fix(deps): bump io.netty to 4.2.17.Final to resolve GHSA-8c42-7qj2-3j46

Bump io.netty group dependency version constraint from 4.2.16.Final to 4.2.17.Final
in the resolutionStrategy to resolve the CORS Vary header overwrite vulnerability
(GHSA-8c42-7qj2-3j46) in io.netty:netty-codec-http, fixed in 4.2.17.Final.

Also update the accompanying  clause to document this new CVE alongside
existing Netty vulnerability references.

Updates both the root build.gradle resolutionStrategy and the example subproject
netty version overrides.

Co-Authored-By: Ronald van Duren <ronald.vanduren@getyourguide.com>

Author: claude

build.gradle

@@ -49,14 +49,14 @@ subprojects {
                 because('GHSA-rv64-5gf8-9qq8 / GHSA-x4m4-345f-5h5g / GHSA-24j9-x2wg-9qv6 / GHSA-gx5v-xp9w-j4cg: Apache Tomcat < 11.0.22 vulnerabilities')
             }
             if (requested.group == 'io.netty'
-                    && requested.version != null && requested.version < '4.2.16.Final') {
-                useVersion('4.2.16.Final')
+                    && requested.version != null && requested.version < '4.2.17.Final') {
+                useVersion('4.2.17.Final')
                 because('GHSA-38f8-5428-x5cv: HTTP Request Smuggling in io.netty:netty-codec-http via malformed Transfer-Encoding headers; ' +
                         'GHSA-3qp7-7mw8-wx86 / GHSA-c2rx-5r8w-8xr2 / GHSA-cmm3-54f8-px4j / GHSA-x4gw-5cx5-pgmh / GHSA-676x-f7gg-47vc / ' +
                         'GHSA-5pvg-856g-cp85 / GHSA-4grm-h2qv-h6w6 / GHSA-c653-97m9-rcg9 / GHSA-563q-j3cm-6jxm / GHSA-hvcg-qmg6-jm4c / ' +
                         'GHSA-cq4q-cv5g-r8q5 / GHSA-c2gf-v879-257j / GHSA-5x3r-wrvg-rp6q / GHSA-xmv7-r254-6q78 / GHSA-w573-9ffj-6ff9 / ' +
-                        'GHSA-mvh2-crg5-v77c: multiple Netty vulnerabilities, including SPDY zlib header block continues decoded expansion ' +
-                        'after maxHeaderSize truncation, fixed in 4.2.16.Final')
+                        'GHSA-mvh2-crg5-v77c / GHSA-8c42-7qj2-3j46: multiple Netty vulnerabilities, including SPDY zlib header block continues decoded expansion ' +
+                        'after maxHeaderSize truncation, and cache poisoning and information disclosure via CORS Vary header overwrite in io.netty:netty-codec-http, fixed in 4.2.17.Final')
             }
             if (requested.group == 'org.springframework' && requested.name == 'spring-core'
                     && requested.version != null && requested.version < '7.0.8') {

examples/example-spring-boot-starter-web/build.gradle

@@ -8,7 +8,7 @@ plugins {
 ext['jackson-bom.version'] = '3.1.4'
 ext['jackson-2-bom.version'] = '2.21.5'
 ext['logback.version'] = '1.5.34'
-ext['netty.version'] = '4.2.16.Final'
+ext['netty.version'] = '4.2.17.Final'
 ext['tomcat.version'] = '11.0.22'
 ext['spring-framework.version'] = '7.0.8'
 

examples/example-spring-boot-starter-webflux/build.gradle

@@ -8,7 +8,7 @@ plugins {
 ext['jackson-bom.version'] = '3.1.4'
 ext['jackson-2-bom.version'] = '2.21.5'
 ext['logback.version'] = '1.5.34'
-ext['netty.version'] = '4.2.16.Final'
+ext['netty.version'] = '4.2.17.Final'
 ext['tomcat.version'] = '11.0.22'
 ext['spring-framework.version'] = '7.0.8'