Skip to content

Upgrade netty version#164

Draft
sidhdirenge wants to merge 1 commit into
developfrom
jetski/fix-vulns-jackson-netty
Draft

Upgrade netty version#164
sidhdirenge wants to merge 1 commit into
developfrom
jetski/fix-vulns-jackson-netty

Conversation

@sidhdirenge

Copy link
Copy Markdown

No description provided.

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request adds a dependency on io.netty:netty:3.9.9.Final to the adls-plugins pom.xml. The review feedback correctly identifies that hardcoding dependency versions in child modules reduces maintainability and highlights that Netty 3.9.9.Final is an outdated version with known security vulnerabilities. It is recommended to manage the dependency version in the parent POM and upgrade to a secure version.

Comment thread adls-plugins/pom.xml
Comment on lines +31 to +35
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty</artifactId>
<version>3.9.9.Final</version>
</dependency>

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

Hardcoding dependency versions in child modules reduces maintainability and can lead to version mismatch issues across the project. It is highly recommended to define the version in the parent pom.xml (either under properties or dependencyManagement) and reference it here using a property.

Additionally, Netty 3.9.9.Final is an extremely old version with multiple known security vulnerabilities (CVEs). If a 3.x version is strictly required due to legacy dependencies, please consider upgrading to at least 3.10.6.Final. Otherwise, upgrading to a supported 4.x version is strongly recommended.

Suggested change
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty</artifactId>
<version>3.9.9.Final</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty</artifactId>
<version>${netty.version}</version>
</dependency>

@sidhdirenge sidhdirenge force-pushed the jetski/fix-vulns-jackson-netty branch from c48bf84 to 7634a8d Compare June 18, 2026 09:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant