Skip to content

Bump the minor-and-patch-dependencies group with 4 updates - #3855

Merged
brfrn169 merged 2 commits into
masterfrom
dependabot/gradle/minor-and-patch-dependencies-b7dad6b1d1
Sep 14, 2026
Merged

Bump the minor-and-patch-dependencies group with 4 updates#3855
brfrn169 merged 2 commits into
masterfrom
dependabot/gradle/minor-and-patch-dependencies-b7dad6b1d1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 13, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch-dependencies group with 4 updates: io.netty:netty-codec-http, io.netty:netty-codec-http2, com.google.cloud:google-cloud-storage and com.google.cloud:google-cloud-spanner-jdbc.

Updates io.netty:netty-codec-http from 4.1.137.Final to 4.1.138.Final

Release notes

Sourced from io.netty:netty-codec-http's releases.

netty-4.1.138.Final

Security fixes

  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
  • CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility note

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

... (truncated)

Commits
  • 26e68a2 [maven-release-plugin] prepare release netty-4.1.138.Final
  • 9099e6b OCSP: Correctly handle that nextUpdate is optional
  • 46f4ab0 Verify id-kp-OCSPSigning EKU on delegated OCSP responder certificates
  • ab3f6df SPDY: SpdySessionHandler must limit the concurrent streams
  • 36ee644 HTTP: Limit the maximum number of concurrent pipelined requests
  • d9cf57d HTTP/2: Limit HPACK encoding table size
  • cb84b06 STOMP: Correctly release partial content on handler removal
  • 3574f7e WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...
  • 9551ac4 STOMP codec content-length long-to-int truncation causes infinite decode loop...
  • d5bc028 Fix frame desynchronization in the binary memcache decoder
  • Additional commits viewable in compare view

Updates io.netty:netty-codec-http2 from 4.1.137.Final to 4.1.138.Final

Release notes

Sourced from io.netty:netty-codec-http2's releases.

netty-4.1.138.Final

Security fixes

  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
  • CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility note

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

... (truncated)

Commits
  • 26e68a2 [maven-release-plugin] prepare release netty-4.1.138.Final
  • 9099e6b OCSP: Correctly handle that nextUpdate is optional
  • 46f4ab0 Verify id-kp-OCSPSigning EKU on delegated OCSP responder certificates
  • ab3f6df SPDY: SpdySessionHandler must limit the concurrent streams
  • 36ee644 HTTP: Limit the maximum number of concurrent pipelined requests
  • d9cf57d HTTP/2: Limit HPACK encoding table size
  • cb84b06 STOMP: Correctly release partial content on handler removal
  • 3574f7e WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...
  • 9551ac4 STOMP codec content-length long-to-int truncation causes infinite decode loop...
  • d5bc028 Fix frame desynchronization in the binary memcache decoder
  • Additional commits viewable in compare view

Updates io.netty:netty-codec-http2 from 4.1.137.Final to 4.1.138.Final

Release notes

Sourced from io.netty:netty-codec-http2's releases.

netty-4.1.138.Final

Security fixes

  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
  • CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
  • CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
  • CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
  • CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
  • CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
  • CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
  • CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility note

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

... (truncated)

Commits
  • 26e68a2 [maven-release-plugin] prepare release netty-4.1.138.Final
  • 9099e6b OCSP: Correctly handle that nextUpdate is optional
  • 46f4ab0 Verify id-kp-OCSPSigning EKU on delegated OCSP responder certificates
  • ab3f6df SPDY: SpdySessionHandler must limit the concurrent streams
  • 36ee644 HTTP: Limit the maximum number of concurrent pipelined requests
  • d9cf57d HTTP/2: Limit HPACK encoding table size
  • cb84b06 STOMP: Correctly release partial content on handler removal
  • 3574f7e WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...
  • 9551ac4 STOMP codec content-length long-to-int truncation causes infinite decode loop...
  • d5bc028 Fix frame desynchronization in the binary memcache decoder
  • Additional commits viewable in compare view

Updates com.google.cloud:google-cloud-storage from 2.72.0 to 2.73.0

Changelog

Sourced from com.google.cloud:google-cloud-storage's changelog.

2.73.0 (2025-07-28)

Dependencies

  • update dependency com.google.cloud:sdk-platform-java-config to v3.50.2 (#11680) (d1b99a7)
Commits

Updates com.google.cloud:google-cloud-spanner-jdbc from 2.43.0 to 2.44.0

Changelog

Sourced from com.google.cloud:google-cloud-spanner-jdbc's changelog.

Changelog

2.92.0 (None)

  • No change

2.91.0 (2026-03-11)

  • No change

2.90.0 (2026-02-25)

Dependencies

  • update dependency com.google.cloud:sdk-platform-java-config to v3.57.0 (#11956) (62b97e1)

2.87.0 (2026-01-29)

Dependencies

  • update dependency com.google.cloud:sdk-platform-java-config to v3.56.0 (#11879) (ac1f018)

2.86.0 (2026-01-15)

Dependencies

  • update dependency com.google.cloud:sdk-platform-java-config to v3.55.1 (#11863) (50cda6e)

2.85.0 (2025-12-16)

Dependencies

  • update dependency com.google.cloud:sdk-platform-java-config to v3.54.2 (#11819) (f32924a)

2.82.0 (2025-10-21)

Dependencies

  • update dependency com.google.cloud:sdk-platform-java-config to v3.53.0 (#11776) (e4a2892)

2.81.0 (2025-10-13)

  • No change

... (truncated)

Commits

Most Recent Ignore Conditions Applied to This Pull Request
Dependency Name Ignore Conditions
io.netty:netty-codec-http [>= 4.2.a, < 4.3]
io.netty:netty-codec-http2 [>= 4.2.a, < 4.3]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the minor-and-patch-dependencies group with 4 updates
3ae25bd 
Bumps the minor-and-patch-dependencies group with 4 updates: [io.netty:netty-codec-http](https://github.com/netty/netty), [io.netty:netty-codec-http2](https://github.com/netty/netty), [com.google.cloud:google-cloud-storage](https://github.com/googleapis/google-cloud-java) and [com.google.cloud:google-cloud-spanner-jdbc](https://github.com/googleapis/google-cloud-java).


Updates `io.netty:netty-codec-http` from 4.1.137.Final to 4.1.138.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.137.Final...netty-4.1.138.Final)

Updates `io.netty:netty-codec-http2` from 4.1.137.Final to 4.1.138.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.137.Final...netty-4.1.138.Final)

Updates `io.netty:netty-codec-http2` from 4.1.137.Final to 4.1.138.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.137.Final...netty-4.1.138.Final)

Updates `com.google.cloud:google-cloud-storage` from 2.72.0 to 2.73.0
- [Release notes](https://github.com/googleapis/google-cloud-java/releases)
- [Changelog](https://github.com/googleapis/google-cloud-java/blob/main/java-document-ai/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-java/commits)

Updates `com.google.cloud:google-cloud-spanner-jdbc` from 2.43.0 to 2.44.0
- [Release notes](https://github.com/googleapis/google-cloud-java/releases)
- [Changelog](https://github.com/googleapis/google-cloud-java/blob/main/java-document-ai/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-java/commits)

---
updated-dependencies:
- dependency-name: io.netty:netty-codec-http
  dependency-version: 4.1.138.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch-dependencies
- dependency-name: io.netty:netty-codec-http2
  dependency-version: 4.1.138.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch-dependencies
- dependency-name: io.netty:netty-codec-http2
  dependency-version: 4.1.138.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch-dependencies
- dependency-name: com.google.cloud:google-cloud-storage
  dependency-version: 2.73.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch-dependencies
- dependency-name: com.google.cloud:google-cloud-spanner-jdbc
  dependency-version: 2.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Sep 13, 2026
@feeblefakie
feeblefakie requested review from a team, KodaiD, Torch3333, brfrn169 and feeblefakie and removed request for a team September 13, 2026 16:04
@brfrn169
brfrn169 enabled auto-merge (squash) September 14, 2026 01:52
@brfrn169
brfrn169 merged commit be08fa7 into master Sep 14, 2026
11 checks passed
@brfrn169
brfrn169 deleted the dependabot/gradle/minor-and-patch-dependencies-b7dad6b1d1 branch September 14, 2026 02:08
@feeblefakie feeblefakie mentioned this pull request Sep 14, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@brfrn169 brfrn169 brfrn169 approved these changes
@Torch3333 Torch3333 Torch3333 approved these changes
@feeblefakie feeblefakie Awaiting requested review from feeblefakie feeblefakie was automatically assigned from scalar-labs/scalardb
@KodaiD KodaiD Awaiting requested review from KodaiD KodaiD was automatically assigned from scalar-labs/scalardb

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file improvement java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@brfrn169 @Torch3333