USPR-13776: bump io.netty resolutionStrategy override to 4.2.16.Final - #383
Open
midnight-clue[bot] wants to merge 1 commit into
Open
USPR-13776: bump io.netty resolutionStrategy override to 4.2.16.Final#383midnight-clue[bot] wants to merge 1 commit into
midnight-clue[bot] wants to merge 1 commit into
Conversation
Fixes GHSA-6jqx-86gh-f27w (Dependabot alert #105): unbounded SPDY SETTINGS frame map in io.netty:netty-codec-http, versions >= 4.2.0.Final and <= 4.2.15.Final. Bumps the existing resolutionStrategy override in the root build.gradle and the example modules' ext['netty.version'] properties from 4.2.15.Final to 4.2.16.Final. Co-Authored-By: Catarina Pinheiro Correia <catarina.correia@getyourguide.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context & Problem
GitHub Dependabot alert #105 flagged
io.netty:netty-codec-httpversions >= 4.2.0.Final and <= 4.2.15.Final as vulnerable to GHSA-6jqx-86gh-f27w (unbounded SPDY SETTINGS frame map, high severity). The patched version is 4.2.16.Final. The repo already has aresolutionStrategy.eachDependencyoverride in the rootbuild.gradlepinningio.nettyto 4.2.15.Final for prior CVEs, so this override needed to be bumped one patch version further.Jira: USPR-13776
Solution
Bumped the
io.nettyversion threshold/pinned version in the rootbuild.gradleresolutionStrategy override from4.2.15.Finalto4.2.16.Final, and appended GHSA-6jqx-86gh-f27w to thebecause(...)reason string. Also updatedext['netty.version']inexamples/example-spring-boot-starter-web/build.gradleandexamples/example-spring-boot-starter-webflux/build.gradlefrom4.2.15.Finalto4.2.16.Finalso the example modules stay in sync with the override and don't fight it.Verification
io.netty:netty-codec-http(and otherio.nettyartifacts) resolve to >= 4.2.16.Final across subprojects (verified via./gradlew :examples:example-spring-boot-starter-webflux:dependencies --configuration runtimeClasspath, which showedio.netty:netty-codec-http:4.2.12.Final -> 4.2.16.Finaland all otherio.netty:*artifacts resolved to4.2.16.Final)build.gradleresolutionStrategy override bumped from 4.2.15.Final to 4.2.16.Final with GHSA-6jqx-86gh-f27w documented in thebecausestringext['netty.version']kept in sync (4.2.16.Final)🔍 Braintrust trace