From f240a08b11a1e8415a9da99ecd0c8a62b37bab4f Mon Sep 17 00:00:00 2001 From: NianJiuZst <3235467914@qq.com> Date: Sat, 5 Sep 2026 00:14:07 +0800 Subject: [PATCH] Upgrade Netty to 4.2.17 Update the Gradle and Bazel dependency declarations to the first Netty 4.2 release patched for CVE-2026-75596. Keep netty-tcnative at the 2.0.81 version used by Netty 4.2.17. Fixes #13027 --- MODULE.bazel | 24 ++++++++++++------------ SECURITY.md | 3 ++- gradle/libs.versions.toml | 8 ++++---- repositories.bzl | 24 ++++++++++++------------ 4 files changed, 30 insertions(+), 29 deletions(-) diff --git a/MODULE.bazel b/MODULE.bazel index d6dd7bc37b6..ada267b7014 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -25,20 +25,20 @@ IO_GRPC_GRPC_JAVA_ARTIFACTS = [ "dev.cel:common:0.13.1", "com.squareup.okhttp:okhttp:2.7.5", "com.squareup.okio:okio:2.10.0", # 3.0+ needs swapping to -jvm; need work to avoid flag-day - "io.netty:netty-buffer:4.2.16.Final", - "io.netty:netty-codec-base:4.2.16.Final", - "io.netty:netty-codec-http2:4.2.16.Final", - "io.netty:netty-codec-http:4.2.16.Final", - "io.netty:netty-codec-socks:4.2.16.Final", - "io.netty:netty-common:4.2.16.Final", - "io.netty:netty-handler-proxy:4.2.16.Final", - "io.netty:netty-handler:4.2.16.Final", - "io.netty:netty-resolver:4.2.16.Final", + "io.netty:netty-buffer:4.2.17.Final", + "io.netty:netty-codec-base:4.2.17.Final", + "io.netty:netty-codec-http2:4.2.17.Final", + "io.netty:netty-codec-http:4.2.17.Final", + "io.netty:netty-codec-socks:4.2.17.Final", + "io.netty:netty-common:4.2.17.Final", + "io.netty:netty-handler-proxy:4.2.17.Final", + "io.netty:netty-handler:4.2.17.Final", + "io.netty:netty-resolver:4.2.17.Final", "io.netty:netty-tcnative-boringssl-static:2.0.81.Final", "io.netty:netty-tcnative-classes:2.0.81.Final", - "io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.2.16.Final", - "io.netty:netty-transport-native-unix-common:4.2.16.Final", - "io.netty:netty-transport:4.2.16.Final", + "io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.2.17.Final", + "io.netty:netty-transport-native-unix-common:4.2.17.Final", + "io.netty:netty-transport:4.2.17.Final", "io.opencensus:opencensus-api:0.31.0", "io.opencensus:opencensus-contrib-grpc-metrics:0.31.0", "io.perfmark:perfmark-api:0.27.0", diff --git a/SECURITY.md b/SECURITY.md index 1361a321418..4d71d6d8785 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -403,7 +403,8 @@ grpc-netty version | netty-handler version | netty-tcnative-boringssl-static ver 1.81.x | 4.1.132.Final | 2.0.75.Final 1.82.x | 4.1.133.Final | 2.0.75.Final 1.83.x | 4.2.15.Final | 2.0.75.Final -1.84.x- | 4.2.16.Final | 2.0.81.Final +1.84.x | 4.2.16.Final | 2.0.81.Final +1.85.x- | 4.2.17.Final | 2.0.81.Final _(grpc-netty-shaded avoids issues with keeping these versions in sync.)_ diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index c1f7d13d411..54a66d0015b 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -102,14 +102,14 @@ lincheck = "org.jetbrains.lincheck:lincheck:3.7" mockito-android = "org.mockito:mockito-android:4.4.0" # checkForUpdates: mockito-core:4.4.+ mockito-core = "org.mockito:mockito-core:4.4.0" -netty-codec-http2 = "io.netty:netty-codec-http2:4.2.16.Final" -netty-handler-proxy = "io.netty:netty-handler-proxy:4.2.16.Final" +netty-codec-http2 = "io.netty:netty-codec-http2:4.2.17.Final" +netty-handler-proxy = "io.netty:netty-handler-proxy:4.2.17.Final" # Keep the following references of tcnative version in sync whenever it's updated: # SECURITY.md netty-tcnative = "io.netty:netty-tcnative-boringssl-static:2.0.81.Final" netty-tcnative-classes = "io.netty:netty-tcnative-classes:2.0.81.Final" -netty-transport-epoll = "io.netty:netty-transport-native-epoll:4.2.16.Final" -netty-unix-common = "io.netty:netty-transport-native-unix-common:4.2.16.Final" +netty-transport-epoll = "io.netty:netty-transport-native-epoll:4.2.17.Final" +netty-unix-common = "io.netty:netty-transport-native-unix-common:4.2.17.Final" okhttp = "com.squareup.okhttp:okhttp:2.7.5" # okio 3.5+ uses Kotlin 1.9+ which requires Android Gradle Plugin 9+ # checkForUpdates: okio:3.4.+ diff --git a/repositories.bzl b/repositories.bzl index a00a0a85f65..0f0296620ba 100644 --- a/repositories.bzl +++ b/repositories.bzl @@ -30,20 +30,20 @@ IO_GRPC_GRPC_JAVA_ARTIFACTS = [ "dev.cel:common:0.13.1", "com.squareup.okhttp:okhttp:2.7.5", "com.squareup.okio:okio:2.10.0", # 3.0+ needs swapping to -jvm; need work to avoid flag-day - "io.netty:netty-buffer:4.2.16.Final", - "io.netty:netty-codec-base:4.2.16.Final", - "io.netty:netty-codec-http2:4.2.16.Final", - "io.netty:netty-codec-http:4.2.16.Final", - "io.netty:netty-codec-socks:4.2.16.Final", - "io.netty:netty-common:4.2.16.Final", - "io.netty:netty-handler-proxy:4.2.16.Final", - "io.netty:netty-handler:4.2.16.Final", - "io.netty:netty-resolver:4.2.16.Final", + "io.netty:netty-buffer:4.2.17.Final", + "io.netty:netty-codec-base:4.2.17.Final", + "io.netty:netty-codec-http2:4.2.17.Final", + "io.netty:netty-codec-http:4.2.17.Final", + "io.netty:netty-codec-socks:4.2.17.Final", + "io.netty:netty-common:4.2.17.Final", + "io.netty:netty-handler-proxy:4.2.17.Final", + "io.netty:netty-handler:4.2.17.Final", + "io.netty:netty-resolver:4.2.17.Final", "io.netty:netty-tcnative-boringssl-static:2.0.81.Final", "io.netty:netty-tcnative-classes:2.0.81.Final", - "io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.2.16.Final", - "io.netty:netty-transport-native-unix-common:4.2.16.Final", - "io.netty:netty-transport:4.2.16.Final", + "io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.2.17.Final", + "io.netty:netty-transport-native-unix-common:4.2.17.Final", + "io.netty:netty-transport:4.2.17.Final", "io.opencensus:opencensus-api:0.31.0", "io.opencensus:opencensus-contrib-grpc-metrics:0.31.0", "io.perfmark:perfmark-api:0.27.0",