build(deps): bump the dependencies group with 35 updates by dependabot[bot] · Pull Request #4005 · jooby-project/jooby

dependabot · 2026-09-14T00:25:22Z

Bumps the dependencies group with 35 updates:

Package	From	To
io.netty:netty-bom	`4.2.17.Final`	`4.2.18.Final`
io.netty:netty-codec-http2	`4.2.17.Final`	`4.2.18.Final`
io.netty:netty-transport-native-epoll	`4.2.17.Final`	`4.2.18.Final`
io.netty:netty-transport-native-kqueue	`4.2.17.Final`	`4.2.18.Final`
io.netty:netty-transport-native-io_uring	`4.2.17.Final`	`4.2.18.Final`
org.slf4j:slf4j-api	`2.0.18`	`2.0.19`
org.slf4j:log4j-over-slf4j	`2.0.18`	`2.0.19`
org.slf4j:jcl-over-slf4j	`2.0.18`	`2.0.19`
org.slf4j:jul-to-slf4j	`2.0.18`	`2.0.19`
org.slf4j:slf4j-simple	`2.0.18`	`2.0.19`
org.eclipse.jetty:jetty-server	`12.1.12`	`12.1.13`
org.eclipse.jetty.websocket:jetty-websocket-core-server	`12.1.12`	`12.1.13`
org.eclipse.jetty.websocket:jetty-websocket-jetty-api	`12.1.12`	`12.1.13`
org.eclipse.jetty.websocket:jetty-websocket-jetty-server	`12.1.12`	`12.1.13`
org.eclipse.jetty.http2:jetty-http2-server	`12.1.12`	`12.1.13`
org.eclipse.jetty:jetty-alpn-java-server	`12.1.12`	`12.1.13`
org.eclipse.jetty.compression:jetty-compression-server	`12.1.12`	`12.1.13`
org.eclipse.jetty.compression:jetty-compression-gzip	`12.1.12`	`12.1.13`
org.eclipse.jetty.http2:jetty-http2-client	`12.1.12`	`12.1.13`
org.jetbrains.kotlin:kotlin-stdlib	`2.4.10`	`2.4.20`
org.jetbrains.kotlin:kotlin-reflect	`2.4.10`	`2.4.20`
org.jetbrains.kotlin:kotlin-maven-plugin	`2.4.10`	`2.4.20`
org.apache.maven.plugin-tools:maven-plugin-annotations	`3.15.2`	`3.16.0`
io.repaint.maven:tiles-maven-plugin	`2.45`	`2.45.1`
com.diffplug.spotless:spotless-maven-plugin	`3.10.1`	`3.10.2`
io.vertx:vertx-core	`5.1.7`	`5.1.8`
io.vertx:vertx-sql-client	`5.1.7`	`5.1.8`
io.vertx:vertx-mysql-client	`5.1.7`	`5.1.8`
io.vertx:vertx-pg-client	`5.1.7`	`5.1.8`
dev.langchain4j:langchain4j-bom	`1.19.0`	`1.20.0`
io.github.classgraph:classgraph	`4.8.194`	`4.8.195`
software.amazon.awssdk:bom	`2.54.12`	`2.54.16`
org.jline:jline	`3.30.16`	`3.30.17`
org.jline:jline-terminal-jna	`3.30.16`	`3.30.17`
org.apache.maven.plugins:maven-plugin-plugin	`3.15.2`	`3.16.0`

Updates io.netty:netty-bom from 4.2.17.Final to 4.2.18.Final

Release notes

Sourced from io.netty:netty-bom's releases.

netty-4.2.18.Final

Security fixes

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)

CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2

CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp

CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3

CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp

CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp

CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy

CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)

CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1)

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)

CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt

CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp

CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility Notes

A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.

Two specific changes are worth calling out:

QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown.

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

Use X509ExtendedTrustManager in SSLErrorTest by @normanmaurer in netty/netty#17221

Update setup-testlens to v1.9.4 by @marcphilipp in netty/netty#17223

... (truncated)

Commits

2521f49 [maven-release-plugin] prepare release netty-4.2.18.Final
6fd5327 HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...
c44a052 SPDY: SpdySessionHandler must limit the concurrent streams
374d965 HTTP: Limit the maximum number of concurrent pipelined requests
7e8b325 HTTP/2: Limit HPACK encoding table size
e3ebf70 OCSP: Correctly handle that nextUpdate is optional
5388535 STOMP: Correctly release partial content on handler removal
3a80f5a WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...
1b6ea48 HTTP3: Correctly handle ":authority" and "host" headers
3630659 STOMP codec content-length long-to-int truncation causes infinite decode loop...
Additional commits viewable in compare view

Updates io.netty:netty-codec-http2 from 4.2.17.Final to 4.2.18.Final

Release notes

Sourced from io.netty:netty-codec-http2's releases.

netty-4.2.18.Final

Security fixes

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)

CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2

CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp

CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3

CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp

CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp

CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy

CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)

CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1)

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)

CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt

CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp

CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility Notes

A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.

