Skip to content

Bump netty from 4.2.10.Final to 4.2.15.Final#1817

Open
jonesdevelopment wants to merge 2 commits into
PaperMC:dev/3.0.0from
jonesdevelopment:deps/bump-netty
Open

Bump netty from 4.2.10.Final to 4.2.15.Final#1817
jonesdevelopment wants to merge 2 commits into
PaperMC:dev/3.0.0from
jonesdevelopment:deps/bump-netty

Conversation

@jonesdevelopment

@jonesdevelopment jonesdevelopment commented May 30, 2026

Copy link
Copy Markdown
Contributor

4.2.15.Final fixes 22 CVEs, one of which affects haproxy.

4.2.13.Final fixes 13 CVEs, one of which affects epoll.

4.2.11.Final, 4.2.12.Final, and 4.2.14.Final are bug-fix releases. There are no major/breaking changes.

I have tested this change in production and did not encounter any issues.

@WouterGritter

WouterGritter commented May 30, 2026

Copy link
Copy Markdown
Contributor

CVE-2026-42577 does not affect Velocity, we don't make use of ALLOW_HALF_CLOSURE. Still, a netty bump would be very welcome ofc.

Plugins that rely on the netty Velocity ships might make use of netty features that have fixed bugs/CVE's

Comment thread gradle/libs.versions.toml Outdated
Co-authored-by: Wouter Gritter <wouter@gritter.nl>
@jonesdevelopment jonesdevelopment changed the title Bump netty from 4.2.10.Final to 4.2.14.Final Bump netty from 4.2.10.Final to 4.2.15.Final Jun 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants