Bump the gradle-minor-and-patch group across 1 directory with 19 updates by dependabot[bot] · Pull Request #867 · drpcorg/dshackle

dependabot · 2026-06-02T23:35:10Z

Bumps the gradle-minor-and-patch group with 19 updates in the / directory:

Package	From	To
com.google.protobuf:protobuf-java-util	`4.34.1`	`4.35.0`
com.fasterxml.jackson.core:jackson-core	`2.21.3`	`2.21.4`
com.fasterxml.jackson.core:jackson-databind	`2.21.3`	`2.21.4`
com.fasterxml.jackson.datatype:jackson-datatype-jdk8	`2.21.3`	`2.21.4`
com.fasterxml.jackson.datatype:jackson-datatype-jsr310	`2.21.3`	`2.21.4`
com.fasterxml.jackson.module:jackson-module-kotlin	`2.21.3`	`2.21.4`
com.fasterxml.jackson.dataformat:jackson-dataformat-yaml	`2.21.3`	`2.21.4`
io.lettuce:lettuce-core	`7.5.2.RELEASE`	`7.6.0.RELEASE`
io.netty:netty-common	`4.2.13.Final`	`4.2.15.Final`
io.netty:netty-transport	`4.2.13.Final`	`4.2.15.Final`
io.netty:netty-handler	`4.2.13.Final`	`4.2.15.Final`
io.netty:netty-handler-proxy	`4.2.13.Final`	`4.2.15.Final`
io.netty:netty-resolver	`4.2.13.Final`	`4.2.15.Final`
io.netty:netty-resolver-dns	`4.2.13.Final`	`4.2.15.Final`
io.netty:netty-codec	`4.2.13.Final`	`4.2.15.Final`
io.netty:netty-codec-http	`4.2.13.Final`	`4.2.15.Final`
io.netty:netty-codec-http2	`4.2.13.Final`	`4.2.15.Final`
io.netty:netty-buffer	`4.2.13.Final`	`4.2.15.Final`
io.netty:netty-resolver-dns-native-macos	`4.2.13.Final`	`4.2.15.Final`

Updates com.google.protobuf:protobuf-java-util from 4.34.1 to 4.35.0

Updates com.fasterxml.jackson.core:jackson-core from 2.21.3 to 2.21.4

Commits

f17a4f7 [maven-release-plugin] prepare release jackson-core-2.21.4
c6411e1 Prep for 2.21.4 release
52633da Merge branch '2.20' into 2.21
1fa7bb9 Merge branch '2.19' into 2.20
6dea8a8 Merge branch '2.18' into 2.19
ada244d Post-release dep version bump
52f69d3 [maven-release-plugin] prepare for next development iteration
899d70a [maven-release-plugin] prepare release jackson-core-2.18.8
a006b52 Prep for 2.18.8 release
4c05816 Merge branch '2.20' into 2.21
Additional commits viewable in compare view

Updates com.fasterxml.jackson.core:jackson-databind from 2.21.3 to 2.21.4

Commits

See full diff in compare view

Updates com.fasterxml.jackson.datatype:jackson-datatype-jdk8 from 2.21.3 to 2.21.4

Updates com.fasterxml.jackson.datatype:jackson-datatype-jsr310 from 2.21.3 to 2.21.4

Updates com.fasterxml.jackson.module:jackson-module-kotlin from 2.21.3 to 2.21.4

Commits

d1e079e [maven-release-plugin] prepare release jackson-module-kotlin-2.21.4
77295a2 Prep for 2.21.4 release
3ef400e Merge branch '2.20' into 2.21
609b375 Merge branch '2.19' into 2.20
c623e25 Merge branch '2.18' into 2.19
a6790e5 Post-release dep version bump
5a09e64 [maven-release-plugin] prepare for next development iteration
0566650 [maven-release-plugin] prepare release jackson-module-kotlin-2.18.8
b635ae9 Prep for 2.18.8 release
346ccb8 Merge pull request #1170 from k163377/fix/wf
Additional commits viewable in compare view

Updates com.fasterxml.jackson.dataformat:jackson-dataformat-yaml from 2.21.3 to 2.21.4

Commits

95debb7 [maven-release-plugin] prepare release jackson-dataformats-text-2.21.4
c426a04 Prep for 2.21.4 release
6350258 Merge branch '2.20' into 2.21
bdcc3eb Merge branch '2.19' into 2.20
48242e9 Merge branch '2.18' into 2.19
6d9da0d Post-release dep version bump
fd07764 [maven-release-plugin] prepare for next development iteration
906a1ba [maven-release-plugin] prepare release jackson-dataformats-text-2.18.8
673d805 Prep for 2.18.8 release
3f9b8be Merge branch '2.20' into 2.21
Additional commits viewable in compare view

Updates com.fasterxml.jackson.core:jackson-databind from 2.21.3 to 2.21.4

Commits

See full diff in compare view

Updates com.fasterxml.jackson.datatype:jackson-datatype-jdk8 from 2.21.3 to 2.21.4

Updates com.fasterxml.jackson.datatype:jackson-datatype-jsr310 from 2.21.3 to 2.21.4

Updates com.fasterxml.jackson.module:jackson-module-kotlin from 2.21.3 to 2.21.4

Commits

d1e079e [maven-release-plugin] prepare release jackson-module-kotlin-2.21.4
77295a2 Prep for 2.21.4 release
3ef400e Merge branch '2.20' into 2.21
609b375 Merge branch '2.19' into 2.20
c623e25 Merge branch '2.18' into 2.19
a6790e5 Post-release dep version bump
5a09e64 [maven-release-plugin] prepare for next development iteration
0566650 [maven-release-plugin] prepare release jackson-module-kotlin-2.18.8
b635ae9 Prep for 2.18.8 release
346ccb8 Merge pull request #1170 from k163377/fix/wf
Additional commits viewable in compare view

Updates com.fasterxml.jackson.dataformat:jackson-dataformat-yaml from 2.21.3 to 2.21.4

Commits

95debb7 [maven-release-plugin] prepare release jackson-dataformats-text-2.21.4
c426a04 Prep for 2.21.4 release
6350258 Merge branch '2.20' into 2.21
bdcc3eb Merge branch '2.19' into 2.20
48242e9 Merge branch '2.18' into 2.19
6d9da0d Post-release dep version bump
fd07764 [maven-release-plugin] prepare for next development iteration
906a1ba [maven-release-plugin] prepare release jackson-dataformats-text-2.18.8
673d805 Prep for 2.18.8 release
3f9b8be Merge branch '2.20' into 2.21
Additional commits viewable in compare view

Updates io.lettuce:lettuce-core from 7.5.2.RELEASE to 7.6.0.RELEASE

Release notes

Sourced from io.lettuce:lettuce-core's releases.

7.6.0.RELEASE

The Lettuce team is pleased to announce the Lettuce 7.6.0 minor release!

✨ Highlights

Lettuce 7.6.0 introduces support for the new features from Redis OSS 8.8 release, such as:

the new Array data structure

INCREX: a window counter rate limiter combining INCR, INCRBY, INCRBYFLOAT, bounds, and expiration

XNACK: a new streams command - allow consumers to explicitly release pending messages

ZUNION, ZINTER, ZUNIONSTORE, ZINTERSTORE: new COUNT aggregator

JSON.SET: new FPHA argument to specify the FP type for homogeneous FP arrays

Lettuce 7.6.0 supports Redis 2.6+ up to Redis 8.x. In terms of Java runtime, Lettuce requires at least Java 8 and works with Java 24. The driver is tested against Redis 8.8, Redis 8.6, Redis 8.4, Redis 8.2, Redis 8.0, Redis 7.4 and Redis 7.2.

Thanks to all contributors who made Lettuce 7.6.0.RELEASE possible.

📗 Links Reference documentation: https://lettuce.io/core/7.6.0.RELEASE

⭐ New Features

Add arrays API by @a-TODO-rov in redis/lettuce#3745

Introduce INCREX command by @a-TODO-rov in redis/lettuce#3746

Redis 8.8: Add XNACK support by @uglide in redis/lettuce#3728

Support COUNT aggregator for ZINTER, ZINTERSTORE, ZUNION and ZUNIONSTORE (Redis 8.8) by @atakavci in redis/lettuce#3736

Add support for FPHA argument with JSON.SET (Redis 8.8)#4478 by @atakavci in redis/lettuce#3710

Add missing Search languages by @viktoriya-kutsarova in redis/lettuce#3690

🐞 Bug Fixes

ERR unknown subcommand 'MYID' with Azure Managed Redis #3495 by @tishun in redis/lettuce#3693

Fix links in README for Streaming API and Native Transports by @a-TODO-rov in redis/lettuce#3707

Fix JSON.ARRAPPEND root path encoding by @Dgramada in redis/lettuce#3715

Fix benchmark tests by @atakavci in redis/lettuce#3735

Fix imports in benchmarks client by @atakavci in redis/lettuce#3737

Improve CI pipeline stability in redis/lettuce#3740 , redis/lettuce#3724 by @atakavci , redis/lettuce#3725 by @tishun , redis/lettuce#3720 by @viktoriya-kutsarova

⚙️ Maintenance

ci(integration): cap GITHUB_TOKEN to contents: read by @arpitjain099 in redis/lettuce#3761

ci: declare workflow-level contents: read on 3 workflows by @arpitjain099 in redis/lettuce#3748

Bump Netty 4.2.12.Final by @atakavci in redis/lettuce#3723

Bump Netty 4.2.13.Final by @atakavci in redis/lettuce#3751

💡 Other

Add 8.8 to test matrix by @a-TODO-rov in redis/lettuce#3764

Add tests for client auth by @a-TODO-rov in redis/lettuce#3685

Introduce reusable workflows by @a-TODO-rov in redis/lettuce#3673

Optimize single-node master/replica reads by @Sean-Kenneth-Doherty in redis/lettuce#3758

Add subkeyspace notifications integration tests by @a-TODO-rov in redis/lettuce#3734

... (truncated)

Changelog

Sourced from io.lettuce:lettuce-core's changelog.

Lettuce 7.6.0 RELEASE NOTES

The Lettuce team is pleased to announce the Lettuce 7.6.0 minor release!

✨ Highlights

Lettuce 7.6.0 introduces support for the new features from Redis OSS 8.8 release, such as:

the new Array data structure

INCREX: a window counter rate limiter combining INCR, INCRBY, INCRBYFLOAT, bounds, and expiration

XNACK: a new streams command - allow consumers to explicitly release pending messages

ZUNION, ZINTER, ZUNIONSTORE, ZINTERSTORE: new COUNT aggregator

JSON.SET: new FPHA argument to specify the FP type for homogeneous FP arrays

Lettuce 7.6.0 supports Redis 2.6+ up to Redis 8.x. In terms of Java runtime, Lettuce requires at least Java 8 and works with Java 24. The driver is tested against Redis 8.8, Redis 8.6, Redis 8.4, Redis 8.2, Redis 8.0, Redis 7.4 and Redis 7.2.

Thanks to all contributors who made Lettuce 7.6.0.RELEASE possible.

📗 Links Reference documentation: https://lettuce.io/core/7.6.0.RELEASE

⭐ New Features

Add arrays API by @a-TODO-rov in redis/lettuce#3745

Introduce INCREX command by @a-TODO-rov in redis/lettuce#3746

Redis 8.8: Add XNACK support by @uglide in redis/lettuce#3728

Support COUNT aggregator for ZINTER, ZINTERSTORE, ZUNION and ZUNIONSTORE (Redis 8.8) by @atakavci in redis/lettuce#3736

Add support for FPHA argument with JSON.SET (Redis 8.8)#4478 by @atakavci in redis/lettuce#3710

Add missing Search languages by @viktoriya-kutsarova in redis/lettuce#3690

🐞 Bug Fixes

ERR unknown subcommand 'MYID' with Azure Managed Redis #3495 by @tishun in redis/lettuce#3693

Fix links in README for Streaming API and Native Transports by @a-TODO-rov in redis/lettuce#3707

Fix JSON.ARRAPPEND root path encoding by @Dgramada in redis/lettuce#3715

Fix benchmark tests by @atakavci in redis/lettuce#3735

Fix imports in benchmarks client by @atakavci in redis/lettuce#3737

Improve CI pipeline stability in redis/lettuce#3740 , redis/lettuce#3724 by @atakavci , redis/lettuce#3725 by @tishun , redis/lettuce#3720 by @viktoriya-kutsarova

⚙️ Maintenance

ci(integration): cap GITHUB_TOKEN to contents: read by @arpitjain099 in redis/lettuce#3761

ci: declare workflow-level contents: read on 3 workflows by @arpitjain099 in redis/lettuce#3748

Bump Netty 4.2.12.Final by @atakavci in redis/lettuce#3723

Bump Netty 4.2.13.Final by @atakavci in redis/lettuce#3751

💡 Other

Add 8.8 to test matrix by @a-TODO-rov in redis/lettuce#3764

Add tests for client auth by @a-TODO-rov in redis/lettuce#3685

Introduce reusable workflows by @a-TODO-rov in redis/lettuce#3673

Optimize single-node master/replica reads by @Sean-Kenneth-Doherty in redis/lettuce#3758

Add subkeyspace notifications integration tests by @a-TODO-rov in redis/lettuce#3734

... (truncated)

Commits

d34a9a8 Release 7.6.0 (#3767)
59ea606 add Benchmark (jmh) benchmark result for f242194e0bddc7bd2509d153f2f903734765...
f242194 ci: declare workflow-level contents: read on 3 workflows (#3748)
a09e45d add Benchmark (jmh) benchmark result for 27b467030699f90bd6a6f7712767f3818b72...
27b4670 Update 8.8 to official version and make default (#3764)
affdef6 add Benchmark (jmh) benchmark result for 2a49a07f39f713cc6c9e9c41485067ac610f...
2a49a07 ci(integration): cap GITHUB_TOKEN to contents: read (#3761)
8fad729 add Benchmark (jmh) benchmark result for ee1e841dd874fa005d8a1103825e6166bdf3...
ee1e841 add Benchmark (jmh) benchmark result for 2db134d1128ca2f04beed94665e7a689beed...
2db134d add Benchmark (jmh) benchmark result for 312ecc7b497860cab4b9dd2d331db86d2b81...
Additional commits viewable in compare view

Updates io.netty:netty-common from 4.2.13.Final to 4.2.15.Final

Release notes

Sourced from io.netty:netty-common's releases.

netty-4.2.15.Final

Security fixes

CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).

CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-XXXXX: DDoS in io.netty:netty-codec-http2.

CVE-2026-XXXXX: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-XXXXX: information disclosure and denial of service in io.netty:netty-codec-classes-quic.

CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).

CVE-2026-XXXXX: request smuggling in io.netty:netty-codec-http.

CVE-2026-44892: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).

CVE-2026-44894: traffic amplification in io.netty:netty-codec-classes-quic (high).

CVE-2026-XXXXX: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).

CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.

CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).

CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue.

CVE-2026-45674: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-46340: memory exhaustion in io.netty:netty-transport-sctp (high).

CVE-2026-47244: denial of service in io.netty:netty-codec-http2.

CVE-2026-48006: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-48748: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-48043: memory exhaustion in io.netty:netty-codec-http2.

What's Changed

Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by @dreamlike-ocean in netty/netty#16836

HTTP/2: Parse request-target path like Vert.x by @yawkat in netty/netty#16810

Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by @netty-project-bot in netty/netty#16853

FlowControlHandler: Suppress duplicate channelReadComplete after draining queue (#15053) by @schiemon in netty/netty#16837

Pass maxAllocation to Brotli and Zstd decoders by @fedinskiy in netty/netty#16844

Fix revapi warnings by @chrisvest in netty/netty#16885

Fix SCTP and Redis tests by @chrisvest in netty/netty#16893

Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by @skyguard1 in netty/netty#16850

Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by @netty-project-bot in netty/netty#16890

New Contributors

@schiemon made their first contribution in netty/netty#16837

@fedinskiy made their first contribution in netty/netty#16844

Full Changelog: netty/netty@netty-4.2.14.Final...netty-4.2.15.Final

netty-4.2.14.Final

What's Changed

HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by @normanmaurer in netty/netty#16748

HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by @normanmaurer in netty/netty#16747

Marshalling: Explicit document security requirements by @normanmaurer in netty/netty#16752

Fix io_uring op completion TRACE logging by @chrisvest in netty/netty#16755

Quic: Ensure writes are done before notify close promise of QuicheQui… by @normanmaurer in netty/netty#16758

Avoid re-parsing openssl key material with non-cached provider by @chrisvest in netty/netty#16759

... (truncated)

Commits

a41f7b2 [maven-release-plugin] prepare release netty-4.2.15.Final
2394530 Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remain...
0bd1657 Add maxWindowLog parameter to ZstdDecoder to bound memory allocation (#16850)
76291f5 Fix SCTP and Redis tests (#16893)
e067b6e Fix revapi warnings (#16885)
5a52600 Pass maxAllocation to Brotli and Zstd decoders (#16844)
541add0 Merge commit from fork
270800e Merge commit from fork
3d45a1e Merge commit from fork
75127ca Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-transport from 4.2.13.Final to 4.2.15.Final

Release notes

Sourced from io.netty:netty-transport's releases.

netty-4.2.15.Final

Security fixes

CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).

CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-XXXXX: DDoS in io.netty:netty-codec-http2.

CVE-2026-XXXXX: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-XXXXX: information disclosure and denial of service in io.netty:netty-codec-classes-quic.

CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).

CVE-2026-XXXXX: request smuggling in io.netty:netty-codec-http.

CVE-2026-44892: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).

CVE-2026-44894: traffic amplification in io.netty:netty-codec-classes-quic (high).

CVE-2026-XXXXX: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).

CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.

CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).

CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue.

CVE-2026-45674: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-46340: memory exhaustion in io.netty:netty-transport-sctp (high).

CVE-2026-47244: denial of service in io.netty:netty-codec-http2.

CVE-2026-48006: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-48748: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-48043: memory exhaustion in io.netty:netty-codec-http2.

What's Changed

Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by @dreamlike-ocean in netty/netty#16836

HTTP/2: Parse request-target path like Vert.x by @yawkat in netty/netty#16810

Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by @netty-project-bot in netty/netty#16853

FlowControlHandler: Suppress duplicate channelReadComplete after draining queue (#15053) by @schiemon in netty/netty#16837

Pass maxAllocation to Brotli and Zstd decoders by @fedinskiy in netty/netty#16844

Fix revapi warnings by @chrisvest in netty/netty#16885

Fix SCTP and Redis tests by @chrisvest in netty/netty#16893

Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by @skyguard1 in netty/netty#16850

Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by @netty-project-bot in netty/netty#16890

New Contributors

@schiemon made their first contribution in netty/netty#16837

@fedinskiy made their first contribution in netty/netty#16844

Full Changelog: netty/netty@netty-4.2.14.Final...netty-4.2.15.Final

netty-4.2.14.Final

What's Changed

HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by @normanmaurer in netty/netty#16748

HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by @normanmaurer in netty/netty#16747

Marshalling: Explicit document security requirements by @normanmaurer in netty/netty#16752

Fix io_uring op completion TRACE logging by @chrisvest in netty/netty#16755

Quic: Ensure writes are done before notify close promise of QuicheQui… by @normanmaurer in netty/netty#16758

Avoid re-parsing openssl key material with non-cached provider by @chrisvest in netty/netty#16759

... (truncated)

Commits

a41f7b2 [maven-release-plugin] prepare release netty-4.2.15.Final
2394530 Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remain...
0bd1657 Add maxWindowLog parameter to ZstdDecoder to bound memory allocation (#16850)
76291f5 Fix SCTP and Redis tests (#16893)
e067b6e Fix revapi warnings (#16885)
5a52600 Pass maxAllocation to Brotli and Zstd decoders (#16844)
541add0 Merge commit from fork
270800e Merge commit from fork
3d45a1e Merge commit from fork
75127ca Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-handler from 4.2.13.Final to 4.2.15.Final

Release notes

Sourced from io.netty:netty-handler's releases.

netty-4.2.15.Final

Security fixes

CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).

CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-XXXXX: DDoS in io.netty:netty-codec-http2.

CVE-2026-XXXXX: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-XXXXX: information disclosure and denial of service in io.netty:netty-codec-classes-quic.

CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).

CVE-2026-XXXXX: request smuggling in io.netty:netty-codec-http.

CVE-2026-44892: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).

CVE-2026-44894: traffic amplification in io.netty:netty-codec-classes-quic (high).

CVE-2026-XXXXX: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).

CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.

CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).

CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue.

CVE-2026-45674: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-46340: memory exhaustion in io.netty:netty-transport-sctp (high).

CVE-2026-47244: denial of service in io.netty:netty-codec-http2.

CVE-2026-48006: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-48748: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-48043: memory exhaustion in io.netty:netty-codec-http2.

What's Changed

Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by @dreamlike-ocean in netty/netty#16836

HTTP/2: Parse request-target path like Vert.x by @yawkat in netty/netty#16810

Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by @netty-project-bot in netty/netty#16853

FlowControlHandler: Suppress duplicate channelReadComplete after draining queue (#15053) by @schiemon in netty/netty#16837

Pass maxAllocation to Brotli and Zstd decoders by @fedinskiy in netty/netty#16844

Fix revapi warnings by @chrisvest in netty/netty#16885

Fix SCTP and Redis tests by @chrisvest in netty/netty#16893

Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by @skyguard1 in netty/netty#16850

Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by @netty-project-bot in netty/netty#16890

New Contributors

@schiemon made their first contribution in netty/netty#16837

@fedinskiy made their first contribution in netty/netty#16844

Full Changelog: netty/netty@netty-4.2.14.Final...netty-4.2.15.Final

netty-4.2.14.Final

What's Changed

HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by @normanmaurer in netty/netty#16748

HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by @normanmaurer in netty/netty#16747

Marshalling: Explicit document security requirements by @normanmaurer in netty/netty#16752

Fix io_uring op completion TRACE logging by @chrisvest in netty/netty#16755

Quic: Ensure writes are done before notify close promise of QuicheQui… by @normanmaurer in netty/netty#16758

Avoid re-parsing openssl key material with non-cached provider by @chrisvest in netty/netty#16759

... (truncated)

Commits

a41f7b2 [maven-release-plugin] prepare release netty-4.2.15.Final
2394530 Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remain...
0bd1657 Add maxWindowLog parameter to ZstdDecoder to bound memory allocation (#16850)
76291f5 Fix SCTP and Redis tests (#16893)
e067b6e Fix revapi warnings (#16885)
5a52600 Pass maxAllocation to Brotli and Zstd decoders (#16844)
541add0 Merge commit from fork
270800e Merge commit from fork
3d45a1e Merge commit from fork
75127ca Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-handler-proxy from 4.2.13.Final to 4.2.15.Final

Release notes

Sourced from io.netty:netty-handler-proxy's releases.

netty-4.2.15.Final

Security fixes

CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).

CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-XXXXX: DDoS in io.netty:netty-codec-http2.

CVE-2026-XXXXX: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).

CVE-2026-XXXXX: information disclosure and denial of service in io.netty:netty-codec-classes-quic.

CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).

CVE-2026-XXXXX: request smuggling in io.netty:netty-codec-http.

CVE-2026-44892: memory exhaustion in io.netty:netty-codec-http3 (high).

CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).

CVE-2026-44894: traffic amplification in io.netty:netty-codec-classes-quic (high).

CVE-2026-XXXXX: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).

CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.

CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).

CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue.

CVE-2026-45674: DNS cache poisoning in io.netty:netty-resolver-dns (high).

CVE-2026-46340...
Description has been truncated

Bumps the gradle-minor-and-patch group with 19 updates in the / directory: | Package | From | To | | --- | --- | --- | | com.google.protobuf:protobuf-java-util | `4.34.1` | `4.35.0` | | [com.fasterxml.jackson.core:jackson-core](https://github.com/FasterXML/jackson-core) | `2.21.3` | `2.21.4` | | [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson) | `2.21.3` | `2.21.4` | | com.fasterxml.jackson.datatype:jackson-datatype-jdk8 | `2.21.3` | `2.21.4` | | com.fasterxml.jackson.datatype:jackson-datatype-jsr310 | `2.21.3` | `2.21.4` | | [com.fasterxml.jackson.module:jackson-module-kotlin](https://github.com/FasterXML/jackson-module-kotlin) | `2.21.3` | `2.21.4` | | [com.fasterxml.jackson.dataformat:jackson-dataformat-yaml](https://github.com/FasterXML/jackson-dataformats-text) | `2.21.3` | `2.21.4` | | [io.lettuce:lettuce-core](https://github.com/redis/lettuce) | `7.5.2.RELEASE` | `7.6.0.RELEASE` | | [io.netty:netty-common](https://github.com/netty/netty) | `4.2.13.Final` | `4.2.15.Final` | | [io.netty:netty-transport](https://github.com/netty/netty) | `4.2.13.Final` | `4.2.15.Final` | | [io.netty:netty-handler](https://github.com/netty/netty) | `4.2.13.Final` | `4.2.15.Final` | | [io.netty:netty-handler-proxy](https://github.com/netty/netty) | `4.2.13.Final` | `4.2.15.Final` | | [io.netty:netty-resolver](https://github.com/netty/netty) | `4.2.13.Final` | `4.2.15.Final` | | [io.netty:netty-resolver-dns](https://github.com/netty/netty) | `4.2.13.Final` | `4.2.15.Final` | | [io.netty:netty-codec](https://github.com/netty/netty) | `4.2.13.Final` | `4.2.15.Final` | | [io.netty:netty-codec-http](https://github.com/netty/netty) | `4.2.13.Final` | `4.2.15.Final` | | [io.netty:netty-codec-http2](https://github.com/netty/netty) | `4.2.13.Final` | `4.2.15.Final` | | [io.netty:netty-buffer](https://github.com/netty/netty) | `4.2.13.Final` | `4.2.15.Final` | | [io.netty:netty-resolver-dns-native-macos](https://github.com/netty/netty) | `4.2.13.Final` | `4.2.15.Final` | Updates `com.google.protobuf:protobuf-java-util` from 4.34.1 to 4.35.0 Updates `com.fasterxml.jackson.core:jackson-core` from 2.21.3 to 2.21.4 - [Commits](FasterXML/jackson-core@jackson-core-2.21.3...jackson-core-2.21.4) Updates `com.fasterxml.jackson.core:jackson-databind` from 2.21.3 to 2.21.4 - [Commits](https://github.com/FasterXML/jackson/commits) Updates `com.fasterxml.jackson.datatype:jackson-datatype-jdk8` from 2.21.3 to 2.21.4 Updates `com.fasterxml.jackson.datatype:jackson-datatype-jsr310` from 2.21.3 to 2.21.4 Updates `com.fasterxml.jackson.module:jackson-module-kotlin` from 2.21.3 to 2.21.4 - [Commits](FasterXML/jackson-module-kotlin@jackson-module-kotlin-2.21.3...jackson-module-kotlin-2.21.4) Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` from 2.21.3 to 2.21.4 - [Commits](FasterXML/jackson-dataformats-text@jackson-dataformats-text-2.21.3...jackson-dataformats-text-2.21.4) Updates `com.fasterxml.jackson.core:jackson-databind` from 2.21.3 to 2.21.4 - [Commits](https://github.com/FasterXML/jackson/commits) Updates `com.fasterxml.jackson.datatype:jackson-datatype-jdk8` from 2.21.3 to 2.21.4 Updates `com.fasterxml.jackson.datatype:jackson-datatype-jsr310` from 2.21.3 to 2.21.4 Updates `com.fasterxml.jackson.module:jackson-module-kotlin` from 2.21.3 to 2.21.4 - [Commits](FasterXML/jackson-module-kotlin@jackson-module-kotlin-2.21.3...jackson-module-kotlin-2.21.4) Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` from 2.21.3 to 2.21.4 - [Commits](FasterXML/jackson-dataformats-text@jackson-dataformats-text-2.21.3...jackson-dataformats-text-2.21.4) Updates `io.lettuce:lettuce-core` from 7.5.2.RELEASE to 7.6.0.RELEASE - [Release notes](https://github.com/redis/lettuce/releases) - [Changelog](https://github.com/redis/lettuce/blob/main/RELEASE-NOTES.md) - [Commits](redis/lettuce@7.5.2.RELEASE...7.6.0.RELEASE) Updates `io.netty:netty-common` from 4.2.13.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.13.Final...netty-4.2.15.Final) Updates `io.netty:netty-transport` from 4.2.13.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.13.Final...netty-4.2.15.Final) Updates `io.netty:netty-handler` from 4.2.13.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.13.Final...netty-4.2.15.Final) Updates `io.netty:netty-handler-proxy` from 4.2.13.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.13.Final...netty-4.2.15.Final) Updates `io.netty:netty-resolver` from 4.2.13.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.13.Final...netty-4.2.15.Final) Updates `io.netty:netty-resolver-dns` from 4.2.13.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.13.Final...netty-4.2.15.Final) Updates `io.netty:netty-codec` from 4.2.13.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.13.Final...netty-4.2.15.Final) Updates `io.netty:netty-codec-http` from 4.2.13.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.13.Final...netty-4.2.15.Final) Updates `io.netty:netty-codec-http2` from 4.2.13.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.13.Final...netty-4.2.15.Final) Updates `io.netty:netty-buffer` from 4.2.13.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.13.Final...netty-4.2.15.Final) Updates `io.netty:netty-resolver-dns-native-macos` from 4.2.13.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.13.Final...netty-4.2.15.Final) Updates `io.netty:netty-transport` from 4.2.13.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.13.Final...netty-4.2.15.Final) Updates `io.netty:netty-handler` from 4.2.13.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.13.Final...netty-4.2.15.Final) Updates `io.netty:netty-handler-proxy` from 4.2.13.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.13.Final...netty-4.2.15.Final) Updates `io.netty:netty-resolver` from 4.2.13.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.13.Final...netty-4.2.15.Final) Updates `io.netty:netty-resolver-dns` from 4.2.13.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.13.Final...netty-4.2.15.Final) Updates `io.netty:netty-codec` from 4.2.13.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.13.Final...netty-4.2.15.Final) Updates `io.netty:netty-codec-http` from 4.2.13.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.13.Final...netty-4.2.15.Final) Updates `io.netty:netty-codec-http2` from 4.2.13.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.13.Final...netty-4.2.15.Final) Updates `io.netty:netty-buffer` from 4.2.13.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.13.Final...netty-4.2.15.Final) Updates `io.netty:netty-resolver-dns-native-macos` from 4.2.13.Final to 4.2.15.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.13.Final...netty-4.2.15.Final) --- updated-dependencies: - dependency-name: com.google.protobuf:protobuf-java-util dependency-version: 4.35.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-minor-and-patch - dependency-name: com.fasterxml.jackson.core:jackson-core dependency-version: 2.21.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: com.fasterxml.jackson.core:jackson-databind dependency-version: 2.21.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: com.fasterxml.jackson.datatype:jackson-datatype-jdk8 dependency-version: 2.21.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: com.fasterxml.jackson.datatype:jackson-datatype-jsr310 dependency-version: 2.21.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: com.fasterxml.jackson.module:jackson-module-kotlin dependency-version: 2.21.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-yaml dependency-version: 2.21.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: com.fasterxml.jackson.core:jackson-databind dependency-version: 2.21.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: com.fasterxml.jackson.datatype:jackson-datatype-jdk8 dependency-version: 2.21.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: com.fasterxml.jackson.datatype:jackson-datatype-jsr310 dependency-version: 2.21.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: com.fasterxml.jackson.module:jackson-module-kotlin dependency-version: 2.21.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: com.fasterxml.jackson.dataformat:jackson-dataformat-yaml dependency-version: 2.21.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: io.lettuce:lettuce-core dependency-version: 7.6.0.RELEASE dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle-minor-and-patch - dependency-name: io.netty:netty-common dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: io.netty:netty-transport dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: io.netty:netty-handler dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: io.netty:netty-handler-proxy dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: io.netty:netty-resolver dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: io.netty:netty-resolver-dns dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: io.netty:netty-codec dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: io.netty:netty-codec-http dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: io.netty:netty-codec-http2 dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: io.netty:netty-buffer dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: io.netty:netty-resolver-dns-native-macos dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: io.netty:netty-transport dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: io.netty:netty-handler dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: io.netty:netty-handler-proxy dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: io.netty:netty-resolver dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: io.netty:netty-resolver-dns dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: io.netty:netty-codec dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: io.netty:netty-codec-http dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: io.netty:netty-codec-http2 dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: io.netty:netty-buffer dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch - dependency-name: io.netty:netty-resolver-dns-native-macos dependency-version: 4.2.15.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-06-02T23:35:11Z

Labels

The following labels could not be found: gradle. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 2, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the gradle-minor-and-patch group across 1 directory with 19 updates#867

Bump the gradle-minor-and-patch group across 1 directory with 19 updates#867
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/gradle/master/gradle-minor-and-patch-1e341380f8

dependabot Bot commented on behalf of github Jun 2, 2026

Uh oh!

dependabot Bot commented on behalf of github Jun 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 2, 2026

7.6.0.RELEASE

✨ Highlights

Lettuce 7.6.0 RELEASE NOTES

✨ Highlights

netty-4.2.15.Final

Security fixes

What's Changed

New Contributors

netty-4.2.14.Final

What's Changed

netty-4.2.15.Final

Security fixes

What's Changed

New Contributors

netty-4.2.14.Final

What's Changed

netty-4.2.15.Final

Security fixes

What's Changed

New Contributors

netty-4.2.14.Final

What's Changed

netty-4.2.15.Final

Security fixes

Uh oh!

dependabot Bot commented on behalf of github Jun 2, 2026

Labels

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants