ARTEMIS-X Bump netty.version from 4.1.132.Final to 4.1.133.Final by dependabot[bot] · Pull Request #6414 · apache/artemis

dependabot · 2026-05-05T04:07:34Z

Bumps netty.version from 4.1.132.Final to 4.1.133.Final.
Updates io.netty:netty-buffer from 4.1.132.Final to 4.1.133.Final

Release notes

Sourced from io.netty:netty-buffer's releases.

netty-4.1.133.Final

CVEs Fixed

CVE-2026-42586 (netty-codec-redis)

CVE-2026-42578 (netty-handler-proxy)

CVE-2026-42587 (netty-codec-http, netty-codec-http2)

CVE-2026-41417 (netty-codec-http)

CVE-2026-42581 (netty-codec-http)

CVE-2026-42580 (netty-codec-http)

CVE-2026-42585 (netty-codec-http)

CVE-2026-42579 (netty-codec-dns)

CVE-2026-42582 (netty-codec-http3)

CVE-2026-42583 (netty-codec, netty-codec-compression)

CVE-2026-42584 (netty-codec-http)

CVE-2026-XXXXX (netty-codec-mqtt)

What's Changed

Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by @daguimu in netty/netty#16539

Auto-port 4.1: Fix implementation of strerror_r_xsi for GNU by @netty-project-bot in netty/netty#16561

Auto-port 4.1: Replace usage of strerror with thread-safe alternative by @netty-project-bot in netty/netty#16555

Auto-port 4.1: Kqueue: sendfile EINTR doesn't advance offset — data duplication by @netty-project-bot in netty/netty#16554

Auto-port 4.1: Avoid leak in PemReader on OutOfDirectMemoryError by @netty-project-bot in netty/netty#16576

Auto-port 4.1: Native DNS resolver: Guard against malloc failures by @netty-project-bot in netty/netty#16584

Auto-port 4.1: Include user properties and subscription IDs in MqttProperties#isEmpty by @netty-project-bot in netty/netty#16582

Auto-port 4.1: Fix parsing HTTP chunks with multiple extensions by @netty-project-bot in netty/netty#16588

Auto-port 4.1: Stabilize read-only toStringMultipleThreads1 by @netty-project-bot in netty/netty#16610

Auto-port 4.1: Epoll: Cleanup code to always return negative value on failure by @netty-project-bot in netty/netty#16601

Auto-port 4.1: Stabilize more AbstractByteBufTests by @netty-project-bot in netty/netty#16613

Auto-port 4.1: Stabilize testSessionInvalidate for Conscrypt by @netty-project-bot in netty/netty#16616

Auto-port 4.1: Native transports: Correctly create pipe when pipe2 is not supported by @netty-project-bot in netty/netty#16598

Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by @daguimu in netty/netty#16558

Fix shutdownInput bug in kqueue for empty recv buffer (#16630) by @normanmaurer in netty/netty#16638

Auto-port 4.1: Kqueue: Fix usage of LOCAL_PEERPID by @netty-project-bot in netty/netty#16646

Auto-port 4.1: HTTP2: Ensure HTTP2 preface is always send as first message by @netty-project-bot in netty/netty#16642

Auto-port 4.1: Propagate exceptions from inner threads in buffer tests by @netty-project-bot in netty/netty#16652

Auto-port 4.1: Add maxFrameLength support to ProtobufVarint32FrameDecoder by @netty-project-bot in netty/netty#16658

Auto-port 4.1: Bump up netty-tcnative to 2.0.76.Final by @netty-project-bot in netty/netty#16672

HTTP2: Ensure HTTP2 preface is always send as first message (also on … by @chrisvest in netty/netty#16675

Improve flaky NioSocketChannelTest (#16679) by @normanmaurer in netty/netty#16681

Deprecate ObjectCleaner and remove usage (#16685) by @chrisvest in netty/netty#16694

Auto-port 4.1: Update to netty-tcnative 2.0.77.Final by @netty-project-bot in netty/netty#16695

Avoid NPE in JdkSslServerContext when TrustManagerFactory returns null by @daguimu in netty/netty#16691

Avoid NPE in JdkSslClientContext when TrustManagerFactory returns null by @daguimu in netty/netty#16690

Auto-port 4.1: Avoid TCPFastOpen in KQueueCompositeBufferGatheringWriteTest by @netty-project-bot in netty/netty#16699

Auto-port 4.1: SCTP: Correctly handle SO_BACKLOG by @netty-project-bot in netty/netty#16715

Fix DiscardClient hang under -Dssl by using a client SSL context by @daguimu in netty/netty#16717

Auto-port 4.1: Consolidate fake exceptions in HTTP/2 tests into Http2TestUtil by @netty-project-bot in netty/netty#16725

Auto-port 4.1: Activate noPrintGC by default by @netty-project-bot in netty/netty#16735

Merge commit from fork by @normanmaurer in netty/netty#16742

New Contributors

... (truncated)

Commits

fb13125 [maven-release-plugin] prepare release netty-4.1.133.Final
815f71a Fix compilation after multiple backports
1986c38 Merge commit from fork
6f69dc9 Merge commit from fork
bf78040 Fix BrotliDecoder not forwarding all decompressed chunks
387bbd0 Merge commit from fork
417ebaa Fix codec-dns tests
3c091ab Merge commit from fork
5d60b87 Fix checkstyle in HttpObjectDecoder
485f11d Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-transport from 4.1.132.Final to 4.1.133.Final

Release notes

Sourced from io.netty:netty-transport's releases.

netty-4.1.133.Final

CVEs Fixed

CVE-2026-42586 (netty-codec-redis)

CVE-2026-42578 (netty-handler-proxy)

CVE-2026-42587 (netty-codec-http, netty-codec-http2)

CVE-2026-41417 (netty-codec-http)

CVE-2026-42581 (netty-codec-http)

CVE-2026-42580 (netty-codec-http)

CVE-2026-42585 (netty-codec-http)

CVE-2026-42579 (netty-codec-dns)

CVE-2026-42582 (netty-codec-http3)

CVE-2026-42583 (netty-codec, netty-codec-compression)

CVE-2026-42584 (netty-codec-http)

CVE-2026-XXXXX (netty-codec-mqtt)

What's Changed

Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by @daguimu in netty/netty#16539

Auto-port 4.1: Fix implementation of strerror_r_xsi for GNU by @netty-project-bot in netty/netty#16561

Auto-port 4.1: Replace usage of strerror with thread-safe alternative by @netty-project-bot in netty/netty#16555

Auto-port 4.1: Kqueue: sendfile EINTR doesn't advance offset — data duplication by @netty-project-bot in netty/netty#16554

Auto-port 4.1: Avoid leak in PemReader on OutOfDirectMemoryError by @netty-project-bot in netty/netty#16576

Auto-port 4.1: Native DNS resolver: Guard against malloc failures by @netty-project-bot in netty/netty#16584

Auto-port 4.1: Include user properties and subscription IDs in MqttProperties#isEmpty by @netty-project-bot in netty/netty#16582

Auto-port 4.1: Fix parsing HTTP chunks with multiple extensions by @netty-project-bot in netty/netty#16588

Auto-port 4.1: Stabilize read-only toStringMultipleThreads1 by @netty-project-bot in netty/netty#16610

Auto-port 4.1: Epoll: Cleanup code to always return negative value on failure by @netty-project-bot in netty/netty#16601

Auto-port 4.1: Stabilize more AbstractByteBufTests by @netty-project-bot in netty/netty#16613

Auto-port 4.1: Stabilize testSessionInvalidate for Conscrypt by @netty-project-bot in netty/netty#16616

Auto-port 4.1: Native transports: Correctly create pipe when pipe2 is not supported by @netty-project-bot in netty/netty#16598

Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by @daguimu in netty/netty#16558

Fix shutdownInput bug in kqueue for empty recv buffer (#16630) by @normanmaurer in netty/netty#16638

Auto-port 4.1: Kqueue: Fix usage of LOCAL_PEERPID by @netty-project-bot in netty/netty#16646

Auto-port 4.1: HTTP2: Ensure HTTP2 preface is always send as first message by @netty-project-bot in netty/netty#16642

Auto-port 4.1: Propagate exceptions from inner threads in buffer tests by @netty-project-bot in netty/netty#16652

Auto-port 4.1: Add maxFrameLength support to ProtobufVarint32FrameDecoder by @netty-project-bot in netty/netty#16658

Auto-port 4.1: Bump up netty-tcnative to 2.0.76.Final by @netty-project-bot in netty/netty#16672

HTTP2: Ensure HTTP2 preface is always send as first message (also on … by @chrisvest in netty/netty#16675

Improve flaky NioSocketChannelTest (#16679) by @normanmaurer in netty/netty#16681

Deprecate ObjectCleaner and remove usage (#16685) by @chrisvest in netty/netty#16694

Auto-port 4.1: Update to netty-tcnative 2.0.77.Final by @netty-project-bot in netty/netty#16695

Avoid NPE in JdkSslServerContext when TrustManagerFactory returns null by @daguimu in netty/netty#16691

Avoid NPE in JdkSslClientContext when TrustManagerFactory returns null by @daguimu in netty/netty#16690

Auto-port 4.1: Avoid TCPFastOpen in KQueueCompositeBufferGatheringWriteTest by @netty-project-bot in netty/netty#16699

Auto-port 4.1: SCTP: Correctly handle SO_BACKLOG by @netty-project-bot in netty/netty#16715

Fix DiscardClient hang under -Dssl by using a client SSL context by @daguimu in netty/netty#16717

Auto-port 4.1: Consolidate fake exceptions in HTTP/2 tests into Http2TestUtil by @netty-project-bot in netty/netty#16725

Auto-port 4.1: Activate noPrintGC by default by @netty-project-bot in netty/netty#16735

Merge commit from fork by @normanmaurer in netty/netty#16742

New Contributors

... (truncated)

Commits

fb13125 [maven-release-plugin] prepare release netty-4.1.133.Final
815f71a Fix compilation after multiple backports
1986c38 Merge commit from fork
6f69dc9 Merge commit from fork
bf78040 Fix BrotliDecoder not forwarding all decompressed chunks
387bbd0 Merge commit from fork
417ebaa Fix codec-dns tests
3c091ab Merge commit from fork
5d60b87 Fix checkstyle in HttpObjectDecoder
485f11d Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-handler from 4.1.132.Final to 4.1.133.Final

Release notes

Sourced from io.netty:netty-handler's releases.

netty-4.1.133.Final

CVEs Fixed

CVE-2026-42586 (netty-codec-redis)

CVE-2026-42578 (netty-handler-proxy)

CVE-2026-42587 (netty-codec-http, netty-codec-http2)

CVE-2026-41417 (netty-codec-http)

CVE-2026-42581 (netty-codec-http)

CVE-2026-42580 (netty-codec-http)

CVE-2026-42585 (netty-codec-http)

CVE-2026-42579 (netty-codec-dns)

CVE-2026-42582 (netty-codec-http3)

CVE-2026-42583 (netty-codec, netty-codec-compression)

CVE-2026-42584 (netty-codec-http)

CVE-2026-XXXXX (netty-codec-mqtt)

What's Changed

Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by @daguimu in netty/netty#16539

Auto-port 4.1: Fix implementation of strerror_r_xsi for GNU by @netty-project-bot in netty/netty#16561

Auto-port 4.1: Replace usage of strerror with thread-safe alternative by @netty-project-bot in netty/netty#16555

Auto-port 4.1: Kqueue: sendfile EINTR doesn't advance offset — data duplication by @netty-project-bot in netty/netty#16554

Auto-port 4.1: Avoid leak in PemReader on OutOfDirectMemoryError by @netty-project-bot in netty/netty#16576

Auto-port 4.1: Native DNS resolver: Guard against malloc failures by @netty-project-bot in netty/netty#16584

Auto-port 4.1: Include user properties and subscription IDs in MqttProperties#isEmpty by @netty-project-bot in netty/netty#16582

Auto-port 4.1: Fix parsing HTTP chunks with multiple extensions by @netty-project-bot in netty/netty#16588

Auto-port 4.1: Stabilize read-only toStringMultipleThreads1 by @netty-project-bot in netty/netty#16610

Auto-port 4.1: Epoll: Cleanup code to always return negative value on failure by @netty-project-bot in netty/netty#16601

Auto-port 4.1: Stabilize more AbstractByteBufTests by @netty-project-bot in netty/netty#16613

Auto-port 4.1: Stabilize testSessionInvalidate for Conscrypt by @netty-project-bot in netty/netty#16616

Auto-port 4.1: Native transports: Correctly create pipe when pipe2 is not supported by @netty-project-bot in netty/netty#16598

Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by @daguimu in netty/netty#16558

Fix shutdownInput bug in kqueue for empty recv buffer (#16630) by @normanmaurer in netty/netty#16638

Auto-port 4.1: Kqueue: Fix usage of LOCAL_PEERPID by @netty-project-bot in netty/netty#16646

Auto-port 4.1: HTTP2: Ensure HTTP2 preface is always send as first message by @netty-project-bot in netty/netty#16642

Auto-port 4.1: Propagate exceptions from inner threads in buffer tests by @netty-project-bot in netty/netty#16652

Auto-port 4.1: Add maxFrameLength support to ProtobufVarint32FrameDecoder by @netty-project-bot in netty/netty#16658

Auto-port 4.1: Bump up netty-tcnative to 2.0.76.Final by @netty-project-bot in netty/netty#16672

HTTP2: Ensure HTTP2 preface is always send as first message (also on … by @chrisvest in netty/netty#16675

Improve flaky NioSocketChannelTest (#16679) by @normanmaurer in netty/netty#16681

Deprecate ObjectCleaner and remove usage (#16685) by @chrisvest in netty/netty#16694

Auto-port 4.1: Update to netty-tcnative 2.0.77.Final by @netty-project-bot in netty/netty#16695

Avoid NPE in JdkSslServerContext when TrustManagerFactory returns null by @daguimu in netty/netty#16691

Avoid NPE in JdkSslClientContext when TrustManagerFactory returns null by @daguimu in netty/netty#16690

Auto-port 4.1: Avoid TCPFastOpen in KQueueCompositeBufferGatheringWriteTest by @netty-project-bot in netty/netty#16699

Auto-port 4.1: SCTP: Correctly handle SO_BACKLOG by @netty-project-bot in netty/netty#16715

Fix DiscardClient hang under -Dssl by using a client SSL context by @daguimu in netty/netty#16717

Auto-port 4.1: Consolidate fake exceptions in HTTP/2 tests into Http2TestUtil by @netty-project-bot in netty/netty#16725

Auto-port 4.1: Activate noPrintGC by default by @netty-project-bot in netty/netty#16735

Merge commit from fork by @normanmaurer in netty/netty#16742

New Contributors

... (truncated)

Commits

fb13125 [maven-release-plugin] prepare release netty-4.1.133.Final
815f71a Fix compilation after multiple backports
1986c38 Merge commit from fork
6f69dc9 Merge commit from fork
bf78040 Fix BrotliDecoder not forwarding all decompressed chunks
387bbd0 Merge commit from fork
417ebaa Fix codec-dns tests
3c091ab Merge commit from fork
5d60b87 Fix checkstyle in HttpObjectDecoder
485f11d Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-handler-proxy from 4.1.132.Final to 4.1.133.Final

Release notes

Sourced from io.netty:netty-handler-proxy's releases.

netty-4.1.133.Final

CVEs Fixed

CVE-2026-42586 (netty-codec-redis)

CVE-2026-42578 (netty-handler-proxy)

CVE-2026-42587 (netty-codec-http, netty-codec-http2)

CVE-2026-41417 (netty-codec-http)

CVE-2026-42581 (netty-codec-http)

CVE-2026-42580 (netty-codec-http)

CVE-2026-42585 (netty-codec-http)

CVE-2026-42579 (netty-codec-dns)

CVE-2026-42582 (netty-codec-http3)

CVE-2026-42583 (netty-codec, netty-codec-compression)

CVE-2026-42584 (netty-codec-http)

CVE-2026-XXXXX (netty-codec-mqtt)

What's Changed

Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by @daguimu in netty/netty#16539

Auto-port 4.1: Fix implementation of strerror_r_xsi for GNU by @netty-project-bot in netty/netty#16561

Auto-port 4.1: Replace usage of strerror with thread-safe alternative by @netty-project-bot in netty/netty#16555

Auto-port 4.1: Kqueue: sendfile EINTR doesn't advance offset — data duplication by @netty-project-bot in netty/netty#16554

Auto-port 4.1: Avoid leak in PemReader on OutOfDirectMemoryError by @netty-project-bot in netty/netty#16576

Auto-port 4.1: Native DNS resolver: Guard against malloc failures by @netty-project-bot in netty/netty#16584

Auto-port 4.1: Include user properties and subscription IDs in MqttProperties#isEmpty by @netty-project-bot in netty/netty#16582

Auto-port 4.1: Fix parsing HTTP chunks with multiple extensions by @netty-project-bot in netty/netty#16588

Auto-port 4.1: Stabilize read-only toStringMultipleThreads1 by @netty-project-bot in netty/netty#16610

Auto-port 4.1: Epoll: Cleanup code to always return negative value on failure by @netty-project-bot in netty/netty#16601

Auto-port 4.1: Stabilize more AbstractByteBufTests by @netty-project-bot in netty/netty#16613

Auto-port 4.1: Stabilize testSessionInvalidate for Conscrypt by @netty-project-bot in netty/netty#16616

Auto-port 4.1: Native transports: Correctly create pipe when pipe2 is not supported by @netty-project-bot in netty/netty#16598

Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by @daguimu in netty/netty#16558

Fix shutdownInput bug in kqueue for empty recv buffer (#16630) by @normanmaurer in netty/netty#16638

Auto-port 4.1: Kqueue: Fix usage of LOCAL_PEERPID by @netty-project-bot in netty/netty#16646

Auto-port 4.1: HTTP2: Ensure HTTP2 preface is always send as first message by @netty-project-bot in netty/netty#16642

Auto-port 4.1: Propagate exceptions from inner threads in buffer tests by @netty-project-bot in netty/netty#16652

Auto-port 4.1: Add maxFrameLength support to ProtobufVarint32FrameDecoder by @netty-project-bot in netty/netty#16658

Auto-port 4.1: Bump up netty-tcnative to 2.0.76.Final by @netty-project-bot in netty/netty#16672

HTTP2: Ensure HTTP2 preface is always send as first message (also on … by @chrisvest in netty/netty#16675

Improve flaky NioSocketChannelTest (#16679) by @normanmaurer in netty/netty#16681

Deprecate ObjectCleaner and remove usage (#16685) by @chrisvest in netty/netty#16694

Auto-port 4.1: Update to netty-tcnative 2.0.77.Final by @netty-project-bot in netty/netty#16695

Avoid NPE in JdkSslServerContext when TrustManagerFactory returns null by @daguimu in netty/netty#16691

Avoid NPE in JdkSslClientContext when TrustManagerFactory returns null by @daguimu in netty/netty#16690

Auto-port 4.1: Avoid TCPFastOpen in KQueueCompositeBufferGatheringWriteTest by @netty-project-bot in netty/netty#16699

Auto-port 4.1: SCTP: Correctly handle SO_BACKLOG by @netty-project-bot in netty/netty#16715

Fix DiscardClient hang under -Dssl by using a client SSL context by @daguimu in netty/netty#16717

Auto-port 4.1: Consolidate fake exceptions in HTTP/2 tests into Http2TestUtil by @netty-project-bot in netty/netty#16725

Auto-port 4.1: Activate noPrintGC by default by @netty-project-bot in netty/netty#16735

Merge commit from fork by @normanmaurer in netty/netty#16742

New Contributors

... (truncated)

Commits

fb13125 [maven-release-plugin] prepare release netty-4.1.133.Final
815f71a Fix compilation after multiple backports
1986c38 Merge commit from fork
6f69dc9 Merge commit from fork
bf78040 Fix BrotliDecoder not forwarding all decompressed chunks
387bbd0 Merge commit from fork
417ebaa Fix codec-dns tests
3c091ab Merge commit from fork
5d60b87 Fix checkstyle in HttpObjectDecoder
485f11d Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-codec from 4.1.132.Final to 4.1.133.Final

Release notes

Sourced from io.netty:netty-codec's releases.

netty-4.1.133.Final

CVEs Fixed

CVE-2026-42586 (netty-codec-redis)

CVE-2026-42578 (netty-handler-proxy)

CVE-2026-42587 (netty-codec-http, netty-codec-http2)

CVE-2026-41417 (netty-codec-http)

CVE-2026-42581 (netty-codec-http)

CVE-2026-42580 (netty-codec-http)

CVE-2026-42585 (netty-codec-http)

CVE-2026-42579 (netty-codec-dns)

CVE-2026-42582 (netty-codec-http3)

CVE-2026-42583 (netty-codec, netty-codec-compression)

CVE-2026-42584 (netty-codec-http)

CVE-2026-XXXXX (netty-codec-mqtt)

What's Changed

Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by @daguimu in netty/netty#16539

Auto-port 4.1: Fix implementation of strerror_r_xsi for GNU by @netty-project-bot in netty/netty#16561

Auto-port 4.1: Replace usage of strerror with thread-safe alternative by @netty-project-bot in netty/netty#16555

Auto-port 4.1: Kqueue: sendfile EINTR doesn't advance offset — data duplication by @netty-project-bot in netty/netty#16554

Auto-port 4.1: Avoid leak in PemReader on OutOfDirectMemoryError by @netty-project-bot in netty/netty#16576

Auto-port 4.1: Native DNS resolver: Guard against malloc failures by @netty-project-bot in netty/netty#16584

Auto-port 4.1: Include user properties and subscription IDs in MqttProperties#isEmpty by @netty-project-bot in netty/netty#16582

Auto-port 4.1: Fix parsing HTTP chunks with multiple extensions by @netty-project-bot in netty/netty#16588

Auto-port 4.1: Stabilize read-only toStringMultipleThreads1 by @netty-project-bot in netty/netty#16610

Auto-port 4.1: Epoll: Cleanup code to always return negative value on failure by @netty-project-bot in netty/netty#16601

Auto-port 4.1: Stabilize more AbstractByteBufTests by @netty-project-bot in netty/netty#16613

Auto-port 4.1: Stabilize testSessionInvalidate for Conscrypt by @netty-project-bot in netty/netty#16616

Auto-port 4.1: Native transports: Correctly create pipe when pipe2 is not supported by @netty-project-bot in netty/netty#16598

Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by @daguimu in netty/netty#16558

Fix shutdownInput bug in kqueue for empty recv buffer (#16630) by @normanmaurer in netty/netty#16638

Auto-port 4.1: Kqueue: Fix usage of LOCAL_PEERPID by @netty-project-bot in netty/netty#16646

Auto-port 4.1: HTTP2: Ensure HTTP2 preface is always send as first message by @netty-project-bot in netty/netty#16642

Auto-port 4.1: Propagate exceptions from inner threads in buffer tests by @netty-project-bot in netty/netty#16652

Auto-port 4.1: Add maxFrameLength support to ProtobufVarint32FrameDecoder by @netty-project-bot in netty/netty#16658

Auto-port 4.1: Bump up netty-tcnative to 2.0.76.Final by @netty-project-bot in netty/netty#16672

HTTP2: Ensure HTTP2 preface is always send as first message (also on … by @chrisvest in netty/netty#16675

Improve flaky NioSocketChannelTest (#16679) by @normanmaurer in netty/netty#16681

Deprecate ObjectCleaner and remove usage (#16685) by @chrisvest in netty/netty#16694

Auto-port 4.1: Update to netty-tcnative 2.0.77.Final by @netty-project-bot in netty/netty#16695

Avoid NPE in JdkSslServerContext when TrustManagerFactory returns null by @daguimu in netty/netty#16691

Avoid NPE in JdkSslClientContext when TrustManagerFactory returns null by @daguimu in netty/netty#16690

Auto-port 4.1: Avoid TCPFastOpen in KQueueCompositeBufferGatheringWriteTest by @netty-project-bot in netty/netty#16699

Auto-port 4.1: SCTP: Correctly handle SO_BACKLOG by @netty-project-bot in netty/netty#16715

Fix DiscardClient hang under -Dssl by using a client SSL context by @daguimu in netty/netty#16717

Auto-port 4.1: Consolidate fake exceptions in HTTP/2 tests into Http2TestUtil by @netty-project-bot in netty/netty#16725

Auto-port 4.1: Activate noPrintGC by default by @netty-project-bot in netty/netty#16735

Merge commit from fork by @normanmaurer in netty/netty#16742

New Contributors

... (truncated)

Commits

fb13125 [maven-release-plugin] prepare release netty-4.1.133.Final
815f71a Fix compilation after multiple backports
1986c38 Merge commit from fork
6f69dc9 Merge commit from fork
bf78040 Fix BrotliDecoder not forwarding all decompressed chunks
387bbd0 Merge commit from fork
417ebaa Fix codec-dns tests
3c091ab Merge commit from fork
5d60b87 Fix checkstyle in HttpObjectDecoder
485f11d Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-codec-http from 4.1.132.Final to 4.1.133.Final

Release notes

Sourced from io.netty:netty-codec-http's releases.

netty-4.1.133.Final

CVEs Fixed

CVE-2026-42586 (netty-codec-redis)

CVE-2026-42578 (netty-handler-proxy)

CVE-2026-42587 (netty-codec-http, netty-codec-http2)

CVE-2026-41417 (netty-codec-http)

CVE-2026-42581 (netty-codec-http)

CVE-2026-42580 (netty-codec-http)

CVE-2026-42585 (netty-codec-http)

CVE-2026-42579 (netty-codec-dns)

CVE-2026-42582 (netty-codec-http3)

CVE-2026-42583 (netty-codec, netty-codec-compression)

CVE-2026-42584 (netty-codec-http)

CVE-2026-XXXXX (netty-codec-mqtt)

What's Changed

Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by @daguimu in netty/netty#16539

Auto-port 4.1: Fix implementation of strerror_r_xsi for GNU by @netty-project-bot in netty/netty#16561

Auto-port 4.1: Replace usage of strerror with thread-safe alternative by @netty-project-bot in netty/netty#16555

Auto-port 4.1: Kqueue: sendfile EINTR doesn't advance offset — data duplication by @netty-project-bot in netty/netty#16554

Auto-port 4.1: Avoid leak in PemReader on OutOfDirectMemoryError by @netty-project-bot in netty/netty#16576

Auto-port 4.1: Native DNS resolver: Guard against malloc failures by @netty-project-bot in netty/netty#16584

Auto-port 4.1: Include user properties and subscription IDs in MqttProperties#isEmpty by @netty-project-bot in netty/netty#16582

Auto-port 4.1: Fix parsing HTTP chunks with multiple extensions by @netty-project-bot in netty/netty#16588

Auto-port 4.1: Stabilize read-only toStringMultipleThreads1 by @netty-project-bot in netty/netty#16610

Auto-port 4.1: Epoll: Cleanup code to always return negative value on failure by @netty-project-bot in netty/netty#16601

Auto-port 4.1: Stabilize more AbstractByteBufTests by @netty-project-bot in netty/netty#16613

Auto-port 4.1: Stabilize testSessionInvalidate for Conscrypt by @netty-project-bot in netty/netty#16616

Auto-port 4.1: Native transports: Correctly create pipe when pipe2 is not supported by @netty-project-bot in netty/netty#16598

Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by @daguimu in netty/netty#16558

Fix shutdownInput bug in kqueue for empty recv buffer (#16630) by @normanmaurer in netty/netty#16638

Auto-port 4.1: Kqueue: Fix usage of LOCAL_PEERPID by @netty-project-bot in netty/netty#16646

Auto-port 4.1: HTTP2: Ensure HTTP2 preface is always send as first message by @netty-project-bot in netty/netty#16642

Auto-port 4.1: Propagate exceptions from inner threads in buffer tests by @netty-project-bot in netty/netty#16652

Auto-port 4.1: Add maxFrameLength support to ProtobufVarint32FrameDecoder by @netty-project-bot in netty/netty#16658

Auto-port 4.1: Bump up netty-tcnative to 2.0.76.Final by @netty-project-bot in netty/netty#16672

HTTP2: Ensure HTTP2 preface is always send as first message (also on … by @chrisvest in netty/netty#16675

Improve flaky NioSocketChannelTest (#16679) by @normanmaurer in netty/netty#16681

Deprecate ObjectCleaner and remove usage (#16685) by @chrisvest in netty/netty#16694

Auto-port 4.1: Update to netty-tcnative 2.0.77.Final by @netty-project-bot in netty/netty#16695

Avoid NPE in JdkSslServerContext when TrustManagerFactory returns null by @daguimu in netty/netty#16691

Avoid NPE in JdkSslClientContext when TrustManagerFactory returns null by @daguimu in netty/netty#16690

Auto-port 4.1: Avoid TCPFastOpen in KQueueCompositeBufferGatheringWriteTest by @netty-project-bot in netty/netty#16699

Auto-port 4.1: SCTP: Correctly handle SO_BACKLOG by @netty-project-bot in netty/netty#16715

Fix DiscardClient hang under -Dssl by using a client SSL context by @daguimu in netty/netty#16717

Auto-port 4.1: Consolidate fake exceptions in HTTP/2 tests into Http2TestUtil by @netty-project-bot in netty/netty#16725

Auto-port 4.1: Activate noPrintGC by default by @netty-project-bot in netty/netty#16735

Merge commit from fork by @normanmaurer in netty/netty#16742

New Contributors

... (truncated)

Commits

fb13125 [maven-release-plugin] prepare release netty-4.1.133.Final
815f71a Fix compilation after multiple backports
1986c38 Merge commit from fork
6f69dc9 Merge commit from fork
bf78040 Fix BrotliDecoder not forwarding all decompressed chunks
387bbd0 Merge commit from fork
417ebaa Fix codec-dns tests
3c091ab Merge commit from fork
5d60b87 Fix checkstyle in HttpObjectDecoder
485f11d Merge commit from fork
Additional commits viewable in compare view

Updates io.netty:netty-codec-mqtt from 4.1.132.Final to 4.1.133.Final

Release notes

Sourced from io.netty:netty-codec-mqtt's releases.

netty-4.1.133.Final

CVEs Fixed

CVE-2026-42586 (netty-codec-redis)

CVE-2026-42578 (netty-handler-proxy)

CVE-2026-42587 (netty-codec-http, netty-codec-http2)

CVE-2026-41417 (netty-codec-http)

CVE-2026-42581 (netty-codec-http)

CVE-2026-42580 (netty-codec-http)

CVE-2026-42585 (netty-codec-http)

CVE-2026-42579 (netty-codec-dns)

CVE-2026-42582 (netty-codec-http3)

CVE-2026-42583 (netty-codec, netty-codec-compression)

CVE-2026-42584 (netty-codec-http)

CVE-2026-XXXXX (netty-codec-mqtt)

What's Changed

Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by @daguimu in netty/netty#16539

Auto-port 4.1: Fix implementation of strerror_r_xsi for GNU by <...
Description has been truncated

Bumps `netty.version` from 4.1.132.Final to 4.1.133.Final. Updates `io.netty:netty-buffer` from 4.1.132.Final to 4.1.133.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.1.133.Final) Updates `io.netty:netty-transport` from 4.1.132.Final to 4.1.133.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.1.133.Final) Updates `io.netty:netty-handler` from 4.1.132.Final to 4.1.133.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.1.133.Final) Updates `io.netty:netty-handler-proxy` from 4.1.132.Final to 4.1.133.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.1.133.Final) Updates `io.netty:netty-codec` from 4.1.132.Final to 4.1.133.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.1.133.Final) Updates `io.netty:netty-codec-http` from 4.1.132.Final to 4.1.133.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.1.133.Final) Updates `io.netty:netty-codec-mqtt` from 4.1.132.Final to 4.1.133.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.1.133.Final) Updates `io.netty:netty-codec-haproxy` from 4.1.132.Final to 4.1.133.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.1.133.Final) Updates `io.netty:netty-codec-socks` from 4.1.132.Final to 4.1.133.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.1.133.Final) Updates `io.netty:netty-common` from 4.1.132.Final to 4.1.133.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.1.133.Final) Updates `io.netty:netty-resolver` from 4.1.132.Final to 4.1.133.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.1.133.Final) Updates `io.netty:netty-transport-native-unix-common` from 4.1.132.Final to 4.1.133.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.1.133.Final) Updates `io.netty:netty-transport-classes-epoll` from 4.1.132.Final to 4.1.133.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.1.133.Final) Updates `io.netty:netty-transport-native-epoll` from 4.1.132.Final to 4.1.133.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.1.133.Final) Updates `io.netty:netty-transport-classes-kqueue` from 4.1.132.Final to 4.1.133.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.1.133.Final) Updates `io.netty:netty-transport-native-kqueue` from 4.1.132.Final to 4.1.133.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.1.133.Final) Updates `io.netty:netty-codec-http2` from 4.1.132.Final to 4.1.133.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.132.Final...netty-4.1.133.Final) --- updated-dependencies: - dependency-name: io.netty:netty-buffer dependency-version: 4.1.133.Final dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.netty:netty-transport dependency-version: 4.1.133.Final dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.netty:netty-handler dependency-version: 4.1.133.Final dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.netty:netty-handler-proxy dependency-version: 4.1.133.Final dependency-type: direct:development update-type: version-update:semver-patch - dependency-name: io.netty:netty-codec dependency-version: 4.1.133.Final dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.netty:netty-codec-http dependency-version: 4.1.133.Final dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.netty:netty-codec-mqtt dependency-version: 4.1.133.Final dependency-type: direct:development update-type: version-update:semver-patch - dependency-name: io.netty:netty-codec-haproxy dependency-version: 4.1.133.Final dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.netty:netty-codec-socks dependency-version: 4.1.133.Final dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.netty:netty-common dependency-version: 4.1.133.Final dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.netty:netty-resolver dependency-version: 4.1.133.Final dependency-type: direct:development update-type: version-update:semver-patch - dependency-name: io.netty:netty-transport-native-unix-common dependency-version: 4.1.133.Final dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.netty:netty-transport-classes-epoll dependency-version: 4.1.133.Final dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.netty:netty-transport-native-epoll dependency-version: 4.1.133.Final dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.netty:netty-transport-classes-kqueue dependency-version: 4.1.133.Final dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.netty:netty-transport-native-kqueue dependency-version: 4.1.133.Final dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.netty:netty-codec-http2 dependency-version: 4.1.133.Final dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-05-05T17:13:50Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

dependabot Bot added the dependencies Pull requests that update a dependency file label May 5, 2026

jbertram closed this May 5, 2026

dependabot Bot deleted the dependabot/maven/netty.version-4.1.133.Final branch May 5, 2026 17:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ARTEMIS-X Bump netty.version from 4.1.132.Final to 4.1.133.Final#6414

ARTEMIS-X Bump netty.version from 4.1.132.Final to 4.1.133.Final#6414
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/maven/netty.version-4.1.133.Final

dependabot Bot commented on behalf of github May 5, 2026

Uh oh!

dependabot Bot commented on behalf of github May 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github May 5, 2026

netty-4.1.133.Final

CVEs Fixed

What's Changed

New Contributors

netty-4.1.133.Final

CVEs Fixed

What's Changed

New Contributors

netty-4.1.133.Final

CVEs Fixed

What's Changed

New Contributors

netty-4.1.133.Final

CVEs Fixed

What's Changed

New Contributors

netty-4.1.133.Final

CVEs Fixed

What's Changed

New Contributors

netty-4.1.133.Final

CVEs Fixed

What's Changed

New Contributors

netty-4.1.133.Final

CVEs Fixed

What's Changed

Uh oh!

dependabot Bot commented on behalf of github May 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant