rishabhdaim opened a new pull request, #3156: URL: https://github.com/apache/jackrabbit-oak/pull/3156
## Summary Backport the merged OAK-12409 Netty dependency update to the Oak 1.22 maintenance branch. ## Change Bump the shared Netty version from 4.1.135.Final to 4.1.138.Final in oak-parent/pom.xml. ## Upstream context This backports the merged trunk fix from PR #3155, merge commit dac516587cf8de419ab3688d1f5ab35f2dc3b0f1. The target Oak maintenance release is 1.22.25. ## Security rationale - CVE-2026-75595 / GHSA-c4c3-7fpv-j4q5 is fixed in Netty 4.1.137 and later. - GHSA-hcvj-94mj-jp5c affects versions through 4.1.137 and is fixed in 4.1.138. - Netty 4.1.138 includes additional upstream security fixes. ## Verification - JENV_VERSION=17.0.20 mvn -pl oak-parent,oak-segment-tar,oak-blob-cloud-azure -am -DskipTests package passed. - JENV_VERSION=11.0.32 mvn -pl oak-segment-tar,oak-blob-cloud-azure -am -DskipTests=false test passed. - Reactor: 13 modules successful; oak-segment-tar: 602 tests, 0 failures; oak-blob-cloud-azure: 10 tests, 0 failures, 6 skipped. Reference: https://issues.apache.org/jira/browse/OAK-12409 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
