diff --git a/build.gradle b/build.gradle
index 12a0622db99..1ebb3e19bf1 100644
--- a/build.gradle
+++ b/build.gradle
@@ -144,6 +144,17 @@ subprojects {
details.because("Automatically replace android guava with jre version: ${requestedVersion} -> ${jreVersion}")
}
}
+ // Fix CVE-2026-33871: Netty HTTP/2 CONTINUATION Frame Flood DoS
+ // Affected: netty-codec-http2 < 4.1.132.Final
+ // https://github.com/advisories/GHSA-w9fj-cfpg-grvv
+ if (details.requested.group == 'io.netty') {
+ def nettyVersion = details.requested.version
+ if (nettyVersion != null && nettyVersion.startsWith('4.1.') &&
+ nettyVersion < '4.1.132.Final') {
+ details.useVersion('4.1.132.Final')
+ details.because("CVE-2026-33871: force Netty >= 4.1.132.Final to fix HTTP/2 CONTINUATION frame DoS")
+ }
+ }
}
}
}
diff --git a/common/build.gradle b/common/build.gradle
index 98fc3257190..acde43a1ea9 100644
--- a/common/build.gradle
+++ b/common/build.gradle
@@ -8,7 +8,7 @@ sourceCompatibility = 1.8
dependencies {
- api group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.18.3' // https://github.com/FasterXML/jackson-databind/issues/3627
+ api group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.18.6' // https://github.com/FasterXML/jackson-databind/issues/3627
api "com.cedarsoftware:java-util:3.2.0"
api group: 'org.apache.httpcomponents', name: 'httpasyncclient', version: '4.1.1'
api group: 'commons-codec', name: 'commons-codec', version: '1.11'
diff --git a/framework/build.gradle b/framework/build.gradle
index d884b6a7c49..1aa266da3cd 100644
--- a/framework/build.gradle
+++ b/framework/build.gradle
@@ -42,8 +42,8 @@ dependencies {
implementation group: 'io.dropwizard.metrics', name: 'metrics-core', version: '3.1.2'
implementation group: 'com.github.davidb', name: 'metrics-influxdb', version: '0.8.2'
// http
- implementation 'org.eclipse.jetty:jetty-server:9.4.57.v20241219'
- implementation 'org.eclipse.jetty:jetty-servlet:9.4.57.v20241219'
+ implementation 'org.eclipse.jetty:jetty-server:9.4.58.v20250814'
+ implementation 'org.eclipse.jetty:jetty-servlet:9.4.58.v20250814'
implementation 'com.alibaba:fastjson:1.2.83'
// end http
@@ -53,7 +53,7 @@ dependencies {
// https://mvnrepository.com/artifact/javax.portlet/portlet-api
compileOnly group: 'javax.portlet', name: 'portlet-api', version: '3.0.1'
- implementation (group: 'org.pf4j', name: 'pf4j', version: '3.10.0') {
+ implementation (group: 'org.pf4j', name: 'pf4j', version: '3.14.1') {
exclude group: "org.slf4j", module: "slf4j-api"
}
diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml
index 4d0bf1013d6..8b89745c1a9 100644
--- a/gradle/verification-metadata.xml
+++ b/gradle/verification-metadata.xml
@@ -164,9 +164,9 @@
-
-
-
+
+
+
@@ -174,9 +174,9 @@
-
-
-
+
+
+
@@ -184,9 +184,9 @@
-
-
-
+
+
+
@@ -194,9 +194,9 @@
-
-
-
+
+
+
@@ -204,15 +204,15 @@
-
-
-
+
+
+
-
-
+
+
-
-
+
+
@@ -220,15 +220,15 @@
-
-
-
+
+
+
-
-
+
+
-
-
+
+
@@ -236,15 +236,15 @@
-
-
-
+
+
+
-
-
+
+
-
-
+
+
@@ -266,12 +266,12 @@
-
-
-
+
+
+
-
-
+
+
@@ -292,12 +292,12 @@
-
-
-
+
+
+
-
-
+
+
@@ -324,12 +324,12 @@
-
-
-
+
+
+
-
-
+
+
@@ -340,9 +340,9 @@
-
-
-
+
+
+
@@ -363,12 +363,12 @@
-
-
-
+
+
+
-
-
+
+
@@ -381,9 +381,9 @@
-
-
-
+
+
+
@@ -394,12 +394,12 @@
-
-
-
+
+
+
-
-
+
+
@@ -444,15 +444,15 @@
-
-
-
+
+
+
-
-
+
+
-
-
+
+
@@ -485,14 +485,14 @@
-
-
-
+
+
+
-
-
-
+
+
+
@@ -516,12 +516,12 @@
-
-
-
+
+
+
-
-
+
+
@@ -865,76 +865,76 @@
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
@@ -962,97 +962,97 @@
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
@@ -1676,12 +1676,12 @@
-
-
-
+
+
+
-
-
+
+
@@ -1689,9 +1689,9 @@
-
-
-
+
+
+
@@ -1699,9 +1699,9 @@
-
-
-
+
+
+
@@ -1728,65 +1728,65 @@
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
-
-
+
+
@@ -1989,6 +1989,17 @@
+
+
+
+
+
+
+
+
+
+
+
@@ -2013,6 +2024,14 @@
+
+
+
+
+
+
+
+
@@ -2021,6 +2040,14 @@
+
+
+
+
+
+
+
+
@@ -2145,17 +2172,17 @@
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
diff --git a/protocol/build.gradle b/protocol/build.gradle
index 789d27b6360..b3c0c9a8269 100644
--- a/protocol/build.gradle
+++ b/protocol/build.gradle
@@ -1,7 +1,7 @@
apply plugin: 'com.google.protobuf'
def protobufVersion = '3.25.8'
-def grpcVersion = '1.75.0'
+def grpcVersion = '1.80.0'
dependencies {
api group: 'com.google.protobuf', name: 'protobuf-java', version: protobufVersion