Bump io.netty:netty-transport-native-epoll from 4.1.133.Final to 4.2.13.Final in /hadoop-project by dependabot[bot] · Pull Request #8486 · apache/hadoop

dependabot · 2026-05-08T05:29:02Z

Bumps io.netty:netty-transport-native-epoll from 4.1.133.Final to 4.2.13.Final.

Release notes

Sourced from io.netty:netty-transport-native-epoll's releases.

netty-4.2.13.Final

CVEs Fixed

CVE-2026-42586 (netty-codec-redis)

CVE-2026-42578 (netty-handler-proxy)

CVE-2026-42577 (netty-transport-native-epoll)

CVE-2026-42587 (netty-codec-http, netty-codec-http2)

CVE-2026-41417 (netty-codec-http)

CVE-2026-42581 (netty-codec-http)

CVE-2026-42580 (netty-codec-http)

CVE-2026-42585 (netty-codec-http)

CVE-2026-42579 (netty-codec-dns)

CVE-2026-42582 (netty-codec-http3)

CVE-2026-42583 (netty-codec, netty-codec-compression)

CVE-2026-42584 (netty-codec-http)

CVE-2026-44248 (netty-codec-mqtt)

What's Changed

Kqueue: sendfile EINTR doesn't advance offset — data duplication by @normanmaurer in netty/netty#16544

Replace usage of strerror with thread-safe alternative by @normanmaurer in netty/netty#16547

Fix implementation of strerror_r_xsi for GNU by @normanmaurer in netty/netty#16546

Lazy init ArrayList in DefaultHeaders.getAll by @doom369 in netty/netty#16526

Less logging in AWS-LC build by @chrisvest in netty/netty#16565

Ensure the CRYPTO_BUFFER_POOL is also freed when we fail creating the SSLContext by @normanmaurer in netty/netty#16545

Auto-port 4.2: Fix IndexOutOfBoundsException in StompSubframeDecoder on heartbeat by @netty-project-bot in netty/netty#16543

Avoid leak in PemReader on OutOfDirectMemoryError by @raipc in netty/netty#16551

IoUring: Disable test while we debug to unblock other builds by @normanmaurer in netty/netty#16581

Include user properties and subscription IDs in MqttProperties#isEmpty by @ShadowySpirits in netty/netty#16575

Native DNS resolver: Guard against malloc failures by @normanmaurer in netty/netty#16559

Auto-port 4.2: Increase timeouts for QuicChannelConnectTest by @netty-project-bot in netty/netty#16578

Fix parsing HTTP chunks with multiple extensions by @chrisvest in netty/netty#16579

Bump org.codehaus.plexus:plexus-utils from 3.4.2 to 4.0.3 in /codec-native-quic by @dependabot[bot] in netty/netty#16572

Revert to PR build to Ubuntu 22.04 by @chrisvest in netty/netty#16595

Native transports: Correctly create pipe when pipe2 is not supported by @normanmaurer in netty/netty#16592

Epoll: Cleanup code to always return negative value on failure by @normanmaurer in netty/netty#16591

Fix component search fast path by @yawkat in netty/netty#16548

Stabilize read-only toStringMultipleThreads1 by @chrisvest in netty/netty#16608

Stabilize more AbstractByteBufTests by @chrisvest in netty/netty#16611

Remove note about needing 256-bit for PQC by @chrisvest in netty/netty#16605

Stabilize testSessionInvalidate for Conscrypt by @chrisvest in netty/netty#16615

Quic: Correctly handle SSL_CTX_new failures by @normanmaurer in netty/netty#16622

Make LocalIoHandle public by @rdicroce in netty/netty#16621

Quic: Fix shadowing of variable which leads to incorrectly handling errors by @normanmaurer in netty/netty#16623

Auto-port 4.2: Use stream error for maxContentLength exceeded in InboundHttp2ToHttpAdapter by @netty-project-bot in netty/netty#16629

Fix shutdownInput bug in kqueue for empty recv buffer by @chrisvest in netty/netty#16630

fix FFM address semantics in directBufferAddress by @dreamlike-ocean in netty/netty#16603

HTTP2: Ensure HTTP2 preface is always send as first message by @normanmaurer in netty/netty#16636

Move Http2FrameCodecSubClassTest to correct package by @normanmaurer in netty/netty#16640

Kqueue: Fix usage of LOCAL_PEERPID by @normanmaurer in netty/netty#16637

Avoid ArrayQueue allocation in HttpServerCodec by @doom369 in netty/netty#16596

Fix file descriptor reuse bug in kqueue by @chrisvest in netty/netty#16650

... (truncated)

Commits

b3844c8 [maven-release-plugin] prepare release netty-4.2.13.Final
82f47fa Merge commit from fork
ada0999 Merge commit from fork
b4051e2 Fix BrotliDecoder not forwarding all decompressed chunks
67207c1 Merge commit from fork
541ca7c Merge commit from fork
943edb3 Fix codec-dns tests
6459a28 Merge commit from fork
b4ba61b Fix checkstyle in HttpObjectDecoder
977661f Merge commit from fork
Additional commits viewable in compare view

hadoop-yetus · 2026-05-08T06:39:21Z

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	6m 32s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 0s		codespell was not available.
+0 🆗	detsecrets	0m 0s		detect-secrets was not available.
+0 🆗	xmllint	0m 0s		xmllint was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ trunk Compile Tests _
+1 💚	mvninstall	25m 48s		trunk passed
+1 💚	compile	0m 30s		trunk passed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04
+1 💚	compile	0m 29s		trunk passed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1
+1 💚	mvnsite	0m 30s		trunk passed
+1 💚	javadoc	0m 29s		trunk passed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04
+1 💚	javadoc	0m 31s		trunk passed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1
+1 💚	shadedclient	44m 12s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+1 💚	mvninstall	0m 11s		the patch passed
+1 💚	compile	0m 10s		the patch passed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04
+1 💚	javac	0m 10s		the patch passed
+1 💚	compile	0m 10s		the patch passed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1
+1 💚	javac	0m 10s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	mvnsite	0m 12s		the patch passed
+1 💚	javadoc	0m 11s		the patch passed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04
+1 💚	javadoc	0m 10s		the patch passed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1
-1 ❌	shadedclient	16m 14s		patch has errors when building and testing our client artifacts.
			_ Other Tests _
+1 💚	unit	0m 12s		hadoop-project in the patch passed.
+1 💚	asflicense	0m 23s		The patch does not generate ASF License warnings.
		69m 25s

Subsystem	Report/Notes
Docker	ClientAPI=1.54 ServerAPI=1.54 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8486/1/artifact/out/Dockerfile
GITHUB PR	#8486
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient codespell detsecrets xmllint
uname	Linux 58eaa8a26611 5.15.0-141-generic #151-Ubuntu SMP Sun May 18 21:35:19 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / `0eaa649`
Default Java	Ubuntu-17.0.18+8-Ubuntu-124.04.1
Multi-JDK versions	/usr/lib/jvm/java-21-openjdk-amd64:Ubuntu-21.0.10+7-Ubuntu-124.04 /usr/lib/jvm/java-17-openjdk-amd64:Ubuntu-17.0.18+8-Ubuntu-124.04.1
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8486/1/testReport/
Max. process+thread count	616 (vs. ulimit of 10000)
modules	C: hadoop-project U: hadoop-project
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8486/1/console
versions	git=2.43.0 maven=3.9.15
Powered by	Apache Yetus 0.14.1 https://yetus.apache.org

This message was automatically generated.

Bumps [io.netty:netty-transport-native-epoll](https://github.com/netty/netty) from 4.1.133.Final to 4.2.13.Final. - [Release notes](https://github.com/netty/netty/releases) - [Commits](netty/netty@netty-4.1.133.Final...netty-4.2.13.Final) --- updated-dependencies: - dependency-name: io.netty:netty-transport-native-epoll dependency-version: 4.2.13.Final dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

hadoop-yetus · 2026-05-08T10:44:23Z

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 23s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 1s		codespell was not available.
+0 🆗	detsecrets	0m 1s		detect-secrets was not available.
+0 🆗	xmllint	0m 1s		xmllint was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ trunk Compile Tests _
+1 💚	mvninstall	26m 54s		trunk passed
+1 💚	compile	0m 23s		trunk passed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04
+1 💚	compile	0m 21s		trunk passed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1
+1 💚	mvnsite	0m 23s		trunk passed
+1 💚	javadoc	0m 25s		trunk passed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04
+1 💚	javadoc	0m 21s		trunk passed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1
+1 💚	shadedclient	45m 53s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+1 💚	mvninstall	0m 9s		the patch passed
+1 💚	compile	0m 9s		the patch passed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04
+1 💚	javac	0m 9s		the patch passed
+1 💚	compile	0m 8s		the patch passed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1
+1 💚	javac	0m 8s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	mvnsite	0m 10s		the patch passed
+1 💚	javadoc	0m 11s		the patch passed with JDK Ubuntu-21.0.10+7-Ubuntu-124.04
+1 💚	javadoc	0m 9s		the patch passed with JDK Ubuntu-17.0.18+8-Ubuntu-124.04.1
-1 ❌	shadedclient	18m 5s		patch has errors when building and testing our client artifacts.
			_ Other Tests _
+1 💚	unit	0m 10s		hadoop-project in the patch passed.
+1 💚	asflicense	0m 19s		The patch does not generate ASF License warnings.
		66m 36s

Subsystem	Report/Notes
Docker	ClientAPI=1.54 ServerAPI=1.54 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8486/2/artifact/out/Dockerfile
GITHUB PR	#8486
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient codespell detsecrets xmllint
uname	Linux c2dc17f6515d 5.15.0-141-generic #151-Ubuntu SMP Sun May 18 21:35:19 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / `8014cf7`
Default Java	Ubuntu-17.0.18+8-Ubuntu-124.04.1
Multi-JDK versions	/usr/lib/jvm/java-21-openjdk-amd64:Ubuntu-21.0.10+7-Ubuntu-124.04 /usr/lib/jvm/java-17-openjdk-amd64:Ubuntu-17.0.18+8-Ubuntu-124.04.1
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8486/2/testReport/
Max. process+thread count	637 (vs. ulimit of 10000)
modules	C: hadoop-project U: hadoop-project
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8486/2/console
versions	git=2.43.0 maven=3.9.15
Powered by	Apache Yetus 0.14.1 https://yetus.apache.org

This message was automatically generated.

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels May 8, 2026

github-actions Bot added build trunk labels May 8, 2026

dependabot Bot changed the title ~~Bump io.netty:netty-transport-native-epoll from 4.1.130.Final to 4.2.13.Final in /hadoop-project~~ Bump io.netty:netty-transport-native-epoll from 4.1.133.Final to 4.2.13.Final in /hadoop-project May 8, 2026

dependabot Bot force-pushed the dependabot/maven/hadoop-project/io.netty-netty-transport-native-epoll-4.2.13.Final branch from 0eaa649 to 8014cf7 Compare May 8, 2026 09:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump io.netty:netty-transport-native-epoll from 4.1.133.Final to 4.2.13.Final in /hadoop-project#8486

Bump io.netty:netty-transport-native-epoll from 4.1.133.Final to 4.2.13.Final in /hadoop-project#8486
dependabot[bot] wants to merge 1 commit intotrunkfrom
dependabot/maven/hadoop-project/io.netty-netty-transport-native-epoll-4.2.13.Final

dependabot Bot commented on behalf of github May 8, 2026 •

edited

Loading

Uh oh!

hadoop-yetus commented May 8, 2026

Uh oh!

hadoop-yetus commented May 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

netty-4.2.13.Final

CVEs Fixed

What's Changed

Uh oh!

hadoop-yetus commented May 8, 2026

Uh oh!

hadoop-yetus commented May 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github May 8, 2026 •

edited

Loading