Skip to content

chore: resolve open dependabot security alerts - #314

Merged
JamieSinn merged 1 commit into
mainfrom
chore/dependabot-alerts
Jul 27, 2026
Merged

chore: resolve open dependabot security alerts#314
JamieSinn merged 1 commit into
mainfrom
chore/dependabot-alerts

Conversation

@jonathannorris

Copy link
Copy Markdown
Member

Summary

  • Resolved 9 open Dependabot security alerts by bumping forced Netty transitive dependency versions from 4.2.15.Final to 4.2.16.Final in the root build.gradle resolution strategy (buildscript classpath and subprojects configurations)

Dependabot Alerts Resolved

Alert Package Severity Fix
#56 io.netty:netty-codec-http medium Forced to 4.2.16.Final
#55 io.netty:netty-codec-compression high Forced to 4.2.16.Final
#54 io.netty:netty-codec-http2 medium Forced to 4.2.16.Final
#53 io.netty:netty-codec-http medium Forced to 4.2.16.Final
#52 io.netty:netty-codec-http medium Forced to 4.2.16.Final
#51 io.netty:netty-codec-http medium Forced to 4.2.16.Final
#50 io.netty:netty-codec-http high Forced to 4.2.16.Final
#49 io.netty:netty-codec-http high Forced to 4.2.16.Final
#48 io.netty:netty-codec-http high Forced to 4.2.16.Final

Netty is pulled in transitively via the buildscript classpath (through grpc-netty, used by a build plugin), not as a runtime dependency of the SDK itself. Verified via ./gradlew buildEnvironment that all Netty artifacts now resolve to 4.2.16.Final.

Test plan

  • ./gradlew build succeeds
  • ./gradlew buildEnvironment confirms all io.netty:* artifacts resolve to 4.2.16.Final
  • ./gradlew testDebugUnitTest passes (167/167); one intermittent timing-based test (DevCycleClientTests > variable calls back when variable value changes, uses CountDownLatch.await) failed once and passed on retry — confirmed pre-existing flake unrelated to this change

- io.netty:netty-codec-http 4.2.15.Final -> 4.2.16.Final (alerts #48, #49, #50, #51, #52, #53)
- io.netty:netty-codec-http2 4.2.15.Final -> 4.2.16.Final (alert #54)
- io.netty:netty-codec-compression 4.2.15.Final -> 4.2.16.Final (alert #55)
- io.netty:netty-codec, netty-handler, netty-handler-proxy, netty-common 4.2.15.Final -> 4.2.16.Final (transitive netty modules pulled in via alert #56 and related advisories)
@jonathannorris
jonathannorris requested a review from a team as a code owner July 27, 2026 16:02
Copilot AI review requested due to automatic review settings July 27, 2026 16:02

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@JamieSinn
JamieSinn merged commit bd7509d into main Jul 27, 2026
6 checks passed
@JamieSinn
JamieSinn deleted the chore/dependabot-alerts branch July 27, 2026 17:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants