From ce8763c91183f93f00b093677d56eff84d2a3a15 Mon Sep 17 00:00:00 2001
From: Wu Sheng <wu.sheng@foxmail.com>
Date: Tue, 3 Nov 2026 00:46:48 +0800
Subject: [PATCH] Bump dependencies to fix security alerts

Shipped in skywalking-agent.jar (shaded):
- netty 4.1.124.Final -> 4.1.139.Final (root pom netty.version, through
  netty-bom). OSV lists 4.1.124.Final for netty-codec (GHSA-3p8m-j85q-pgmj,
  GHSA-558v-64gr-wgg4, GHSA-mj4r-2hfc-f8p6), netty-codec-http (18
  advisories, e.g. GHSA-4mp9-239f-g9hg, GHSA-8c42-7qj2-3j46), netty-codec-http2
  (7, e.g. GHSA-93wv-jw9v-4972), netty-handler (5, e.g. GHSA-c4c3-7fpv-j4q5)
  and netty-handler-proxy (GHSA-45q3-82m4-75jr); 4.1.139.Final has none.
- netty-tcnative-boringssl-static 2.0.70.Final -> 2.0.84.Final, the
  version netty 4.1.139.Final is built with.
- dist-material/LICENSE names netty 4.1.139. CHANGES.md updated.

guava stays on 32.1.3-jre (see the pom comment on Java 8).
---
 CHANGES.md            | 3 +++
 dist-material/LICENSE | 2 +-
 pom.xml               | 4 ++--
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/CHANGES.md b/CHANGES.md
index 2984b9541a..a490aa4104 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -27,6 +27,9 @@ Release Notes.
   message to add its headers, and now adds them to the copy of the message that the client sends.
 * Test the `rocketMQ-5.x` plugin with rocketmq-client 5.5, and the `rocketMQ-client-java-5.x` plugin with
   rocketmq-client-java 5.0, 5.1 and 5.2.
+* Bump the netty shaded into the agent from `4.1.124.Final` to `4.1.139.Final` (with netty-tcnative-boringssl-static
+  `2.0.70.Final` → `2.0.84.Final`, the version netty `4.1.139.Final` is built with) to clear the netty-codec,
+  netty-codec-http, netty-codec-http2, netty-handler and netty-handler-proxy CVEs.
 
 All issues and pull requests are [here](https://github.com/apache/skywalking/milestone/267?closed=1)
 
diff --git a/dist-material/LICENSE b/dist-material/LICENSE
index a7cb7efaeb..11f8dd653e 100755
--- a/dist-material/LICENSE
+++ b/dist-material/LICENSE
@@ -221,7 +221,7 @@ The text of each license is the standard Apache 2.0 license.
     Google: proto-google-common-protos 2.59.2: https://github.com/googleapis/googleapis , Apache 2.0
     Google: jsr305 3.0.2: http://central.maven.org/maven2/com/google/code/findbugs/jsr305/3.0.0/jsr305-3.0.0.pom , Apache 2.0
     Google: guava 32.1.3: https://github.com/google/guava , Apache 2.0
-    netty 4.1.124: https://github.com/netty/netty/blob/4.1/LICENSE.txt, Apache 2.0
+    netty 4.1.139: https://github.com/netty/netty/blob/4.1/LICENSE.txt, Apache 2.0
     async-profiler 3.0: https://github.com/async-profiler/async-profiler/blob/v3.0/LICENSE, Apache 2.0
 
 ========================================================================
diff --git a/pom.xml b/pom.xml
index ec35bdd8c5..242d3ed8e2 100755
--- a/pom.xml
+++ b/pom.xml
@@ -91,7 +91,7 @@
         <!-- core lib dependency -->
         <bytebuddy.version>1.17.6</bytebuddy.version>
         <grpc.version>1.74.0</grpc.version>
-        <netty.version>4.1.124.Final</netty.version>
+        <netty.version>4.1.139.Final</netty.version>
         <gson.version>2.13.1</gson.version>
         <!-- Google ends the JAVA8 support since v33 -->
         <!-- Can't upgrade Guava until JAVA8 EOL -->
@@ -101,7 +101,7 @@
         <protobuf-maven-plugin.version>0.6.1</protobuf-maven-plugin.version>
         <com.google.protobuf.protoc.version>3.25.5</com.google.protobuf.protoc.version>
         <protoc-gen-grpc-java.plugin.version>1.74.0</protoc-gen-grpc-java.plugin.version>
-        <netty-tcnative-boringssl-static.version>2.0.70.Final</netty-tcnative-boringssl-static.version>
+        <netty-tcnative-boringssl-static.version>2.0.84.Final</netty-tcnative-boringssl-static.version>
         <javax.annotation-api.version>1.3.2</javax.annotation-api.version>
         <objenesis.version>3.1</objenesis.version>
         <async-profiler.version>3.0</async-profiler.version>