[utkrishtsahu]

Changes

Forces the transitive io.netty:netty-codec-http to 4.1.137.Final via a Gradle resolutionStrategy in the root build.gradle, clearing the reported CVEs (HTTP request smuggling, data amplification, CRLF injection, etc.).

• Why: netty-codec-http was flagged at 4.1.93.Final and 4.1.110.Final, both pulled in transitively by the Android Gradle Plugin's test tooling (grpc-netty). 4.1.137.Final is the lowest version that fixes every reported CVE.
• No public API impact — no endpoints, classes, or methods added, changed, or removed.
• Build/test-time only — this dependency is not included in the published AAR, so there is no runtime change for SDK consumers.
• Verified: testReleaseUnitTest + lintRelease pass; resolved dependency tree confirms the override.

Checklist

• I have read the Auth0 general contribution guidelines

• I have read the Auth0 Code of Conduct

• All existing and new tests complete without errors

Summary by CodeRabbit

• Chores
  • Updated the build configuration for an underlying networking component. No changes to user-facing features or behavior are described in this update.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 164c0579-5fc2-489e-8df7-a3c4250fd848

📥 Commits

Reviewing files that changed from the base of the PR and between a32bdb9 and e423368.

📒 Files selected for processing (1)

• build.gradle

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

---

📝 Walkthrough

Walkthrough

The build adds an all-projects dependency-resolution rule that substitutes version 4.1.137.Final for requests for io.netty:netty-codec-http.

Changes

Netty version resolution

Layer / File(s)	Summary
Configure Netty codec version build.gradle	An all-projects dependency-resolution rule substitutes version 4.1.137.Final for requests for io.netty:netty-codec-http.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Other

Suggested reviewers: pmathew92

Merge Risk: ⚪ Minimal · up to e4233

The change pins matching project dependency requests to Netty 4.1.137.Final. Available evidence does not establish a concrete affected workflow or published-artifact impact, so no material merge risk is supported.

Security Architecture Review

Security architecture risk: 🔵 Low · up to e4233

The change adds a narrowly targeted dependency override without changing application code. However, it does not establish that the Android build plugin’s dependency is patched. No new exploitable exposure is demonstrated, but the security fix remains incompletely verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The demonstrated change affects matching dependency requests in project build configurations. The full comparison provides no application-code change or new public entrypoint; consumer runtime exposure is not established by this rule alone.

Security Findings and Attack Paths

• inferred — The candidate remains deferred because the effective root buildscript Netty version is unknown. The AGP declaration and its dependency scope predate this PR; the available comparison does not demonstrate a newly introduced or worsened attack path.

Trust Boundaries and Controls

• inferred — The dependency control must be evaluated in the scope of its intended consumer. Coverage of Project configurations cannot be treated as coverage of the separate ScriptHandler classpath used to load AGP.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the Netty dependency update and target version. The change matches the pull request’s main objective.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}