
• 60e53c9 Stricter HTTP/1.1 chunk extension parsing (#16537)
• 9f47a7b Limit the number of Continuation frames per HTTP2 Headers (#13969)
• 10c1603 Auto-port 4.1: JdkZlibDecoder: accumulate decompressed output before firing c...
• df65997 Epoll: setTcpMg5Sig(...) might overflow (#16511) (#16520)
• 692ec87 Auto-port 4.1: AdaptivePoolingAllocator: Fix assertion for size class multipl...
• 3ac3f37 Auto-port 4.1: AdaptivePoolingAllocator: remove ensureAccessible() call in ...
• 5a0072b Auto-port 4.1: Epoll: Fix support for IP_RECVORIGDSTADDR (#16468)
• 779fce7 Auto-port 4.1: Epoll: Use correct value to initialize mmsghdr.msg_namelen (#1...
• 56d84e1 Auto-port 4.1: DnsNameResolver: Skip test if we can not bind TCP and UDP to t...
• Additional commits viewable in compare view

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates org.apache.logging.log4j:log4j-core from 2.25.3 to 2.25.4

Updates org.apache.tomcat:tomcat-catalina from 9.0.113 to 9.0.117

Updates io.netty:netty-codec-http from 4.1.119.Final to 4.1.132.Final

Release notes

Sourced from io.netty:netty-codec-http's releases.

netty-4.1.132.Final

Security

• CVE-2026-33871, HTTP/2 CONTINUATION Frame Flood Denial of Service
• CVE-2026-33870, HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

What's Changed

• Fix Incorrect nanos-to-millis conversion in epoll_wait EINTR retry lo… by @​normanmaurer in netty/netty#16248
• Make RefCntOpenSslContext.deallocate more robust (#16253) by @​normanmaurer in netty/netty#16257
• Update to gcc for arm 10.3-2021.07 (#16255) by @​normanmaurer in netty/netty#16263
• HTTP2: Correctly account for padding when decompress by @​normanmaurer in netty/netty#16265
• Update JDK versions to latest patch releases (#16254) by @​normanmaurer in netty/netty#16267
• Backport 4.1: Automatic backporting workflow from 4.1 to 4.2 by @​github-actions[bot] in netty/netty#16274
• Backport 4.1: Backport PRs must be created with personal access tokens by @​chrisvest in netty/netty#16277
• Backport 4.1: Add more porting workflows by @​netty-project-bot in netty/netty#16284
• Backport 4.1: Some polishing of the porting workflows by @​netty-project-bot in netty/netty#16292
• Backport 4.1: Fix high-order bit aliasing in HttpUtil.validateToken by @​netty-project-bot in netty/netty#16303
• Auto-port 4.1: Support more branch freedom for auto-porting by @​netty-project-bot in netty/netty#16310
• fix: the precedence of + is higher than >> (#16312) by @​chrisvest in netty/netty#16316
• AdaptiveByteBufAllocator: make sure byteBuf.capacity() not greater th… by @​chrisvest in netty/netty#16320
• Auto-port 4.1: Fix flaky PooledByteBufAllocatorTest by @​netty-project-bot in netty/netty#16324
• Auto-port 4.1: Fix pooled arena accounting tests by @​netty-project-bot in netty/netty#16326
• Auto-port 4.1: Fix RunInFastThreadLocalThreadExtension by @​netty-project-bot in netty/netty#16328
• Auto-port 4.1: AdaptivePoolingAllocator: call unreserveMatchingBuddy(...) if byteBuf initialization failed by @​netty-project-bot in netty/netty#16331
• Auto-port 4.1: Mark LoggingHandlerTest with @​Isolated to fix flaky build by @​netty-project-bot in netty/netty#16340
• Auto-port 4.1: Fix flaky HTTP/2 test by @​netty-project-bot in netty/netty#16348
• Auto-port 4.1: Fix flaky RenegotiateTest by @​netty-project-bot in netty/netty#16355
• Auto-port 4.1: Fix HTTP/2 push frame test by @​netty-project-bot in netty/netty#16353
• SSL test: Don't depend on property value in test (#16346) by @​normanmaurer in netty/netty#16362
• Auto-port 4.1: Don't assume CertificateFactory is thread-safe by @​netty-project-bot in netty/netty#16364
• AdaptivePoolingAllocator: assign a more explicit value to BuddyChunk.freeListCapacity (#16334) by @​chrisvest in netty/netty#16368
• Auto-port 4.1: Add more diagnostic points to PooledByteBufAllocatorTest.createNewThr… by @​netty-project-bot in netty/netty#16372
• Fix leak in SniHandlerTest (#16367) by @​normanmaurer in netty/netty#16377
• Auto-port 4.1: Stabilize AbstractByteBufTest.testBytesInArrayMultipleThreads by @​netty-project-bot in netty/netty#16373
• Remove reference counting from size classed chunks (#16306) by @​chrisvest in netty/netty#16379
• Auto-port 4.1: Stabilize AbstractByteBufTest.testToStringMultipleThreads by @​netty-project-bot in netty/netty#16384
• Fix HttpObjectAggregator leaving connection stuck after 413 with AUTO… by @​samlandfried in netty/netty#16280
• Auto-port 4.1: Fix autoport fetching into the existing branch - again by @​netty-project-bot in netty/netty#16417
• Auto-port 4.1: Capture why threads get stuck in testCopyMultipleThreads0 by @​netty-project-bot in netty/netty#16419
• Auto-port 4.1: Remove unnecessary array access in DefaultAttributeMap.orderedCopyOnInsert by @​netty-project-bot in netty/netty#16421
• Auto-port 4.1: Whitelist JMH annotation processing in microbench module by @​netty-project-bot in netty/netty#16430
• Auto-port 4.1: HTTP2: Ensure preface is flushed in all cases by @​netty-project-bot in netty/netty#16432
• Auto-port 4.1: Fix UnsupportedOperationException in readTrailingHeaders by @​netty-project-bot in netty/netty#16437
• Auto-port 4.1: Fix client_max_window_bits parameter handling in permessage-deflate extension by @​netty-project-bot in netty/netty#16435
• Auto-port 4.1: Native transports: Fix possible fd leak when fcntl fails. by @​netty-project-bot in netty/netty#16446
• Auto-port 4.1: Kqueue: Fix undefined behaviour when GetStringUTFChars fails and SO_ACCEPTFILTER is supported by @​netty-project-bot in netty/netty#16448
• Auto-port 4.1: Kqueue: Possible overflow when using netty_kqueue_bsdsocket_setAcceptFilter(...) by @​netty-project-bot in netty/netty#16459
• Auto-port 4.1: Native transports: Fix undefined behaviour when GetStringUTFChars fails while open FD by @​netty-project-bot in netty/netty#16456
• Auto-port 4.1: Epoll: Add null checks for safety reasons by @​netty-project-bot in netty/netty#16463
• Auto-port 4.1: DnsNameResolver: Skip test if we can not bind TCP and UDP to the same port by @​netty-project-bot in netty/netty#16464

... (truncated)

Commits

• ec119d4 [maven-release-plugin] prepare release netty-4.1.132.Final
• 60e53c9 Stricter HTTP/1.1 chunk extension parsing (#16537)
• 9f47a7b Limit the number of Continuation frames per HTTP2 Headers (#13969)
• 10c1603 Auto-port 4.1: JdkZlibDecoder: accumulate decompressed output before firing c...
• df65997 Epoll: setTcpMg5Sig(...) might overflow (#16511) (#16520)
• 692ec87 Auto-port 4.1: AdaptivePoolingAllocator: Fix assertion for size class multipl...
• 3ac3f37 Auto-port 4.1: AdaptivePoolingAllocator: remove ensureAccessible() call in ...
• 5a0072b Auto-port 4.1: Epoll: Fix support for IP_RECVORIGDSTADDR (#16468)
• 779fce7 Auto-port 4.1: Epoll: Use correct value to initialize mmsghdr.msg_namelen (#1...
• 56d84e1 Auto-port 4.1: DnsNameResolver: Skip test if we can not bind TCP and UDP to t...
• Additional commits viewable in compare view

Updates io.netty:netty-codec-http from 4.1.119.Final to 4.1.132.Final

Release notes

Sourced from io.netty:netty-codec-http's releases.

netty-4.1.132.Final

Security

• CVE-2026-33871, HTTP/2 CONTINUATION Frame Flood Denial of Service
• CVE-2026-33870, HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

What's Changed

• Fix Incorrect nanos-to-millis conversion in epoll_wait EINTR retry lo… by @​normanmaurer in netty/netty#16248
• Make RefCntOpenSslContext.deallocate more robust (#16253) by @​normanmaurer in netty/netty#16257
• Update to gcc for arm 10.3-2021.07 (#16255) by @​normanmaurer in netty/netty#16263
• HTTP2: Correctly account for padding when decompress by @​normanmaurer in netty/netty#16265
• Update JDK versions to latest patch releases (#16254) by @​normanmaurer in netty/netty#16267
• Backport 4.1: Automatic backporting workflow from 4.1 to 4.2 by @​github-actions[bot] in netty/netty#16274
• Backport 4.1: Backport PRs must be created with personal access tokens by @​chrisvest in netty/netty#16277
• Backport 4.1: Add more porting workflows by @​netty-project-bot in netty/netty#16284
• Backport 4.1: Some polishing of the porting workflows by @​netty-project-bot in netty/netty#16292
• Backport 4.1: Fix high-order bit aliasing in HttpUtil.validateToken by @​netty-project-bot in netty/netty#16303
• Auto-port 4.1: Support more branch freedom for auto-porting by @​netty-project-bot in netty/netty#16310
• fix: the precedence of + is higher than >> (#16312) by @​chrisvest in netty/netty#16316
• AdaptiveByteBufAllocator: make sure byteBuf.capacity() not greater th… by @​chrisvest in netty/netty#16320
• Auto-port 4.1: Fix flaky PooledByteBufAllocatorTest by @​netty-project-bot in netty/netty#16324
• Auto-port 4.1: Fix pooled arena accounting tests by @​netty-project-bot in netty/netty#16326
• Auto-port 4.1: Fix RunInFastThreadLocalThreadExtension by @​netty-project-bot in netty/netty#16328
• Auto-port 4.1: AdaptivePoolingAllocator: call unreserveMatchingBuddy(...) if byteBuf initialization failed by @​netty-project-bot in netty/netty#16331
• Auto-port 4.1: Mark LoggingHandlerTest with @​Isolated to fix flaky build by @​netty-project-bot in netty/netty#16340
• Auto-port 4.1: Fix flaky HTTP/2 test by @​netty-project-bot in netty/netty#16348
• Auto-port 4.1: Fix flaky RenegotiateTest by @​netty-project-bot in netty/netty#16355
• Auto-port 4.1: Fix HTTP/2 push frame test by @​netty-project-bot in netty/netty#16353
• SSL test: Don't depend on property value in test (#16346) by @​normanmaurer in netty/netty#16362
• Auto-port 4.1: Don't assume CertificateFactory is thread-safe by @​netty-project-bot in netty/netty#16364
• AdaptivePoolingAllocator: assign a more explicit value to BuddyChunk.freeListCapacity (#16334) by @​chrisvest in netty/netty#16368
• Auto-port 4.1: Add more diagnostic points to PooledByteBufAllocatorTest.createNewThr… by @​netty-project-bot in netty/netty#16372
• Fix leak in SniHandlerTest (...

  Description has been truncated

[dependabot]

Superseded by #1211.