[dependabot]

Bumps netty.version from 4.2.18.Final to 4.2.19.Final.
Updates io.netty:netty-codec-http from 4.2.18.Final to 4.2.19.Final

Release notes

Sourced from io.netty:netty-codec-http's releases.

netty-4.2.19.Final

Security

Note that Netty 4.1 will be End-of-Life on July 1st, 2027.

We strongly recommend upgrading to this version to get the following security fixes:

• CVE-2026-XXXXX : parser desync in io.netty:netty-codec-haproxy
• CVE-2026-XXXXX : improper CRLF neutralization (request/response smuggling) in io.netty:netty-codec-http
• CVE-2026-XXXXX : origin validation error in io.netty:netty-codec-http
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http2
• CVE-2026-XXXXX : request/response smuggling in io.netty:netty-codec-http
• CVE-2026-XXXXX : time-of-check/time-of-use error in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : SNI routing bypass in io.netty:netty-handler
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-xml
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-base
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http
• CVE-2026-XXXXX : input misinterpretation in io.netty:netty-codec-socks
• CVE-2026-XXXXX : improper access control in io.netty:netty-handler
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-dns
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http3
• CVE-2026-XXXXX : use-after-free in io.netty:netty-transport-classes-io_uring
• CVE-2026-XXXXX : memory leak in io.netty:netty-transport-native-io_uring

Note that due to overwhelming strain on the CVE infrastructure, we have not gotten a single CVE number assigned to these reports in time for our release. The advisories will be published without.

Specific changes worth calling out:

Validation in FileUpload.setContentType. Previously, the FileUpload.setContentType methods did not validate their inputs. They now throw an IllegaalArgumentException if the given string is not formatted as a plausible MIME content type.

What's Changed

• perf: Use LinkedHashSet to deduplicate search domains by @​JunggiKim in netty/netty#17400
• Handle non-positive skip lengths in ByteBufInputStream by @​cuishuang in netty/netty#17388
• Avoid double promise allocation in SslHandler.wrap() by @​doom369 in netty/netty#17382
• Socket: Add half-closure tests to SocketHalfClosedTest by @​rajan-github in netty/netty#17394
• HttpUtil.getCharset() must accept whitespace before the next Content-Type parameter by @​hunseonglee in netty/netty#17386
• codec-dns: Add SMIMEA, CDS, CDNSKEY, OPENPGPKEY, CSYNC, ZONEMD records by @​hyperxpro in netty/netty#17373
• transport: Avoid io_uring completion callback allocation by @​massiccio in netty/netty#17457
• QUIC: Ensure writable events reflect stream capacity by @​yawkat in netty/netty#17431
• OcspServerCertificateValidatorTest: Fix possible leak in test by @​normanmaurer in netty/netty#17469
• Use github to download cmake and also remove tar file after unpacking by @​normanmaurer in netty/netty#17482
• build: Upgrade GitHub Actions to fix Node.js 20 deprecation warnings by @​normanmaurer in netty/netty#17484
• HttpUtil.getMimeType() must not include whitespace before the next Content-Type parameter by @​ohchanKyu in netty/netty#17456
• Fix buffer leak when recvmmsg returns single UDP_GRO batch by @​octa-one in netty/netty#17493
• Guard ChunkedWriteHandler.doFlush() against re-entrant invocation from user code by @​fudianchn in netty/netty#17438
• Add regression test for close() cascade reentering flush() by @​normanmaurer in netty/netty#17497
• Fix UDP_GRO segment size is lost when reading with recvmmsg by @​octa-one in netty/netty#17492

... (truncated)

Commits

• 64cc10f [maven-release-plugin] prepare release netty-4.2.19.Final
• e863e69 Fix io_uring domain socket fd leak on multi-fd SCM_RIGHTS messages
• d82c6c3 Fix IP allow-list bypass from ruleType-blind dedup in IpSubnetFilter
• bccc62a Bound domain-name decode buffer to avoid quadratic allocation
• 6b02cd3 Fix wrong nextBid computation in IoUringBufferRing for RECVSEND_BUNDLE
• ef3a3e1 Fix sign-extension bug in SocksInitRequestDecoder NMETHODS field
• 4cacdf0 Fix quadratic CPU usage in XmlFrameDecoder when an element is never balanced
• 20f3aae Fail closed on zero-length handshake records in SslClientHelloHandler
• c3f7088 Netty OcspServerCertificateValidator still delivers buffered data from a revo...
• 4029f07 Correctly handle multiple Content-Length
• Additional commits viewable in compare view

Updates io.netty:netty-handler from 4.2.18.Final to 4.2.19.Final

Release notes

Sourced from io.netty:netty-handler's releases.

netty-4.2.19.Final

Security

Note that Netty 4.1 will be End-of-Life on July 1st, 2027.

We strongly recommend upgrading to this version to get the following security fixes:

• CVE-2026-XXXXX : parser desync in io.netty:netty-codec-haproxy
• CVE-2026-XXXXX : improper CRLF neutralization (request/response smuggling) in io.netty:netty-codec-http
• CVE-2026-XXXXX : origin validation error in io.netty:netty-codec-http
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http2
• CVE-2026-XXXXX : request/response smuggling in io.netty:netty-codec-http
• CVE-2026-XXXXX : time-of-check/time-of-use error in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : SNI routing bypass in io.netty:netty-handler
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-xml
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-base
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http
• CVE-2026-XXXXX : input misinterpretation in io.netty:netty-codec-socks
• CVE-2026-XXXXX : improper access control in io.netty:netty-handler
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-dns
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http3
• CVE-2026-XXXXX : use-after-free in io.netty:netty-transport-classes-io_uring
• CVE-2026-XXXXX : memory leak in io.netty:netty-transport-native-io_uring

Note that due to overwhelming strain on the CVE infrastructure, we have not gotten a single CVE number assigned to these reports in time for our release. The advisories will be published without.

Specific changes worth calling out:

Validation in FileUpload.setContentType. Previously, the FileUpload.setContentType methods did not validate their inputs. They now throw an IllegaalArgumentException if the given string is not formatted as a plausible MIME content type.

What's Changed

• perf: Use LinkedHashSet to deduplicate search domains by @​JunggiKim in netty/netty#17400
• Handle non-positive skip lengths in ByteBufInputStream by @​cuishuang in netty/netty#17388
• Avoid double promise allocation in SslHandler.wrap() by @​doom369 in netty/netty#17382
• Socket: Add half-closure tests to SocketHalfClosedTest by @​rajan-github in netty/netty#17394
• HttpUtil.getCharset() must accept whitespace before the next Content-Type parameter by @​hunseonglee in netty/netty#17386
• codec-dns: Add SMIMEA, CDS, CDNSKEY, OPENPGPKEY, CSYNC, ZONEMD records by @​hyperxpro in netty/netty#17373
• transport: Avoid io_uring completion callback allocation by @​massiccio in netty/netty#17457
• QUIC: Ensure writable events reflect stream capacity by @​yawkat in netty/netty#17431
• OcspServerCertificateValidatorTest: Fix possible leak in test by @​normanmaurer in netty/netty#17469
• Use github to download cmake and also remove tar file after unpacking by @​normanmaurer in netty/netty#17482
• build: Upgrade GitHub Actions to fix Node.js 20 deprecation warnings by @​normanmaurer in netty/netty#17484
• HttpUtil.getMimeType() must not include whitespace before the next Content-Type parameter by @​ohchanKyu in netty/netty#17456
• Fix buffer leak when recvmmsg returns single UDP_GRO batch by @​octa-one in netty/netty#17493
• Guard ChunkedWriteHandler.doFlush() against re-entrant invocation from user code by @​fudianchn in netty/netty#17438
• Add regression test for close() cascade reentering flush() by @​normanmaurer in netty/netty#17497
• Fix UDP_GRO segment size is lost when reading with recvmmsg by @​octa-one in netty/netty#17492

... (truncated)

Commits

• 64cc10f [maven-release-plugin] prepare release netty-4.2.19.Final
• e863e69 Fix io_uring domain socket fd leak on multi-fd SCM_RIGHTS messages
• d82c6c3 Fix IP allow-list bypass from ruleType-blind dedup in IpSubnetFilter
• bccc62a Bound domain-name decode buffer to avoid quadratic allocation
• 6b02cd3 Fix wrong nextBid computation in IoUringBufferRing for RECVSEND_BUNDLE
• ef3a3e1 Fix sign-extension bug in SocksInitRequestDecoder NMETHODS field
• 4cacdf0 Fix quadratic CPU usage in XmlFrameDecoder when an element is never balanced
• 20f3aae Fail closed on zero-length handshake records in SslClientHelloHandler
• c3f7088 Netty OcspServerCertificateValidator still delivers buffered data from a revo...
• 4029f07 Correctly handle multiple Content-Length
• Additional commits viewable in compare view

Updates io.netty:netty-transport from 4.2.18.Final to 4.2.19.Final

Release notes

Sourced from io.netty:netty-transport's releases.

netty-4.2.19.Final

Security

Note that Netty 4.1 will be End-of-Life on July 1st, 2027.

We strongly recommend upgrading to this version to get the following security fixes:

• CVE-2026-XXXXX : parser desync in io.netty:netty-codec-haproxy
• CVE-2026-XXXXX : improper CRLF neutralization (request/response smuggling) in io.netty:netty-codec-http
• CVE-2026-XXXXX : origin validation error in io.netty:netty-codec-http
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http2
• CVE-2026-XXXXX : request/response smuggling in io.netty:netty-codec-http
• CVE-2026-XXXXX : time-of-check/time-of-use error in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : SNI routing bypass in io.netty:netty-handler
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-xml
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-base
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http
• CVE-2026-XXXXX : input misinterpretation in io.netty:netty-codec-socks
• CVE-2026-XXXXX : improper access control in io.netty:netty-handler
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-dns
• CVE-2026-XXXXX : unbounded resource consumption in io.netty:netty-codec-http3
• CVE-2026-XXXXX : use-after-free in io.netty:netty-transport-classes-io_uring
• CVE-2026-XXXXX : memory leak in io.netty:netty-transport-native-io_uring

Note that due to overwhelming strain on the CVE infrastructure, we have not gotten a single CVE number assigned to these reports in time for our release. The advisories will be published without.

Specific changes worth calling out:

Validation in FileUpload.setContentType. Previously, the FileUpload.setContentType methods did not validate their inputs. They now throw an IllegaalArgumentException if the given string is not formatted as a plausible MIME content type.

What's Changed

• perf: Use LinkedHashSet to deduplicate search domains by @​JunggiKim in netty/netty#17400
• Handle non-positive skip lengths in ByteBufInputStream by @​cuishuang in netty/netty#17388
• Avoid double promise allocation in SslHandler.wrap() by @​doom369 in netty/netty#17382
• Socket: Add half-closure tests to SocketHalfClosedTest by @​rajan-github in netty/netty#17394
• HttpUtil.getCharset() must accept whitespace before the next Content-Type parameter by @​hunseonglee in netty/netty#17386
• codec-dns: Add SMIMEA, CDS, CDNSKEY, OPENPGPKEY, CSYNC, ZONEMD records by @​hyperxpro in netty/netty#17373
• transport: Avoid io_uring completion callback allocation by @​massiccio in netty/netty#17457
• QUIC: Ensure writable events reflect stream capacity by @​yawkat in netty/netty#17431
• OcspServerCertificateValidatorTest: Fix possible leak in test by @​normanmaurer in netty/netty#17469
• Use github to download cmake and also remove tar file after unpacking by @​normanmaurer in netty/netty#17482
• build: Upgrade GitHub Actions to fix Node.js 20 deprecation warnings by @​normanmaurer in netty/netty#17484
• HttpUtil.getMimeType() must not include whitespace before the next Content-Type parameter by @​ohchanKyu in netty/netty#17456
• Fix buffer leak when recvmmsg returns single UDP_GRO batch by @​octa-one in netty/netty#17493
• Guard ChunkedWriteHandler.doFlush() against re-entrant invocation from user code by @​fudianchn in netty/netty#17438
• Add regression test for close() cascade reentering flush() by @​normanmaurer in netty/netty#17497
• Fix UDP_GRO segment size is lost when reading with recvmmsg by @​octa-one in netty/netty#17492

... (truncated)

Commits

• 64cc10f [maven-release-plugin] prepare release netty-4.2.19.Final
• e863e69 Fix io_uring domain socket fd leak on multi-fd SCM_RIGHTS messages
• d82c6c3 Fix IP allow-list bypass from ruleType-blind dedup in IpSubnetFilter
• bccc62a Bound domain-name decode buffer to avoid quadratic allocation
• 6b02cd3 Fix wrong nextBid computation in IoUringBufferRing for RECVSEND_BUNDLE
• ef3a3e1 Fix sign-extension bug in SocksInitRequestDecoder NMETHODS field
• 4cacdf0 Fix quadratic CPU usage in XmlFrameDecoder when an element is never balanced
• 20f3aae Fail closed on zero-length handshake records in SslClientHelloHandler
• c3f7088 Netty OcspServerCertificateValidator still delivers buffered data from a revo...
• 4029f07 Correctly handle multiple Content-Length
• Additional commits viewable in compare view