fix(security): bump netty-bom 4.1.136.Final and jetty 12.1.10 to clear Inspector high findings

[manerow]

OM-side half of the fix for the 6 High Inspector findings on the 1.13 Collate server image.

Bump	Clears
netty-bom 4.1.135.Final -> 4.1.136.Final	CVE-2026-55831, CVE-2026-55833, CVE-2026-56745, CVE-2026-59901 (high) + CVE-2026-56746, CVE-2026-59898, CVE-2026-59899, CVE-2026-59900, CVE-2026-59921
jetty 12.1.7 -> 12.1.10	CVE-2026-10050 (high, jetty-security digest-auth bypass), CVE-2026-10051, CVE-2026-6790, CVE-2026-8384

Note: jetty.version is defined in both the root pom.xml and openmetadata-service/pom.xml. The child redefinition shadows the parent, so bumping only the root silently has no effect. Both are changed here.

Inspector reports fixedInVersion: 4.2.16.Final for the netty advisories, but each has a 4.1-line backport in 4.1.136.Final, so no 4.2 major upgrade is needed.

Paired with open-metadata/openmetadata-collate#5226.

mvn -pl openmetadata-service -am package passes.

🤖 Generated with Claude Code

Fixes #30394

Greptile Summary

Updates Jetty to 12.1.10 across the root, service, and MCP Maven properties and updates the Netty BOM to 4.1.136.Final.

• Aligns the previously missed openmetadata-mcp Jetty override with the patched version.
• Updates the service and parent Jetty properties.
• Advances the parent-managed Netty BOM.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains, and the MCP module’s previously missed Jetty override now uses the patched version.

Important Files Changed

Filename	Overview
openmetadata-mcp/pom.xml	Aligns the MCP module’s shadowing Jetty property with 12.1.10, completing the previously requested fix.
openmetadata-service/pom.xml	Updates the service-local Jetty override from 12.1.7 to 12.1.10.
pom.xml	Updates the parent Jetty property to 12.1.10 and the managed Netty BOM to 4.1.136.Final.

_{Reviews (4): Last reviewed commit: "Merge remote-tracking branch 'origin/mai..." | Re-trigger Greptile}

[github-actions]

✅ PR checks passed

The linked issue has a description and all required Shipping project fields set. Thanks!

[github-actions]

🔴 Playwright Results — 3 test failure(s)

✅ 4531 passed · ❌ 3 failed · 🟡 25 flaky · ⏭️ 102 skipped

Shard	Passed	Failed	Flaky	Skipped
🟡 Shard 1	435	0	5	16
✅ Shard 2	11	0	0	0
🔴 Shard 3	821	1	9	8
🔴 Shard 4	812	2	1	25
🟡 Shard 5	830	0	3	5
✅ Shard 6	832	0	0	46
🟡 Shard 7	790	0	7	2

Genuine Failures (failed on all attempts)

❌ Features/ContextCenterArticles.spec.ts › Article edit persistence and unsaved title behavior are correct (shard 3)

Error: �[2mexpect(�[22m�[31mlocator�[39m�[2m).�[22mtoHaveValue�[2m(�[22m�[32mexpected�[39m�[2m)�[22m failed

Locator:  getByTestId('entity-header-display-name')
Expected: �[32m"CC Edit Article dcc57add Updated"�[39m
Received: �[31m"CC Edit Article dcc57add Updated�[7m Unsaved�[27m"�[39m
Timeout:  15000ms

Call log:
�[2m  - Expect "toHaveValue" with timeout 15000ms�[22m
�[2m  - waiting for getByTestId('entity-header-display-name')�[22m
�[2m    18 × locator resolved to <textarea rows="1" id="title-input" spellcheck="false" class="knowledge-page-title-input" data-testid="entity-header-display-name" placeholder="CC Edit Article dcc57add Updated Unsaved">CC Edit Article dcc57add Updated Unsaved</textarea>�[22m
�[2m       - unexpected value "CC Edit Article dcc57add Updated Unsaved"�[22m

❌ Features/OntologyExplorerRdf.spec.ts › term Relations Graph requests /rdf/glossary/graph scoped to the selected term (glossaryTermId) when RDF is enabled (shard 4)

�[31mTest timeout of 60000ms exceeded.�[39m

❌ Features/OntologyExplorerRdf.spec.ts › glossary Relations Graph calls /rdf/glossary/graph when RDF is enabled and renders nodes from the response (shard 4)

Error: GET /rdf/glossary/graph must be called on the glossary Relations Graph when RDF is enabled

�[2mexpect(�[22m�[31mreceived�[39m�[2m).�[22mtoBe�[2m(�[22m�[32mexpected�[39m�[2m) // Object.is equality�[22m

Expected: �[32mtrue�[39m
Received: �[31mfalse�[39m

🟡 25 flaky test(s) (passed on retry)

• Flow/TestConnectionModal.spec.ts › failure state shows remediation card with error content (shard 1, 1 retry)
• Pages/Lineage/LineageRightPanel.spec.ts › Verify custom properties tab IS visible for supported type: chart (shard 1, 1 retry)
• Pages/SearchSettings.spec.ts › Preview config reflects reverted n-gram weight after save (shard 1, 1 retry)
• Pages/SearchSettings.spec.ts › Latest preview config wins when a superseded request resolves late (shard 1, 1 retry)
• Flow/SearchRBAC.spec.ts › a dashboard-scoped user sees dashboards but never tables (shard 1, 1 retry)
• Features/ColumnBulkOperations.spec.ts › should clear individual filter and update URL (shard 3, 1 retry)
• Features/ContextCenterArchive.spec.ts › file in deleted folder is absent from search and not added to archive (shard 3, 1 retry)
• Features/ContextCenterArticles.spec.ts › Article listing search filters, clears, and shows empty state (shard 3, 1 retry)
• Features/ContextCenterArticles.spec.ts › Article list cards, recently viewed widget, and pagination work (shard 3, 1 retry)
• Features/ContextCenterArticles.spec.ts › description: switching articles does not bleed unsaved content into next article (shard 3, 1 retry)
• Features/ContextCenterMemories.spec.ts › cancel button in edit mode closes the modal without saving (shard 3, 1 retry)
• Features/DataQuality/CertificationFilter.spec.ts › Certification filter narrows both table- and testCase-index queries via the flat field path (shard 3, 1 retry)
• Features/DataQuality/DataQualityDashboard.spec.ts › Dimension card click should redirect to test cases with applied filters (shard 3, 1 retry)
• Features/Glossary/GlossaryMiscOperations.spec.ts › should delete parent term and remove both parent and child tags from assets (shard 3, 1 retry)
• Features/RestoreEntityInheritedFields.spec.ts › Validate restore with Inherited domain and data products assigned (shard 4, 1 retry)
• Flow/CustomizeWidgets.spec.ts › Data Products Widget (shard 5, 1 retry)
• Flow/PersonaFlow.spec.ts › Delete persona should work properly (shard 5, 1 retry)
• Pages/CustomProperties.spec.ts › Set & Update all CP types on apiEndpoint (shard 5, 1 retry)
• Pages/Glossary.spec.ts › Approve and reject glossary term from Glossary Listing (shard 7, 2 retries)
• Pages/Lineage/DataAssetLineage.spec.ts › Column lineage for container -> topic (shard 7, 1 retry)
• Pages/Lineage/DataAssetLineage.spec.ts › Column lineage for container -> dashboard (shard 7, 1 retry)
• Pages/Lineage/LineageFilters.spec.ts › Verify Impact Analysis service filter selection (shard 7, 1 retry)
• Pages/Lineage/LineageRightPanel.spec.ts › Verify custom properties tab is NOT visible for pipelineService in platform lineage (shard 7, 1 retry)
• Pages/Lineage/LineageRightPanel.spec.ts › Verify custom properties tab is NOT visible for apiService in platform lineage (shard 7, 1 retry)
• Pages/ServiceEntity.spec.ts › Inactive Announcement create & delete (shard 7, 1 retry)

📦 Download artifacts

How to debug locally

# Download playwright-test-results-<shard> artifact and unzip
npx playwright show-trace path/to/trace.zip    # view trace

[sonarqubecloud]

Quality Gate passed for 'open-metadata-ingestion'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Failed to cherry-pick changes to the 1.13 branch.
Please cherry-pick the changes manually.
You can find more details here.

[gitar-bot]

Code Review ✅ Approved

Bumps netty-bom to 4.1.136.Final and jetty to 12.1.10 across root and service POMs to clear multiple high Inspector security findings. No issues found.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}