From 2cc2218bf4561e7348d1b08c1352b7e07f364493 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 21 Nov 2025 19:43:41 +0000
Subject: [PATCH 1/2] chore(deps): update netty monorepo to v4.2.7.final

---
 providers/flagd/pom.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/providers/flagd/pom.xml b/providers/flagd/pom.xml
index dd5e8ba30..3f23a76ca 100644
--- a/providers/flagd/pom.xml
+++ b/providers/flagd/pom.xml
@@ -64,7 +64,7 @@
             <!-- we only support unix sockets on linux, via epoll native lib -->
             <groupId>io.netty</groupId>
             <artifactId>netty-transport-native-epoll</artifactId>
-            <version>4.2.6.Final</version>
+            <version>4.2.7.Final</version>
             <!-- TODO: with 5+ (still alpha), arm is support and we should package multiple versions -->
             <classifier>linux-x86_64</classifier>
         </dependency>
@@ -185,7 +185,7 @@
             <dependency>
                 <groupId>io.netty</groupId>
                 <artifactId>netty-codec-http2</artifactId>
-                <version>4.1.125.Final</version>
+                <version>4.2.7.Final</version>
             </dependency>
         </dependencies>
 

From fd434cc64697426b1d888f1dfe041a87706898c4 Mon Sep 17 00:00:00 2001
From: Simon Schrottner <simon.schrottner@dynatrace.com>
Date: Fri, 21 Nov 2025 20:53:04 +0100
Subject: [PATCH 2/2] fixup: remove unnecessary cve fix

[INFO] dev.openfeature.contrib.providers:flagd:jar:0.11.18
[INFO] \- io.grpc:grpc-netty:jar:1.77.0:compile
[INFO]    \- io.netty:netty-codec-http2:jar:4.1.127.Final:compile

Signed-off-by: Simon Schrottner <simon.schrottner@dynatrace.com>
---
 providers/flagd/pom.xml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/providers/flagd/pom.xml b/providers/flagd/pom.xml
index 3f23a76ca..955797988 100644
--- a/providers/flagd/pom.xml
+++ b/providers/flagd/pom.xml
@@ -180,15 +180,7 @@
                 <!-- caution - updating this will break compatibility with older protobuf-java versions -->
                 <version>${protobuf-java.min.version}</version>
             </dependency>
-
-            <!-- temporary override for https://www.cve.org/CVERecord?id=CVE-2025-58057 -->
-            <dependency>
-                <groupId>io.netty</groupId>
-                <artifactId>netty-codec-http2</artifactId>
-                <version>4.2.7.Final</version>
-            </dependency>
         </dependencies>
-
     </dependencyManagement>
 
     <build>