rishabhdaim opened a new pull request, #3155: URL: https://github.com/apache/jackrabbit-oak/pull/3155
## Summary Bump the shared Netty version from 4.1.136.Final to 4.1.138.Final. ## Security rationale - CVE-2026-75595 / GHSA-c4c3-7fpv-j4q5 is fixed in Netty 4.1.137 and later. - GHSA-hcvj-94mj-jp5c affects versions through 4.1.137 and is fixed in 4.1.138. - Netty 4.1.138 includes additional upstream security fixes. ## Scope This is a one-line dependency-property update. It updates the embedded Netty modules consumed by oak-segment-tar and oak-blob-cloud-azure; no product source code changes are included. ## Verification - JENV_VERSION=17.0.20 mvn -pl oak-parent,oak-segment-tar,oak-blob-cloud-azure -am -DskipTests package - JENV_VERSION=17.0.20 mvn -pl oak-segment-tar,oak-blob-cloud-azure -DskipTests=false test - oak-segment-tar: 819 tests, 0 failures, 1 skipped - oak-blob-cloud-azure: 214 tests, 0 failures, 7 skipped References: https://issues.apache.org/jira/browse/OAK-12409, https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5, https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