Two specific changes are worth calling out:

QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown.

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

Use X509ExtendedTrustManager in SSLErrorTest by @normanmaurer in netty/netty#17221

Update setup-testlens to v1.9.4 by @marcphilipp in netty/netty#17223

... (truncated)

Commits

2521f49 [maven-release-plugin] prepare release netty-4.2.18.Final
6fd5327 HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...
c44a052 SPDY: SpdySessionHandler must limit the concurrent streams
374d965 HTTP: Limit the maximum number of concurrent pipelined requests
7e8b325 HTTP/2: Limit HPACK encoding table size
e3ebf70 OCSP: Correctly handle that nextUpdate is optional
5388535 STOMP: Correctly release partial content on handler removal
3a80f5a WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...
1b6ea48 HTTP3: Correctly handle ":authority" and "host" headers
3630659 STOMP codec content-length long-to-int truncation causes infinite decode loop...
Additional commits viewable in compare view

Updates io.netty:netty-transport-native-epoll from 4.2.17.Final to 4.2.18.Final

Release notes

Sourced from io.netty:netty-transport-native-epoll's releases.

netty-4.2.18.Final

Security fixes

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)

CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2

CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp

CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3

CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp

CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp

CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy

CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)

CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1)

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)

CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt

CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp

CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility Notes

A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.

Two specific changes are worth calling out:

QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown.

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

Use X509ExtendedTrustManager in SSLErrorTest by @normanmaurer in netty/netty#17221

Update setup-testlens to v1.9.4 by @marcphilipp in netty/netty#17223

... (truncated)

Commits

2521f49 [maven-release-plugin] prepare release netty-4.2.18.Final
6fd5327 HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...
c44a052 SPDY: SpdySessionHandler must limit the concurrent streams
374d965 HTTP: Limit the maximum number of concurrent pipelined requests
7e8b325 HTTP/2: Limit HPACK encoding table size
e3ebf70 OCSP: Correctly handle that nextUpdate is optional
5388535 STOMP: Correctly release partial content on handler removal
3a80f5a WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...
1b6ea48 HTTP3: Correctly handle ":authority" and "host" headers
3630659 STOMP codec content-length long-to-int truncation causes infinite decode loop...
Additional commits viewable in compare view

Updates io.netty:netty-transport-native-kqueue from 4.2.17.Final to 4.2.18.Final

Release notes

Sourced from io.netty:netty-transport-native-kqueue's releases.

netty-4.2.18.Final

Security fixes

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)

CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2

CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp

CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3

CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp

CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp

CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy

CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)

CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1)

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)

CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt

CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp

CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility Notes

A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.

Two specific changes are worth calling out:

QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown.

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

Use X509ExtendedTrustManager in SSLErrorTest by @normanmaurer in netty/netty#17221

Update setup-testlens to v1.9.4 by @marcphilipp in netty/netty#17223

... (truncated)

Commits

2521f49 [maven-release-plugin] prepare release netty-4.2.18.Final
6fd5327 HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...
c44a052 SPDY: SpdySessionHandler must limit the concurrent streams
374d965 HTTP: Limit the maximum number of concurrent pipelined requests
7e8b325 HTTP/2: Limit HPACK encoding table size
e3ebf70 OCSP: Correctly handle that nextUpdate is optional
5388535 STOMP: Correctly release partial content on handler removal
3a80f5a WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...
1b6ea48 HTTP3: Correctly handle ":authority" and "host" headers
3630659 STOMP codec content-length long-to-int truncation causes infinite decode loop...
Additional commits viewable in compare view

Updates io.netty:netty-transport-native-io_uring from 4.2.17.Final to 4.2.18.Final

Release notes

Sourced from io.netty:netty-transport-native-io_uring's releases.

netty-4.2.18.Final

Security fixes

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)

CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2

CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp

CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3

CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp

CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp

CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy

CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)

CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1)

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)

CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)

CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt

CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp

CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp

CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility Notes

A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.

Two specific changes are worth calling out:

QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown.

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

Use X509ExtendedTrustManager in SSLErrorTest by @normanmaurer in netty/netty#17221

Update setup-testlens to v1.9.4 by @marcphilipp in netty/netty#17223

... (truncated)

Commits

2521f49 [maven-release-plugin] prepare release netty-4.2.18.Final
6fd5327 HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...
c44a052 SPDY: SpdySessionHandler must limit the concurrent streams
374d965 HTTP: Limit the maximum number of concurrent pipelined requests
7e8b325 HTTP/2: Limit HPACK encoding table size
e3ebf70 OCSP: Correctly handle that nextUpdate is optional
5388535 STOMP: Correctly release partial content on handler removal
3a80f5a WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...
1b6ea48 HTTP3: Correctly handle ":authority" and "host" headers
3630659 STOMP codec content-length long-to-int truncation causes infinite decode loop...
Additional commits viewable in compare view

Updates org.slf4j:slf4j-api from 2.0.18 to 2.0.19

Updates org.slf4j:log4j-over-slf4j from 2.0.18 to 2.0.19

Updates org.slf4j:jcl-over-slf4j from 2.0.18 to 2.0.19

Updates org.slf4j:jul-to-slf4j from 2.0.18 to 2.0.19

Updates org.slf4j:slf4j-simple from 2.0.18 to 2.0.19

Updates org.slf4j:log4j-over-slf4j from 2.0.18 to 2.0.19

Updates org.slf4j:jcl-over-slf4j from 2.0.18 to 2.0.19

Updates org.slf4j:jul-to-slf4j from 2.0.18 to 2.0.19

Updates org.eclipse.jetty:jetty-server from 12.1.12 to 12.1.13

Updates org.eclipse.jetty.websocket:jetty-websocket-core-server from 12.1.12 to 12.1.13

Updates org.eclipse.jetty.websocket:jetty-websocket-jetty-api from 12.1.12 to 12.1.13

Updates org.eclipse.jetty.websocket:jetty-websocket-jetty-server from 12.1.12 to 12.1.13

Updates org.eclipse.jetty.http2:jetty-http2-server from 12.1.12 to 12.1.13

Updates org.eclipse.jetty:jetty-alpn-java-server from 12.1.12 to 12.1.13

Updates org.eclipse.jetty.compression:jetty-compression-server from 12.1.12 to 12.1.13

Updates org.eclipse.jetty.compression:jetty-compression-gzip from 12.1.12 to 12.1.13

Updates org.eclipse.jetty.http2:jetty-http2-client from 12.1.12 to 12.1.13

Updates org.eclipse.jetty.websocket:jetty-websocket-core-server from 12.1.12 to 12.1.13

Updates org.jetbrains.kotlin:kotlin-stdlib from 2.4.10 to 2.4.20

Release notes

Sourced from org.jetbrains.kotlin:kotlin-stdlib's releases.

Kotlin 2.4.20

Changelog

Analysis API

KT-86546 Check suspicious when over ConeKotlinType in ConeTypeCompatibilityChecker

KT-85418 Implement an API for accessing deserialized file annotations in Analysis API

KT-74448 K2. False positive MISSING_DEPENDENCY_SUPERCLASS in LinkedListTest.kt, kotlinx.coroutines

KT-85856 containingSymbol of constructor property differs for local and non-local classes

KT-65417 K2 IDE: KTOR false positive expect-actual matching error on enum class because of implicit clone() in non-JVM source sets

Analysis API. Code Compilation

KT-76457 K2 IDE / KMP Debugger: KISEWA “Cannot compile a common source without a JVM counterpart” on evaluating inline fun from common module inside jvm

Analysis API. FIR

KT-70552 No expects for actual

KT-69727 K2 IDE. Wrong error in the editor on calling clone function of actual enum instance in non-jvm platform

KT-69726 FP errors on declaring fun clone() in actual enum in not-jvm source-set

KT-86014 Types are broken after remove parameter through change signature

KT-86363 KotlinIllegalArgumentExceptionWithAttachments: No dangling modifier found on companion blocks

KT-86147 Drop kotlin.parallel.resolve.under.global.lock registry key

KT-85543 Avoid lazy resolve for the contracts phase if no constracts might be resolved

Analysis API. Infrastructure

KT-84914 Do not publish analysis-api-test-framework

KT-86986 kotlin-compiler-common-for-ide bundles unrelated Analysis API modules

KT-86186 Analysis API: Codebase tests run twice in some analysis modules — pick a single JUnit runner and migrate

KT-85360 Drop kotlin-compiler-testdata-for-ide artifact

KT-85585 Simplify the dependencies graph for the Analysis API modules

KT-85381 Remove tests for the FE10 implementation

Analysis API. Light Classes

New Features

KT-84645 Support resolving to companion block members & extensions from Java (light classes)

KT-80775 Support PsiClass#getRecordComponents in light classes

Fixes

KT-57537 SLC: propagate default parameter value from (@JvmOverloads) expect declarations to actual declarations

KT-85040 [Analysis API] Improve Java / Kotlin interop in KMP projects

KT-87301 SymbolLightAccessorMethod#isValid returns false for delegated properties

KT-87171 SLC: non-mapped Kotlin collection supertype is dropped from supertype list

KT-87250 JvmExposeBoxed: light classes shouldn't be autogenerated for private declarations

KT-70428 AA: good code is red when a Java class extends a Kotlin class implementing MutableList by delegation

KT-63568 Symbol Light Classes: KtAnnotationApplicationWithArgumentsInfo.normalizedArguments() may work incorrectly when psi is not set

... (truncated)

Changelog

Sourced from org.jetbrains.kotlin:kotlin-stdlib's changelog.

2.4.20

Analysis API

KT-86546 Check suspicious when over ConeKotlinType in ConeTypeCompatibilityChecker

KT-85418 Implement an API for accessing deserialized file annotations in Analysis API

KT-74448 K2. False positive MISSING_DEPENDENCY_SUPERCLASS in LinkedListTest.kt, kotlinx.coroutines

KT-85856 containingSymbol of constructor property differs for local and non-local classes

KT-65417 K2 IDE: KTOR false positive expect-actual matching error on enum class because of implicit clone() in non-JVM source sets

Analysis API. Code Compilation

KT-76457 K2 IDE / KMP Debugger: KISEWA “Cannot compile a common source without a JVM counterpart” on evaluating inline fun from common module inside jvm

Analysis API. FIR

KT-70552 No expects for actual

KT-69727 K2 IDE. Wrong error in the editor on calling clone function of actual enum instance in non-jvm platform

KT-69726 FP errors on declaring fun clone() in actual enum in not-jvm source-set

KT-86014 Types are broken after remove parameter through change signature

KT-86363 KotlinIllegalArgumentExceptionWithAttachments: No dangling modifier found on companion blocks

KT-86147 Drop kotlin.parallel.resolve.under.global.lock registry key

KT-85543 Avoid lazy resolve for the contracts phase if no constracts might be resolved

Analysis API. Infrastructure

KT-84914 Do not publish analysis-api-test-framework

KT-86986 kotlin-compiler-common-for-ide bundles unrelated Analysis API modules

KT-86186 Analysis API: Codebase tests run twice in some analysis modules — pick a single JUnit runner and migrate

KT-85360 Drop kotlin-compiler-testdata-for-ide artifact

KT-85585 Simplify the dependencies graph for the Analysis API modules

KT-85381 Remove tests for the FE10 implementation

Analysis API. Light Classes

New Features

KT-84645 Support resolving to companion block members & extensions from Java (light classes)

KT-80775 Support PsiClass#getRecordComponents in light classes

Fixes

KT-57537 SLC: propagate default parameter value from (@JvmOverloads) expect declarations to actual declarations

KT-85040 [Analysis API] Improve Java / Kotlin interop in KMP projects

KT-87301 SymbolLightAccessorMethod#isValid returns false for delegated properties

KT-87171 SLC: non-mapped Kotlin collection supertype is dropped from supertype list

KT-87250 JvmExposeBoxed: light classes shouldn't be autogenerated for private declarations

KT-70428 AA: good code is red when a Java class extends a Kotlin class implementing MutableList by delegation

KT-63568 Symbol Light Classes: KtAnnotationApplicationWithArgumentsInfo.normalizedArguments() may work incorrectly when psi is not set

KT-36740 MPP: False-positive incompatible types in .java when using expect-class returned by non-expect member from common when actual is actual typealias

... (truncated)

Commits

890ac1d Add Changelog for 2.4.20-RC3
8860aed 🍒 [FIR] Fix suspend conversion when expected type is nullable (#7769)
ab5bcd9 Edit ChangeLog for 2.4.20-RC2
9464edc Add ChangeLog for 2.4.20-RC2
0261e43 Cherry-pick "Fix asBodyAndResultVar call in `visitInlinedLambdaInComposable...
0763513 [box-tests] Workaround for klib compatibility tests (#7626)
045aec6 [Wasm] Append scripts from webpack.config.d in the end of the file (#7615)
cd7173b 🍒 [2.4.20] [K/JS] Keep associated obj annotation only if getInstance survives...
d36a2ff CastsOptimizationPass: break aliases cycles (#7578)

Bumps the dependencies group with 35 updates: | Package | From | To | | --- | --- | --- | | [io.netty:netty-bom](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` | | [io.netty:netty-codec-http2](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` | | [io.netty:netty-transport-native-epoll](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` | | [io.netty:netty-transport-native-kqueue](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` | | [io.netty:netty-transport-native-io_uring](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` | | org.slf4j:slf4j-api | `2.0.18` | `2.0.19` | | org.slf4j:log4j-over-slf4j | `2.0.18` | `2.0.19` | | org.slf4j:jcl-over-slf4j | `2.0.18` | `2.0.19` | | org.slf4j:jul-to-slf4j | `2.0.18` | `2.0.19` | | org.slf4j:slf4j-simple | `2.0.18` | `2.0.19` | | org.eclipse.jetty:jetty-server | `12.1.12` | `12.1.13` | | org.eclipse.jetty.websocket:jetty-websocket-core-server | `12.1.12` | `12.1.13` | | org.eclipse.jetty.websocket:jetty-websocket-jetty-api | `12.1.12` | `12.1.13` | | org.eclipse.jetty.websocket:jetty-websocket-jetty-server | `12.1.12` | `12.1.13` | | org.eclipse.jetty.http2:jetty-http2-server | `12.1.12` | `12.1.13` | | org.eclipse.jetty:jetty-alpn-java-server | `12.1.12` | `12.1.13` | | org.eclipse.jetty.compression:jetty-compression-server | `12.1.12` | `12.1.13` | | org.eclipse.jetty.compression:jetty-compression-gzip | `12.1.12` | `12.1.13` | | org.eclipse.jetty.http2:jetty-http2-client | `12.1.12` | `12.1.13` | | [org.jetbrains.kotlin:kotlin-stdlib](https://github.com/JetBrains/kotlin) | `2.4.10` | `2.4.20` | | [org.jetbrains.kotlin:kotlin-reflect](https://github.com/JetBrains/kotlin) | `2.4.10` | `2.4.20` | | org.jetbrains.kotlin:kotlin-maven-plugin | `2.4.10` | `2.4.20` | | [org.apache.maven.plugin-tools:maven-plugin-annotations](https://github.com/apache/maven-plugin-tools) | `3.15.2` | `3.16.0` | | [io.repaint.maven:tiles-maven-plugin](https://github.com/repaint-io/maven-tiles) | `2.45` | `2.45.1` | | [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) | `3.10.1` | `3.10.2` | | [io.vertx:vertx-core](https://github.com/eclipse/vert.x) | `5.1.7` | `5.1.8` | | [io.vertx:vertx-sql-client](https://github.com/eclipse-vertx/vertx-sql-client) | `5.1.7` | `5.1.8` | | [io.vertx:vertx-mysql-client](https://github.com/eclipse-vertx/vertx-sql-client) | `5.1.7` | `5.1.8` | | [io.vertx:vertx-pg-client](https://github.com/eclipse-vertx/vertx-sql-client) | `5.1.7` | `5.1.8` | | [dev.langchain4j:langchain4j-bom](https://github.com/langchain4j/langchain4j) | `1.19.0` | `1.20.0` | | [io.github.classgraph:classgraph](https://github.com/classgraph/classgraph) | `4.8.194` | `4.8.195` | | software.amazon.awssdk:bom | `2.54.12` | `2.54.16` | | [org.jline:jline](https://github.com/jline/jline3) | `3.30.16` | `3.30.17` | | org.jline:jline-terminal-jna | `3.30.16` | `3.30.17` | | [org.apache.maven.plugins:maven-plugin-plugin](https://github.com/apache/maven-plugin-tools) | `3.15.2` | `3.16.0` | Updates `io.netty:netty-bom` from 4.2.17.Final to 4.2.18.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final) Updates `io.netty:netty-codec-http2` from 4.2.17.Final to 4.2.18.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final) Updates `io.netty:netty-transport-native-epoll` from 4.2.17.Final to 4.2.18.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final) Updates `io.netty:netty-transport-native-kqueue` from 4.2.17.Final to 4.2.18.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final) Updates `io.netty:netty-transport-native-io_uring` from 4.2.17.Final to 4.2.18.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final) Updates `org.slf4j:slf4j-api` from 2.0.18 to 2.0.19 Updates `org.slf4j:log4j-over-slf4j` from 2.0.18 to 2.0.19 Updates `org.slf4j:jcl-over-slf4j` from 2.0.18 to 2.0.19 Updates `org.slf4j:jul-to-slf4j` from 2.0.18 to 2.0.19 Updates `org.slf4j:slf4j-simple` from 2.0.18 to 2.0.19 Updates `org.slf4j:log4j-over-slf4j` from 2.0.18 to 2.0.19 Updates `org.slf4j:jcl-over-slf4j` from 2.0.18 to 2.0.19 Updates `org.slf4j:jul-to-slf4j` from 2.0.18 to 2.0.19 Updates `org.eclipse.jetty:jetty-server` from 12.1.12 to 12.1.13 Updates `org.eclipse.jetty.websocket:jetty-websocket-core-server` from 12.1.12 to 12.1.13 Updates `org.eclipse.jetty.websocket:jetty-websocket-jetty-api` from 12.1.12 to 12.1.13 Updates `org.eclipse.jetty.websocket:jetty-websocket-jetty-server` from 12.1.12 to 12.1.13 Updates `org.eclipse.jetty.http2:jetty-http2-server` from 12.1.12 to 12.1.13 Updates `org.eclipse.jetty:jetty-alpn-java-server` from 12.1.12 to 12.1.13 Updates `org.eclipse.jetty.compression:jetty-compression-server` from 12.1.12 to 12.1.13 Updates `org.eclipse.jetty.compression:jetty-compression-gzip` from 12.1.12 to 12.1.13 Updates `org.eclipse.jetty.http2:jetty-http2-client` from 12.1.12 to 12.1.13 Updates `org.eclipse.jetty.websocket:jetty-websocket-core-server` from 12.1.12 to 12.1.13 Updates `org.jetbrains.kotlin:kotlin-stdlib` from 2.4.10 to 2.4.20 - [Release notes](https://github.com/JetBrains/kotlin/releases) - [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md) - [Commits](JetBrains/kotlin@v2.4.10...v2.4.20) Updates `org.jetbrains.kotlin:kotlin-reflect` from 2.4.10 to 2.4.20 - [Release notes](https://github.com/JetBrains/kotlin/releases) - [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md) - [Commits](JetBrains/kotlin@v2.4.10...v2.4.20) Updates `org.jetbrains.kotlin:kotlin-maven-plugin` from 2.4.10 to 2.4.20 Updates `org.jetbrains.kotlin:kotlin-reflect` from 2.4.10 to 2.4.20 - [Release notes](https://github.com/JetBrains/kotlin/releases) - [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md) - [Commits](JetBrains/kotlin@v2.4.10...v2.4.20) Updates `org.apache.maven.plugin-tools:maven-plugin-annotations` from 3.15.2 to 3.16.0 - [Release notes](https://github.com/apache/maven-plugin-tools/releases) - [Commits](apache/maven-plugin-tools@maven-plugin-tools-3.15.2...maven-plugin-tools-3.16.0) Updates `org.jetbrains.kotlin:kotlin-maven-plugin` from 2.4.10 to 2.4.20 Updates `io.repaint.maven:tiles-maven-plugin` from 2.45 to 2.45.1 - [Release notes](https://github.com/repaint-io/maven-tiles/releases) - [Changelog](https://github.com/repaint-io/maven-tiles/blob/master/CHANGELOG.adoc) - [Commits](repaint-io/maven-tiles@v2.45.0...v2.45.1) Updates `com.diffplug.spotless:spotless-maven-plugin` from 3.10.1 to 3.10.2 - [Release notes](https://github.com/diffplug/spotless/releases) - [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md) - [Commits](diffplug/spotless@maven/3.10.1...maven/3.10.2) Updates `org.eclipse.jetty.websocket:jetty-websocket-jetty-api` from 12.1.12 to 12.1.13 Updates `org.eclipse.jetty.websocket:jetty-websocket-jetty-server` from 12.1.12 to 12.1.13 Updates `org.eclipse.jetty.http2:jetty-http2-server` from 12.1.12 to 12.1.13 Updates `org.eclipse.jetty:jetty-alpn-java-server` from 12.1.12 to 12.1.13 Updates `org.eclipse.jetty.compression:jetty-compression-server` from 12.1.12 to 12.1.13 Updates `org.eclipse.jetty.compression:jetty-compression-gzip` from 12.1.12 to 12.1.13 Updates `io.netty:netty-codec-http2` from 4.2.17.Final to 4.2.18.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final) Updates `io.netty:netty-transport-native-epoll` from 4.2.17.Final to 4.2.18.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final) Updates `io.netty:netty-transport-native-kqueue` from 4.2.17.Final to 4.2.18.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final) Updates `io.netty:netty-transport-native-io_uring` from 4.2.17.Final to 4.2.18.Final - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final) Updates `org.slf4j:slf4j-simple` from 2.0.18 to 2.0.19 Updates `io.vertx:vertx-core` from 5.1.7 to 5.1.8 - [Commits](eclipse-vertx/vert.x@5.1.7...5.1.8) Updates `io.vertx:vertx-sql-client` from 5.1.7 to 5.1.8 - [Commits](eclipse-vertx/vertx-sql-client@5.1.7...5.1.8) Updates `io.vertx:vertx-mysql-client` from 5.1.7 to 5.1.8 - [Commits](eclipse-vertx/vertx-sql-client@5.1.7...5.1.8) Updates `io.vertx:vertx-pg-client` from 5.1.7 to 5.1.8 - [Commits](eclipse-vertx/vertx-sql-client@5.1.7...5.1.8) Updates `dev.langchain4j:langchain4j-bom` from 1.19.0 to 1.20.0 - [Release notes](https://github.com/langchain4j/langchain4j/releases) - [Commits](langchain4j/langchain4j@1.19.0...1.20.0) Updates `io.github.classgraph:classgraph` from 4.8.194 to 4.8.195 - [Release notes](https://github.com/classgraph/classgraph/releases) - [Commits](classgraph/classgraph@classgraph-4.8.194...classgraph-4.8.195) Updates `io.vertx:vertx-sql-client` from 5.1.7 to 5.1.8 - [Commits](eclipse-vertx/vertx-sql-client@5.1.7...5.1.8) Updates `io.vertx:vertx-mysql-client` from 5.1.7 to 5.1.8 - [Commits](eclipse-vertx/vertx-sql-client@5.1.7...5.1.8) Updates `io.vertx:vertx-pg-client` from 5.1.7 to 5.1.8 - [Commits](eclipse-vertx/vertx-sql-client@5.1.7...5.1.8) Updates `software.amazon.awssdk:bom` from 2.54.12 to 2.54.16 Updates `org.jline:jline` from 3.30.16 to 3.30.17 - [Release notes](https://github.com/jline/jline3/releases) - [Commits](jline/jline3@jline-3.30.16...jline-3.30.17) Updates `org.jline:jline-terminal-jna` from 3.30.16 to 3.30.17 Updates `org.apache.maven.plugins:maven-plugin-plugin` from 3.15.2 to 3.16.0 - [Release notes](https://github.com/apache/maven-plugin-tools/releases) - [Commits](apache/maven-plugin-tools@maven-plugin-tools-3.15.2...maven-plugin-tools-3.16.0) Updates `org.eclipse.jetty.http2:jetty-http2-client` from 12.1.12 to 12.1.13 --- updated-dependencies: - dependency-name: io.netty:netty-bom dependency-version: 4.2.18.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.netty:netty-codec-http2 dependency-version: 4.2.18.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.netty:netty-transport-native-epoll dependency-version: 4.2.18.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.netty:netty-transport-native-kqueue dependency-version: 4.2.18.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.netty:netty-transport-native-io_uring dependency-version: 4.2.18.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.slf4j:slf4j-api dependency-version: 2.0.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.slf4j:log4j-over-slf4j dependency-version: 2.0.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.slf4j:jcl-over-slf4j dependency-version: 2.0.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.slf4j:jul-to-slf4j dependency-version: 2.0.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.slf4j:slf4j-simple dependency-version: 2.0.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.slf4j:log4j-over-slf4j dependency-version: 2.0.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.slf4j:jcl-over-slf4j dependency-version: 2.0.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.slf4j:jul-to-slf4j dependency-version: 2.0.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.eclipse.jetty:jetty-server dependency-version: 12.1.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.eclipse.jetty.websocket:jetty-websocket-core-server dependency-version: 12.1.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.eclipse.jetty.websocket:jetty-websocket-jetty-api dependency-version: 12.1.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.eclipse.jetty.websocket:jetty-websocket-jetty-server dependency-version: 12.1.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.eclipse.jetty.http2:jetty-http2-server dependency-version: 12.1.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.eclipse.jetty:jetty-alpn-java-server dependency-version: 12.1.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.eclipse.jetty.compression:jetty-compression-server dependency-version: 12.1.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.eclipse.jetty.compression:jetty-compression-gzip dependency-version: 12.1.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.eclipse.jetty.http2:jetty-http2-client dependency-version: 12.1.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.eclipse.jetty.websocket:jetty-websocket-core-server dependency-version: 12.1.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.jetbrains.kotlin:kotlin-stdlib dependency-version: 2.4.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.jetbrains.kotlin:kotlin-reflect dependency-version: 2.4.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.jetbrains.kotlin:kotlin-maven-plugin dependency-version: 2.4.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.jetbrains.kotlin:kotlin-reflect dependency-version: 2.4.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.apache.maven.plugin-tools:maven-plugin-annotations dependency-version: 3.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: org.jetbrains.kotlin:kotlin-maven-plugin dependency-version: 2.4.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.repaint.maven:tiles-maven-plugin dependency-version: 2.45.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: com.diffplug.spotless:spotless-maven-plugin dependency-version: 3.10.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.eclipse.jetty.websocket:jetty-websocket-jetty-api dependency-version: 12.1.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.eclipse.jetty.websocket:jetty-websocket-jetty-server dependency-version: 12.1.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.eclipse.jetty.http2:jetty-http2-server dependency-version: 12.1.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.eclipse.jetty:jetty-alpn-java-server dependency-version: 12.1.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.eclipse.jetty.compression:jetty-compression-server dependency-version: 12.1.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.eclipse.jetty.compression:jetty-compression-gzip dependency-version: 12.1.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.netty:netty-codec-http2 dependency-version: 4.2.18.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.netty:netty-transport-native-epoll dependency-version: 4.2.18.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.netty:netty-transport-native-kqueue dependency-version: 4.2.18.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.netty:netty-transport-native-io_uring dependency-version: 4.2.18.Final dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.slf4j:slf4j-simple dependency-version: 2.0.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.vertx:vertx-core dependency-version: 5.1.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.vertx:vertx-sql-client dependency-version: 5.1.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.vertx:vertx-mysql-client dependency-version: 5.1.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.vertx:vertx-pg-client dependency-version: 5.1.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: dev.langchain4j:langchain4j-bom dependency-version: 1.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: io.github.classgraph:classgraph dependency-version: 4.8.195 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.vertx:vertx-sql-client dependency-version: 5.1.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.vertx:vertx-mysql-client dependency-version: 5.1.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: io.vertx:vertx-pg-client dependency-version: 5.1.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: software.amazon.awssdk:bom dependency-version: 2.54.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.jline:jline dependency-version: 3.30.17 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.jline:jline-terminal-jna dependency-version: 3.30.17 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: org.apache.maven.plugins:maven-plugin-plugin dependency-version: 3.16.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: org.eclipse.jetty.http2:jetty-http2-client dependency-version: 12.1.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Sep 14, 2026

jknack added this to the 4.5.5 milestone Sep 14, 2026

jknack merged commit ce41e2f into main Sep 14, 2026
4 checks passed

dependabot Bot deleted the dependabot/maven/dependencies-8e88045d6b branch September 14, 2026 09:59

Navigation Menu

Uh oh!

build(deps): bump the dependencies group with 35 updates - #4005

build(deps): bump the dependencies group with 35 updates#4005
jknack merged 1 commit into
mainfrom
dependabot/maven/dependencies-8e88045d6b

dependabot Bot commented on behalf of github Sep 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 14, 2026

netty-4.2.18.Final

Security fixes

Compatibility Notes

What's Changed

netty-4.2.18.Final

Security fixes

Compatibility Notes

What's Changed

netty-4.2.18.Final

Security fixes

Compatibility Notes

What's Changed

netty-4.2.18.Final

Security fixes

Compatibility Notes

What's Changed

netty-4.2.18.Final

Security fixes

Compatibility Notes

What's Changed

Kotlin 2.4.20

Changelog

Analysis API

Analysis API. Code Compilation

Analysis API. FIR

Analysis API. Infrastructure

Analysis API. Light Classes

New Features

Fixes

2.4.20

Analysis API

Analysis API. Code Compilation

Analysis API. FIR

Analysis API. Infrastructure

Analysis API. Light Classes

New Features

Fixes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant