René's URL Explorer Experiment

Title: build(deps): Bump netty.version from 4.2.17.Final to 4.2.18.Final by dependabot[bot] · Pull Request #3570 · OpenFeign/feign · GitHub

Open Graph Title: build(deps): Bump netty.version from 4.2.17.Final to 4.2.18.Final by dependabot[bot] · Pull Request #3570 · OpenFeign/feign

X Title: build(deps): Bump netty.version from 4.2.17.Final to 4.2.18.Final by dependabot[bot] · Pull Request #3570 · OpenFeign/feign

Description: Bumps netty.version from 4.2.17.Final to 4.2.18.Final. Updates io.netty:netty-bom from 4.2.17.Final to 4.2.18.Final Release notes Sourced from io.netty:netty-bom's releases. netty-4.2.18.Final Security fixes CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY) CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1) CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2 CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3 CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3 CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3 CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP) CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1) CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2 CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1) CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2 CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2 CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1) CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1) CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2 Compatibility Notes A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade. Two specific changes are worth calling out: QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown. HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out. What's Changed Use X509ExtendedTrustManager in SSLErrorTest by @​normanmaurer in netty/netty#17221 Update setup-testlens to v1.9.4 by @​marcphilipp in netty/netty#17223 ... (truncated) Commits 2521f49 [maven-release-plugin] prepare release netty-4.2.18.Final 6fd5327 HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri... c44a052 SPDY: SpdySessionHandler must limit the concurrent streams 374d965 HTTP: Limit the maximum number of concurrent pipelined requests 7e8b325 HTTP/2: Limit HPACK encoding table size e3ebf70 OCSP: Correctly handle that nextUpdate is optional 5388535 STOMP: Correctly release partial content on handler removal 3a80f5a WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer... 1b6ea48 HTTP3: Correctly handle ":authority" and "host" headers 3630659 STOMP codec content-length long-to-int truncation causes infinite decode loop... Additional commits viewable in compare view Updates io.netty:netty-handler from 4.2.17.Final to 4.2.18.Final Release notes Sourced from io.netty:netty-handler's releases. netty-4.2.18.Final Security fixes CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY) CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1) CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2 CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3 CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3 CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3 CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP) CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1) CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2 CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1) CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2 CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2 CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1) CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1) CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2 Compatibility Notes A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade. Two specific changes are worth calling out: QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown. HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out. What's Changed Use X509ExtendedTrustManager in SSLErrorTest by @​normanmaurer in netty/netty#17221 Update setup-testlens to v1.9.4 by @​marcphilipp in netty/netty#17223 ... (truncated) Commits 2521f49 [maven-release-plugin] prepare release netty-4.2.18.Final 6fd5327 HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri... c44a052 SPDY: SpdySessionHandler must limit the concurrent streams 374d965 HTTP: Limit the maximum number of concurrent pipelined requests 7e8b325 HTTP/2: Limit HPACK encoding table size e3ebf70 OCSP: Correctly handle that nextUpdate is optional 5388535 STOMP: Correctly release partial content on handler removal 3a80f5a WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer... 1b6ea48 HTTP3: Correctly handle ":authority" and "host" headers 3630659 STOMP codec content-length long-to-int truncation causes infinite decode loop... Additional commits viewable in compare view Updates io.netty:netty-codec-http from 4.2.17.Final to 4.2.18.Final Release notes Sourced from io.netty:netty-codec-http's releases. netty-4.2.18.Final Security fixes CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY) CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1) CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2 CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3 CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3 CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3 CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP) CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1) CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2 CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1) CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2 CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2 CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1) CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1) CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2 Compatibility Notes A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade. Two specific changes are worth calling out: QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown. HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out. What's Changed Use X509ExtendedTrustManager in SSLErrorTest by @​normanmaurer in netty/netty#17221 Update setup-testlens to v1.9.4 by @​marcphilipp in netty/netty#17223 ... (truncated) Commits 2521f49 [maven-release-plugin] prepare release netty-4.2.18.Final 6fd5327 HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri... c44a052 SPDY: SpdySessionHandler must limit the concurrent streams 374d965 HTTP: Limit the maximum number of concurrent pipelined requests 7e8b325 HTTP/2: Limit HPACK encoding table size e3ebf70 OCSP: Correctly handle that nextUpdate is optional 5388535 STOMP: Correctly release partial content on handler removal 3a80f5a WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer... 1b6ea48 HTTP3: Correctly handle ":authority" and "host" headers 3630659 STOMP codec content-length long-to-int truncation causes infinite decode loop... Additional commits viewable in compare view Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase. Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: @dependabot rebase will rebase this PR @dependabot recreate will recreate this PR, overwriting any edits that have been made to it @dependabot show ignore conditions will show all of the ignore conditions of the specified dependency @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Open Graph Description: Bumps netty.version from 4.2.17.Final to 4.2.18.Final. Updates io.netty:netty-bom from 4.2.17.Final to 4.2.18.Final Release notes Sourced from io.netty:netty-bom's releases. netty-4.2.18.Fina...

X Description: Bumps netty.version from 4.2.17.Final to 4.2.18.Final. Updates io.netty:netty-bom from 4.2.17.Final to 4.2.18.Final Release notes Sourced from io.netty:netty-bom's releases. netty-4.2.18....

Opengraph URL: https://github.com/OpenFeign/feign/pull/3570

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width