From d8b761b0910f8b8a1aa5b769dd7fb40680ef6dea Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 30 Jul 2026 15:56:51 +0000 Subject: [PATCH 1/3] fix(deps): force io.netty to >= 4.2.16.Final for GHSA-6cqp-g7gg-8hr5 USPR-13773 Co-Authored-By: Catarina Correia --- build.gradle | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/build.gradle b/build.gradle index a256197..cafa326 100644 --- a/build.gradle +++ b/build.gradle @@ -49,13 +49,14 @@ subprojects { because('GHSA-rv64-5gf8-9qq8 / GHSA-x4m4-345f-5h5g / GHSA-24j9-x2wg-9qv6 / GHSA-gx5v-xp9w-j4cg: Apache Tomcat < 11.0.22 vulnerabilities') } if (requested.group == 'io.netty' - && requested.version != null && requested.version < '4.2.15.Final') { - useVersion('4.2.15.Final') + && requested.version != null && requested.version < '4.2.16.Final') { + useVersion('4.2.16.Final') because('GHSA-38f8-5428-x5cv: HTTP Request Smuggling in io.netty:netty-codec-http via malformed Transfer-Encoding headers; ' + 'GHSA-3qp7-7mw8-wx86 / GHSA-c2rx-5r8w-8xr2 / GHSA-cmm3-54f8-px4j / GHSA-x4gw-5cx5-pgmh / GHSA-676x-f7gg-47vc / ' + 'GHSA-5pvg-856g-cp85 / GHSA-4grm-h2qv-h6w6 / GHSA-c653-97m9-rcg9 / GHSA-563q-j3cm-6jxm / GHSA-hvcg-qmg6-jm4c / ' + 'GHSA-cq4q-cv5g-r8q5 / GHSA-c2gf-v879-257j / GHSA-5x3r-wrvg-rp6q / GHSA-xmv7-r254-6q78 / GHSA-w573-9ffj-6ff9: ' + - 'multiple Netty vulnerabilities fixed in 4.2.15.Final') + 'multiple Netty vulnerabilities fixed in 4.2.15.Final; ' + + 'GHSA-6cqp-g7gg-8hr5: Security Control Bypass via CORS Short-Circuit Failure fixed in 4.2.16.Final') } } } From afddf19c3a6bbad4b5694446725862864890a859 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 30 Jul 2026 16:03:41 +0000 Subject: [PATCH 2/3] fix(deps): bump example netty.version BOM override to 4.2.16.Final The Spring dependency-management BOM override in the example modules takes precedence over the root resolutionStrategy.eachDependency block and must be bumped in lockstep, per the pattern established in USPR-13707. This ensures io.netty dependencies in the example projects are forced to 4.2.16.Final, matching the security baseline. USPR-13773 Co-Authored-By: Catarina Correia --- examples/example-spring-boot-starter-web/build.gradle | 2 +- examples/example-spring-boot-starter-webflux/build.gradle | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/examples/example-spring-boot-starter-web/build.gradle b/examples/example-spring-boot-starter-web/build.gradle index fe3a054..6f5b6d6 100644 --- a/examples/example-spring-boot-starter-web/build.gradle +++ b/examples/example-spring-boot-starter-web/build.gradle @@ -8,7 +8,7 @@ plugins { ext['jackson-bom.version'] = '3.1.4' ext['jackson-2-bom.version'] = '2.21.5' ext['logback.version'] = '1.5.34' -ext['netty.version'] = '4.2.15.Final' +ext['netty.version'] = '4.2.16.Final' ext['tomcat.version'] = '11.0.22' dependencies { diff --git a/examples/example-spring-boot-starter-webflux/build.gradle b/examples/example-spring-boot-starter-webflux/build.gradle index fc6dfe6..94c60a6 100644 --- a/examples/example-spring-boot-starter-webflux/build.gradle +++ b/examples/example-spring-boot-starter-webflux/build.gradle @@ -8,7 +8,7 @@ plugins { ext['jackson-bom.version'] = '3.1.4' ext['jackson-2-bom.version'] = '2.21.5' ext['logback.version'] = '1.5.34' -ext['netty.version'] = '4.2.15.Final' +ext['netty.version'] = '4.2.16.Final' ext['tomcat.version'] = '11.0.22' dependencies { From 58703d3581290ff4a68390f77ccf0188a66eaa61 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 30 Jul 2026 16:08:34 +0000 Subject: [PATCH 3/3] test(deps): add automated verification task for enforced io.netty version Adds a `verifyNettyVersion` Gradle task wired into the `check` task that fails the build if any resolved `io.netty` dependency is below 4.2.16.Final. This gives automated regression coverage for GHSA-6cqp-g7gg-8hr5 across all subprojects (including examples, where a BOM override previously caused a silent regression that manual checks missed). The task runs per-subproject and iterates all resolvable configurations, checking each resolved module dependency against the enforced minimum version, using the same string-comparison style (`version < '4.2.16.Final'`) already established in the existing resolutionStrategy.eachDependency block for consistency. USPR-13773 Co-Authored-By: Catarina Correia --- build.gradle | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/build.gradle b/build.gradle index cafa326..c737477 100644 --- a/build.gradle +++ b/build.gradle @@ -61,6 +61,29 @@ subprojects { } } + tasks.register('verifyNettyVersion') { + group = 'verification' + description = 'Fails the build if any io.netty dependency resolves below the enforced minimum version (GHSA-6cqp-g7gg-8hr5).' + def minNettyVersion = '4.2.16.Final' + doLast { + def offending = [] + configurations.matching { it.canBeResolved }.each { config -> + config.resolvedConfiguration.lenientConfiguration.allModuleDependencies.each { dep -> + if (dep.moduleGroup == 'io.netty' && dep.moduleVersion < minNettyVersion) { + offending << "${config.name}: ${dep.moduleGroup}:${dep.moduleName}:${dep.moduleVersion}" + } + } + } + if (!offending.isEmpty()) { + throw new GradleException("Found io.netty dependencies resolved below ${minNettyVersion}:\n" + offending.join('\n')) + } + } + } + + tasks.withType(Task).matching { it.name == 'check' }.all { checkTask -> + checkTask.dependsOn tasks.named('verifyNettyVersion') + } + if(it.parent.name == 'examples') { apply plugin: 'java' } else {