Skip to content

build(deps): bump the dependencies group with 35 updates - #4005

Merged
jknack merged 1 commit into
mainfrom
dependabot/maven/dependencies-8e88045d6b
Sep 14, 2026
Merged

build(deps): bump the dependencies group with 35 updates#4005
jknack merged 1 commit into
mainfrom
dependabot/maven/dependencies-8e88045d6b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 35 updates:

Package From To
io.netty:netty-bom 4.2.17.Final 4.2.18.Final
io.netty:netty-codec-http2 4.2.17.Final 4.2.18.Final
io.netty:netty-transport-native-epoll 4.2.17.Final 4.2.18.Final
io.netty:netty-transport-native-kqueue 4.2.17.Final 4.2.18.Final
io.netty:netty-transport-native-io_uring 4.2.17.Final 4.2.18.Final
org.slf4j:slf4j-api 2.0.18 2.0.19
org.slf4j:log4j-over-slf4j 2.0.18 2.0.19
org.slf4j:jcl-over-slf4j 2.0.18 2.0.19
org.slf4j:jul-to-slf4j 2.0.18 2.0.19
org.slf4j:slf4j-simple 2.0.18 2.0.19
org.eclipse.jetty:jetty-server 12.1.12 12.1.13
org.eclipse.jetty.websocket:jetty-websocket-core-server 12.1.12 12.1.13
org.eclipse.jetty.websocket:jetty-websocket-jetty-api 12.1.12 12.1.13
org.eclipse.jetty.websocket:jetty-websocket-jetty-server 12.1.12 12.1.13
org.eclipse.jetty.http2:jetty-http2-server 12.1.12 12.1.13
org.eclipse.jetty:jetty-alpn-java-server 12.1.12 12.1.13
org.eclipse.jetty.compression:jetty-compression-server 12.1.12 12.1.13
org.eclipse.jetty.compression:jetty-compression-gzip 12.1.12 12.1.13
org.eclipse.jetty.http2:jetty-http2-client 12.1.12 12.1.13
org.jetbrains.kotlin:kotlin-stdlib 2.4.10 2.4.20
org.jetbrains.kotlin:kotlin-reflect 2.4.10 2.4.20
org.jetbrains.kotlin:kotlin-maven-plugin 2.4.10 2.4.20
org.apache.maven.plugin-tools:maven-plugin-annotations 3.15.2 3.16.0
io.repaint.maven:tiles-maven-plugin 2.45 2.45.1
com.diffplug.spotless:spotless-maven-plugin 3.10.1 3.10.2
io.vertx:vertx-core 5.1.7 5.1.8
io.vertx:vertx-sql-client 5.1.7 5.1.8
io.vertx:vertx-mysql-client 5.1.7 5.1.8
io.vertx:vertx-pg-client 5.1.7 5.1.8
dev.langchain4j:langchain4j-bom 1.19.0 1.20.0
io.github.classgraph:classgraph 4.8.194 4.8.195
software.amazon.awssdk:bom 2.54.12 2.54.16
org.jline:jline 3.30.16 3.30.17
org.jline:jline-terminal-jna 3.30.16 3.30.17
org.apache.maven.plugins:maven-plugin-plugin 3.15.2 3.16.0

Updates io.netty:netty-bom from 4.2.17.Final to 4.2.18.Final

Release notes

Sourced from io.netty:netty-bom's releases.

netty-4.2.18.Final

Security fixes

  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1)
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
  • CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility Notes

A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.

Two specific changes are worth calling out:

QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown.

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

... (truncated)

Commits
  • 2521f49 [maven-release-plugin] prepare release netty-4.2.18.Final
  • 6fd5327 HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...
  • c44a052 SPDY: SpdySessionHandler must limit the concurrent streams
  • 374d965 HTTP: Limit the maximum number of concurrent pipelined requests
  • 7e8b325 HTTP/2: Limit HPACK encoding table size
  • e3ebf70 OCSP: Correctly handle that nextUpdate is optional
  • 5388535 STOMP: Correctly release partial content on handler removal
  • 3a80f5a WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...
  • 1b6ea48 HTTP3: Correctly handle ":authority" and "host" headers
  • 3630659 STOMP codec content-length long-to-int truncation causes infinite decode loop...
  • Additional commits viewable in compare view

Updates io.netty:netty-codec-http2 from 4.2.17.Final to 4.2.18.Final

Release notes

Sourced from io.netty:netty-codec-http2's releases.

netty-4.2.18.Final

Security fixes

  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1)
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
  • CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility Notes

A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.

Two specific changes are worth calling out:

QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown.

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

... (truncated)

Commits
  • 2521f49 [maven-release-plugin] prepare release netty-4.2.18.Final
  • 6fd5327 HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...
  • c44a052 SPDY: SpdySessionHandler must limit the concurrent streams
  • 374d965 HTTP: Limit the maximum number of concurrent pipelined requests
  • 7e8b325 HTTP/2: Limit HPACK encoding table size
  • e3ebf70 OCSP: Correctly handle that nextUpdate is optional
  • 5388535 STOMP: Correctly release partial content on handler removal
  • 3a80f5a WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...
  • 1b6ea48 HTTP3: Correctly handle ":authority" and "host" headers
  • 3630659 STOMP codec content-length long-to-int truncation causes infinite decode loop...
  • Additional commits viewable in compare view

Updates io.netty:netty-transport-native-epoll from 4.2.17.Final to 4.2.18.Final

Release notes

Sourced from io.netty:netty-transport-native-epoll's releases.

netty-4.2.18.Final

Security fixes

  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1)
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
  • CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility Notes

A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.

Two specific changes are worth calling out:

QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown.

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

... (truncated)

Commits
  • 2521f49 [maven-release-plugin] prepare release netty-4.2.18.Final
  • 6fd5327 HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...
  • c44a052 SPDY: SpdySessionHandler must limit the concurrent streams
  • 374d965 HTTP: Limit the maximum number of concurrent pipelined requests
  • 7e8b325 HTTP/2: Limit HPACK encoding table size
  • e3ebf70 OCSP: Correctly handle that nextUpdate is optional
  • 5388535 STOMP: Correctly release partial content on handler removal
  • 3a80f5a WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...
  • 1b6ea48 HTTP3: Correctly handle ":authority" and "host" headers
  • 3630659 STOMP codec content-length long-to-int truncation causes infinite decode loop...
  • Additional commits viewable in compare view

Updates io.netty:netty-transport-native-kqueue from 4.2.17.Final to 4.2.18.Final

Release notes

Sourced from io.netty:netty-transport-native-kqueue's releases.

netty-4.2.18.Final

Security fixes

  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1)
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
  • CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility Notes

A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.

Two specific changes are worth calling out:

QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown.

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

... (truncated)

Commits
  • 2521f49 [maven-release-plugin] prepare release netty-4.2.18.Final
  • 6fd5327 HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...
  • c44a052 SPDY: SpdySessionHandler must limit the concurrent streams
  • 374d965 HTTP: Limit the maximum number of concurrent pipelined requests
  • 7e8b325 HTTP/2: Limit HPACK encoding table size
  • e3ebf70 OCSP: Correctly handle that nextUpdate is optional
  • 5388535 STOMP: Correctly release partial content on handler removal
  • 3a80f5a WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...
  • 1b6ea48 HTTP3: Correctly handle ":authority" and "host" headers
  • 3630659 STOMP codec content-length long-to-int truncation causes infinite decode loop...
  • Additional commits viewable in compare view

Updates io.netty:netty-transport-native-io_uring from 4.2.17.Final to 4.2.18.Final

Release notes

Sourced from io.netty:netty-transport-native-io_uring's releases.

netty-4.2.18.Final

Security fixes

  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1)
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
  • CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility Notes

A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.

Two specific changes are worth calling out:

QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown.

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

... (truncated)

Commits
  • 2521f49 [maven-release-plugin] prepare release netty-4.2.18.Final
  • 6fd5327 HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...
  • c44a052 SPDY: SpdySessionHandler must limit the concurrent streams
  • 374d965 HTTP: Limit the maximum number of concurrent pipelined requests
  • 7e8b325 HTTP/2: Limit HPACK encoding table size
  • e3ebf70 OCSP: Correctly handle that nextUpdate is optional
  • 5388535 STOMP: Correctly release partial content on handler removal
  • 3a80f5a WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...
  • 1b6ea48 HTTP3: Correctly handle ":authority" and "host" headers
  • 3630659 STOMP codec content-length long-to-int truncation causes infinite decode loop...
  • Additional commits viewable in compare view

Updates org.slf4j:slf4j-api from 2.0.18 to 2.0.19

Updates org.slf4j:log4j-over-slf4j from 2.0.18 to 2.0.19

Updates org.slf4j:jcl-over-slf4j from 2.0.18 to 2.0.19

Updates org.slf4j:jul-to-slf4j from 2.0.18 to 2.0.19

Updates org.slf4j:slf4j-simple from 2.0.18 to 2.0.19

Updates org.slf4j:log4j-over-slf4j from 2.0.18 to 2.0.19

Updates org.slf4j:jcl-over-slf4j from 2.0.18 to 2.0.19

Updates org.slf4j:jul-to-slf4j from 2.0.18 to 2.0.19

Updates org.eclipse.jetty:jetty-server from 12.1.12 to 12.1.13

Updates org.eclipse.jetty.websocket:jetty-websocket-core-server from 12.1.12 to 12.1.13

Updates org.eclipse.jetty.websocket:jetty-websocket-jetty-api from 12.1.12 to 12.1.13

Updates org.eclipse.jetty.websocket:jetty-websocket-jetty-server from 12.1.12 to 12.1.13

Updates org.eclipse.jetty.http2:jetty-http2-server from 12.1.12 to 12.1.13

Updates org.eclipse.jetty:jetty-alpn-java-server from 12.1.12 to 12.1.13

Updates org.eclipse.jetty.compression:jetty-compression-server from 12.1.12 to 12.1.13

Updates org.eclipse.jetty.compression:jetty-compression-gzip from 12.1.12 to 12.1.13

Updates org.eclipse.jetty.http2:jetty-http2-client from 12.1.12 to 12.1.13

Updates org.eclipse.jetty.websocket:jetty-websocket-core-server from 12.1.12 to 12.1.13

Updates org.jetbrains.kotlin:kotlin-stdlib from 2.4.10 to 2.4.20

Release notes

Sourced from org.jetbrains.kotlin:kotlin-stdlib's releases.

Kotlin 2.4.20

Changelog

Analysis API

  • KT-86546 Check suspicious when over ConeKotlinType in ConeTypeCompatibilityChecker
  • KT-85418 Implement an API for accessing deserialized file annotations in Analysis API
  • KT-74448 K2. False positive MISSING_DEPENDENCY_SUPERCLASS in LinkedListTest.kt, kotlinx.coroutines
  • KT-85856 containingSymbol of constructor property differs for local and non-local classes
  • KT-65417 K2 IDE: KTOR false positive expect-actual matching error on enum class because of implicit clone() in non-JVM source sets

Analysis API. Code Compilation

  • KT-76457 K2 IDE / KMP Debugger: KISEWA “Cannot compile a common source without a JVM counterpart” on evaluating inline fun from common module inside jvm

Analysis API. FIR

  • KT-70552 No expects for actual
  • KT-69727 K2 IDE. Wrong error in the editor on calling clone function of actual enum instance in non-jvm platform
  • KT-69726 FP errors on declaring fun clone() in actual enum in not-jvm source-set
  • KT-86014 Types are broken after remove parameter through change signature
  • KT-86363 KotlinIllegalArgumentExceptionWithAttachments: No dangling modifier found on companion blocks
  • KT-86147 Drop kotlin.parallel.resolve.under.global.lock registry key
  • KT-85543 Avoid lazy resolve for the contracts phase if no constracts might be resolved

Analysis API. Infrastructure

  • KT-84914 Do not publish analysis-api-test-framework
  • KT-86986 kotlin-compiler-common-for-ide bundles unrelated Analysis API modules
  • KT-86186 Analysis API: Codebase tests run twice in some analysis modules — pick a single JUnit runner and migrate
  • KT-85360 Drop kotlin-compiler-testdata-for-ide artifact
  • KT-85585 Simplify the dependencies graph for the Analysis API modules
  • KT-85381 Remove tests for the FE10 implementation

Analysis API. Light Classes

New Features

  • KT-84645 Support resolving to companion block members & extensions from Java (light classes)
  • KT-80775 Support PsiClass#getRecordComponents in light classes

Fixes

  • KT-57537 SLC: propagate default parameter value from (@JvmOverloads) expect declarations to actual declarations
  • KT-85040 [Analysis API] Improve Java / Kotlin interop in KMP projects
  • KT-87301 SymbolLightAccessorMethod#isValid returns false for delegated properties
  • KT-87171 SLC: non-mapped Kotlin collection supertype is dropped from supertype list
  • KT-87250 JvmExposeBoxed: light classes shouldn't be autogenerated for private declarations
  • KT-70428 AA: good code is red when a Java class extends a Kotlin class implementing MutableList by delegation
  • KT-63568 Symbol Light Classes: KtAnnotationApplicationWithArgumentsInfo.normalizedArguments() may work incorrectly when psi is not set

... (truncated)

Changelog

Sourced from org.jetbrains.kotlin:kotlin-stdlib's changelog.

2.4.20

Analysis API

  • KT-86546 Check suspicious when over ConeKotlinType in ConeTypeCompatibilityChecker
  • KT-85418 Implement an API for accessing deserialized file annotations in Analysis API
  • KT-74448 K2. False positive MISSING_DEPENDENCY_SUPERCLASS in LinkedListTest.kt, kotlinx.coroutines
  • KT-85856 containingSymbol of constructor property differs for local and non-local classes
  • KT-65417 K2 IDE: KTOR false positive expect-actual matching error on enum class because of implicit clone() in non-JVM source sets

Analysis API. Code Compilation

  • KT-76457 K2 IDE / KMP Debugger: KISEWA “Cannot compile a common source without a JVM counterpart” on evaluating inline fun from common module inside jvm

Analysis API. FIR

  • KT-70552 No expects for actual
  • KT-69727 K2 IDE. Wrong error in the editor on calling clone function of actual enum instance in non-jvm platform
  • KT-69726 FP errors on declaring fun clone() in actual enum in not-jvm source-set
  • KT-86014 Types are broken after remove parameter through change signature
  • KT-86363 KotlinIllegalArgumentExceptionWithAttachments: No dangling modifier found on companion blocks
  • KT-86147 Drop kotlin.parallel.resolve.under.global.lock registry key
  • KT-85543 Avoid lazy resolve for the contracts phase if no constracts might be resolved

Analysis API. Infrastructure

  • KT-84914 Do not publish analysis-api-test-framework
  • KT-86986 kotlin-compiler-common-for-ide bundles unrelated Analysis API modules
  • KT-86186 Analysis API: Codebase tests run twice in some analysis modules — pick a single JUnit runner and migrate
  • KT-85360 Drop kotlin-compiler-testdata-for-ide artifact
  • KT-85585 Simplify the dependencies graph for the Analysis API modules
  • KT-85381 Remove tests for the FE10 implementation

Analysis API. Light Classes

New Features

  • KT-84645 Support resolving to companion block members & extensions from Java (light classes)
  • KT-80775 Support PsiClass#getRecordComponents in light classes

Fixes

  • KT-57537 SLC: propagate default parameter value from (@JvmOverloads) expect declarations to actual declarations
  • KT-85040 [Analysis API] Improve Java / Kotlin interop in KMP projects
  • KT-87301 SymbolLightAccessorMethod#isValid returns false for delegated properties
  • KT-87171 SLC: non-mapped Kotlin collection supertype is dropped from supertype list
  • KT-87250 JvmExposeBoxed: light classes shouldn't be autogenerated for private declarations
  • KT-70428 AA: good code is red when a Java class extends a Kotlin class implementing MutableList by delegation
  • KT-63568 Symbol Light Classes: KtAnnotationApplicationWithArgumentsInfo.normalizedArguments() may work incorrectly when psi is not set
  • KT-36740 MPP: False-positive incompatible types in .java when using expect-class returned by non-expect member from common when actual is actual typealias

... (truncated)

Commits
  • 890ac1d Add Changelog for 2.4.20-RC3
  • 8860aed 🍒 [FIR] Fix suspend conversion when expected type is nullable (#7769)
  • ab5bcd9 Edit ChangeLog for 2.4.20-RC2
  • 9464edc Add ChangeLog for 2.4.20-RC2
  • 0261e43 Cherry-pick "Fix asBodyAndResultVar call in `visitInlinedLambdaInComposable...
  • 0763513 [box-tests] Workaround for klib compatibility tests (#7626)
  • 045aec6 [Wasm] Append scripts from webpack.config.d in the end of the file (#7615)
  • cd7173b 🍒 [2.4.20] [K/JS] Keep associated obj annotation only if getInstance survives...
  • d36a2ff CastsOptimizationPass: break aliases cycles (#7578)

@dependabot
build(deps): bump the dependencies group with 35 updates
b4d78d1 
Bumps the dependencies group with 35 updates:

| Package | From | To |
| --- | --- | --- |
| [io.netty:netty-bom](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` |
| [io.netty:netty-codec-http2](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` |
| [io.netty:netty-transport-native-epoll](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` |
| [io.netty:netty-transport-native-kqueue](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` |
| [io.netty:netty-transport-native-io_uring](https://github.com/netty/netty) | `4.2.17.Final` | `4.2.18.Final` |
| org.slf4j:slf4j-api | `2.0.18` | `2.0.19` |
| org.slf4j:log4j-over-slf4j | `2.0.18` | `2.0.19` |
| org.slf4j:jcl-over-slf4j | `2.0.18` | `2.0.19` |
| org.slf4j:jul-to-slf4j | `2.0.18` | `2.0.19` |
| org.slf4j:slf4j-simple | `2.0.18` | `2.0.19` |
| org.eclipse.jetty:jetty-server | `12.1.12` | `12.1.13` |
| org.eclipse.jetty.websocket:jetty-websocket-core-server | `12.1.12` | `12.1.13` |
| org.eclipse.jetty.websocket:jetty-websocket-jetty-api | `12.1.12` | `12.1.13` |
| org.eclipse.jetty.websocket:jetty-websocket-jetty-server | `12.1.12` | `12.1.13` |
| org.eclipse.jetty.http2:jetty-http2-server | `12.1.12` | `12.1.13` |
| org.eclipse.jetty:jetty-alpn-java-server | `12.1.12` | `12.1.13` |
| org.eclipse.jetty.compression:jetty-compression-server | `12.1.12` | `12.1.13` |
| org.eclipse.jetty.compression:jetty-compression-gzip | `12.1.12` | `12.1.13` |
| org.eclipse.jetty.http2:jetty-http2-client | `12.1.12` | `12.1.13` |
| [org.jetbrains.kotlin:kotlin-stdlib](https://github.com/JetBrains/kotlin) | `2.4.10` | `2.4.20` |
| [org.jetbrains.kotlin:kotlin-reflect](https://github.com/JetBrains/kotlin) | `2.4.10` | `2.4.20` |
| org.jetbrains.kotlin:kotlin-maven-plugin | `2.4.10` | `2.4.20` |
| [org.apache.maven.plugin-tools:maven-plugin-annotations](https://github.com/apache/maven-plugin-tools) | `3.15.2` | `3.16.0` |
| [io.repaint.maven:tiles-maven-plugin](https://github.com/repaint-io/maven-tiles) | `2.45` | `2.45.1` |
| [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) | `3.10.1` | `3.10.2` |
| [io.vertx:vertx-core](https://github.com/eclipse/vert.x) | `5.1.7` | `5.1.8` |
| [io.vertx:vertx-sql-client](https://github.com/eclipse-vertx/vertx-sql-client) | `5.1.7` | `5.1.8` |
| [io.vertx:vertx-mysql-client](https://github.com/eclipse-vertx/vertx-sql-client) | `5.1.7` | `5.1.8` |
| [io.vertx:vertx-pg-client](https://github.com/eclipse-vertx/vertx-sql-client) | `5.1.7` | `5.1.8` |
| [dev.langchain4j:langchain4j-bom](https://github.com/langchain4j/langchain4j) | `1.19.0` | `1.20.0` |
| [io.github.classgraph:classgraph](https://github.com/classgraph/classgraph) | `4.8.194` | `4.8.195` |
| software.amazon.awssdk:bom | `2.54.12` | `2.54.16` |
| [org.jline:jline](https://github.com/jline/jline3) | `3.30.16` | `3.30.17` |
| org.jline:jline-terminal-jna | `3.30.16` | `3.30.17` |
| [org.apache.maven.plugins:maven-plugin-plugin](https://github.com/apache/maven-plugin-tools) | `3.15.2` | `3.16.0` |


Updates `io.netty:netty-bom` from 4.2.17.Final to 4.2.18.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final)

Updates `io.netty:netty-codec-http2` from 4.2.17.Final to 4.2.18.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final)

Updates `io.netty:netty-transport-native-epoll` from 4.2.17.Final to 4.2.18.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final)

Updates `io.netty:netty-transport-native-kqueue` from 4.2.17.Final to 4.2.18.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final)

Updates `io.netty:netty-transport-native-io_uring` from 4.2.17.Final to 4.2.18.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final)

Updates `org.slf4j:slf4j-api` from 2.0.18 to 2.0.19

Updates `org.slf4j:log4j-over-slf4j` from 2.0.18 to 2.0.19

Updates `org.slf4j:jcl-over-slf4j` from 2.0.18 to 2.0.19

Updates `org.slf4j:jul-to-slf4j` from 2.0.18 to 2.0.19

Updates `org.slf4j:slf4j-simple` from 2.0.18 to 2.0.19

Updates `org.slf4j:log4j-over-slf4j` from 2.0.18 to 2.0.19

Updates `org.slf4j:jcl-over-slf4j` from 2.0.18 to 2.0.19

Updates `org.slf4j:jul-to-slf4j` from 2.0.18 to 2.0.19

Updates `org.eclipse.jetty:jetty-server` from 12.1.12 to 12.1.13

Updates `org.eclipse.jetty.websocket:jetty-websocket-core-server` from 12.1.12 to 12.1.13

Updates `org.eclipse.jetty.websocket:jetty-websocket-jetty-api` from 12.1.12 to 12.1.13

Updates `org.eclipse.jetty.websocket:jetty-websocket-jetty-server` from 12.1.12 to 12.1.13

Updates `org.eclipse.jetty.http2:jetty-http2-server` from 12.1.12 to 12.1.13

Updates `org.eclipse.jetty:jetty-alpn-java-server` from 12.1.12 to 12.1.13

Updates `org.eclipse.jetty.compression:jetty-compression-server` from 12.1.12 to 12.1.13

Updates `org.eclipse.jetty.compression:jetty-compression-gzip` from 12.1.12 to 12.1.13

Updates `org.eclipse.jetty.http2:jetty-http2-client` from 12.1.12 to 12.1.13

Updates `org.eclipse.jetty.websocket:jetty-websocket-core-server` from 12.1.12 to 12.1.13

Updates `org.jetbrains.kotlin:kotlin-stdlib` from 2.4.10 to 2.4.20
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.4.10...v2.4.20)

Updates `org.jetbrains.kotlin:kotlin-reflect` from 2.4.10 to 2.4.20
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.4.10...v2.4.20)

Updates `org.jetbrains.kotlin:kotlin-maven-plugin` from 2.4.10 to 2.4.20

Updates `org.jetbrains.kotlin:kotlin-reflect` from 2.4.10 to 2.4.20
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.4.10...v2.4.20)

Updates `org.apache.maven.plugin-tools:maven-plugin-annotations` from 3.15.2 to 3.16.0
- [Release notes](https://github.com/apache/maven-plugin-tools/releases)
- [Commits](apache/maven-plugin-tools@maven-plugin-tools-3.15.2...maven-plugin-tools-3.16.0)

Updates `org.jetbrains.kotlin:kotlin-maven-plugin` from 2.4.10 to 2.4.20

Updates `io.repaint.maven:tiles-maven-plugin` from 2.45 to 2.45.1
- [Release notes](https://github.com/repaint-io/maven-tiles/releases)
- [Changelog](https://github.com/repaint-io/maven-tiles/blob/master/CHANGELOG.adoc)
- [Commits](repaint-io/maven-tiles@v2.45.0...v2.45.1)

Updates `com.diffplug.spotless:spotless-maven-plugin` from 3.10.1 to 3.10.2
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](diffplug/spotless@maven/3.10.1...maven/3.10.2)

Updates `org.eclipse.jetty.websocket:jetty-websocket-jetty-api` from 12.1.12 to 12.1.13

Updates `org.eclipse.jetty.websocket:jetty-websocket-jetty-server` from 12.1.12 to 12.1.13

Updates `org.eclipse.jetty.http2:jetty-http2-server` from 12.1.12 to 12.1.13

Updates `org.eclipse.jetty:jetty-alpn-java-server` from 12.1.12 to 12.1.13

Updates `org.eclipse.jetty.compression:jetty-compression-server` from 12.1.12 to 12.1.13

Updates `org.eclipse.jetty.compression:jetty-compression-gzip` from 12.1.12 to 12.1.13

Updates `io.netty:netty-codec-http2` from 4.2.17.Final to 4.2.18.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final)

Updates `io.netty:netty-transport-native-epoll` from 4.2.17.Final to 4.2.18.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final)

Updates `io.netty:netty-transport-native-kqueue` from 4.2.17.Final to 4.2.18.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final)

Updates `io.netty:netty-transport-native-io_uring` from 4.2.17.Final to 4.2.18.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.2.17.Final...netty-4.2.18.Final)

Updates `org.slf4j:slf4j-simple` from 2.0.18 to 2.0.19

Updates `io.vertx:vertx-core` from 5.1.7 to 5.1.8
- [Commits](eclipse-vertx/vert.x@5.1.7...5.1.8)

Updates `io.vertx:vertx-sql-client` from 5.1.7 to 5.1.8
- [Commits](eclipse-vertx/vertx-sql-client@5.1.7...5.1.8)

Updates `io.vertx:vertx-mysql-client` from 5.1.7 to 5.1.8
- [Commits](eclipse-vertx/vertx-sql-client@5.1.7...5.1.8)

Updates `io.vertx:vertx-pg-client` from 5.1.7 to 5.1.8
- [Commits](eclipse-vertx/vertx-sql-client@5.1.7...5.1.8)

Updates `dev.langchain4j:langchain4j-bom` from 1.19.0 to 1.20.0
- [Release notes](https://github.com/langchain4j/langchain4j/releases)
- [Commits](langchain4j/langchain4j@1.19.0...1.20.0)

Updates `io.github.classgraph:classgraph` from 4.8.194 to 4.8.195
- [Release notes](https://github.com/classgraph/classgraph/releases)
- [Commits](classgraph/classgraph@classgraph-4.8.194...classgraph-4.8.195)

Updates `io.vertx:vertx-sql-client` from 5.1.7 to 5.1.8
- [Commits](eclipse-vertx/vertx-sql-client@5.1.7...5.1.8)

Updates `io.vertx:vertx-mysql-client` from 5.1.7 to 5.1.8
- [Commits](eclipse-vertx/vertx-sql-client@5.1.7...5.1.8)

Updates `io.vertx:vertx-pg-client` from 5.1.7 to 5.1.8
- [Commits](eclipse-vertx/vertx-sql-client@5.1.7...5.1.8)

Updates `software.amazon.awssdk:bom` from 2.54.12 to 2.54.16

Updates `org.jline:jline` from 3.30.16 to 3.30.17
- [Release notes](https://github.com/jline/jline3/releases)
- [Commits](jline/jline3@jline-3.30.16...jline-3.30.17)

Updates `org.jline:jline-terminal-jna` from 3.30.16 to 3.30.17

Updates `org.apache.maven.plugins:maven-plugin-plugin` from 3.15.2 to 3.16.0
- [Release notes](https://github.com/apache/maven-plugin-tools/releases)
- [Commits](apache/maven-plugin-tools@maven-plugin-tools-3.15.2...maven-plugin-tools-3.16.0)

Updates `org.eclipse.jetty.http2:jetty-http2-client` from 12.1.12 to 12.1.13

---
updated-dependencies:
- dependency-name: io.netty:netty-bom
  dependency-version: 4.2.18.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.netty:netty-codec-http2
  dependency-version: 4.2.18.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.netty:netty-transport-native-epoll
  dependency-version: 4.2.18.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.netty:netty-transport-native-kqueue
  dependency-version: 4.2.18.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.netty:netty-transport-native-io_uring
  dependency-version: 4.2.18.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.slf4j:slf4j-api
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.slf4j:log4j-over-slf4j
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.slf4j:jcl-over-slf4j
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.slf4j:jul-to-slf4j
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.slf4j:slf4j-simple
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.slf4j:log4j-over-slf4j
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.slf4j:jcl-over-slf4j
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.slf4j:jul-to-slf4j
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.eclipse.jetty:jetty-server
  dependency-version: 12.1.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.eclipse.jetty.websocket:jetty-websocket-core-server
  dependency-version: 12.1.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.eclipse.jetty.websocket:jetty-websocket-jetty-api
  dependency-version: 12.1.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.eclipse.jetty.websocket:jetty-websocket-jetty-server
  dependency-version: 12.1.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.eclipse.jetty.http2:jetty-http2-server
  dependency-version: 12.1.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.eclipse.jetty:jetty-alpn-java-server
  dependency-version: 12.1.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.eclipse.jetty.compression:jetty-compression-server
  dependency-version: 12.1.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.eclipse.jetty.compression:jetty-compression-gzip
  dependency-version: 12.1.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.eclipse.jetty.http2:jetty-http2-client
  dependency-version: 12.1.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.eclipse.jetty.websocket:jetty-websocket-core-server
  dependency-version: 12.1.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.jetbrains.kotlin:kotlin-stdlib
  dependency-version: 2.4.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.jetbrains.kotlin:kotlin-reflect
  dependency-version: 2.4.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.jetbrains.kotlin:kotlin-maven-plugin
  dependency-version: 2.4.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.jetbrains.kotlin:kotlin-reflect
  dependency-version: 2.4.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.apache.maven.plugin-tools:maven-plugin-annotations
  dependency-version: 3.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: org.jetbrains.kotlin:kotlin-maven-plugin
  dependency-version: 2.4.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.repaint.maven:tiles-maven-plugin
  dependency-version: 2.45.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
  dependency-version: 3.10.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.eclipse.jetty.websocket:jetty-websocket-jetty-api
  dependency-version: 12.1.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.eclipse.jetty.websocket:jetty-websocket-jetty-server
  dependency-version: 12.1.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.eclipse.jetty.http2:jetty-http2-server
  dependency-version: 12.1.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.eclipse.jetty:jetty-alpn-java-server
  dependency-version: 12.1.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.eclipse.jetty.compression:jetty-compression-server
  dependency-version: 12.1.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.eclipse.jetty.compression:jetty-compression-gzip
  dependency-version: 12.1.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.netty:netty-codec-http2
  dependency-version: 4.2.18.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.netty:netty-transport-native-epoll
  dependency-version: 4.2.18.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.netty:netty-transport-native-kqueue
  dependency-version: 4.2.18.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.netty:netty-transport-native-io_uring
  dependency-version: 4.2.18.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.slf4j:slf4j-simple
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.vertx:vertx-core
  dependency-version: 5.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.vertx:vertx-sql-client
  dependency-version: 5.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.vertx:vertx-mysql-client
  dependency-version: 5.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.vertx:vertx-pg-client
  dependency-version: 5.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: dev.langchain4j:langchain4j-bom
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io.github.classgraph:classgraph
  dependency-version: 4.8.195
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.vertx:vertx-sql-client
  dependency-version: 5.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.vertx:vertx-mysql-client
  dependency-version: 5.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: io.vertx:vertx-pg-client
  dependency-version: 5.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: software.amazon.awssdk:bom
  dependency-version: 2.54.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.jline:jline
  dependency-version: 3.30.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.jline:jline-terminal-jna
  dependency-version: 3.30.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: org.apache.maven.plugins:maven-plugin-plugin
  dependency-version: 3.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: org.eclipse.jetty.http2:jetty-http2-client
  dependency-version: 12.1.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Sep 14, 2026
@jknack jknack added this to the 4.5.5 milestone Sep 14, 2026
@jknack
jknack merged commit ce41e2f into main Sep 14, 2026
4 checks passed
@dependabot
dependabot Bot deleted the dependabot/maven/dependencies-8e88045d6b branch September 14, 2026 09:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

4.5.5

Development

Successfully merging this pull request may close these issues.

1 participant

@jknack