fix(security): bump netty-bom 4.1.136.Final and jetty 12.1.10 [1.13]

[manerow]

Fixes #30394

Manual cherry-pick of #30391 (merge commit b16f585) into 1.13. The To release auto-cherry-pick applied the change cleanly but its push was rejected because 1.13 is locked (GH006 Cannot change this locked branch) — same as #5228/#30396/#5251. Needs a privileged merge.

Content is identical to the merged main commit: netty 4.1.135 -> 4.1.136.Final, jetty 12.1.7 -> 12.1.10 (root + openmetadata-service + openmetadata-mcp).

🤖 Generated with Claude Code

Greptile Summary

Updates server networking dependencies to patched releases.

• Bumps Jetty from 12.1.7 to 12.1.10 in the root, service, and MCP Maven configurations.
• Bumps the imported Netty BOM from 4.1.135.Final to 4.1.136.Final.

Confidence Score: 5/5

The dependency-only patch updates appear safe to merge.

The Jetty version is updated consistently across all three relevant Maven configurations, the Netty change remains a patch-level BOM update, and no concrete build or runtime failure was established.

Important Files Changed

Filename	Overview
pom.xml	Consistently updates the shared Jetty property and Netty BOM to patched versions without an identified regression.
openmetadata-service/pom.xml	Aligns the service-local Jetty override with the updated root version.
openmetadata-mcp/pom.xml	Aligns the MCP module’s explicitly versioned Jetty dependencies with Jetty 12.1.10.

_{Reviews (1): Last reviewed commit: "fix(security): bump netty-bom 4.1.136.Fi..." | Re-trigger Greptile}

[github-actions]

❌ PR checklist incomplete

This PR cannot be merged until the following are addressed on its linked issue:

• No GitHub issue is linked. Link an issue in the Development section of the PR (or add Fixes #12345 to the description). For a same-org cross-repo issue, add Fixes open-metadata/<repo>#123 to the description.

The fields live on the linked issue in the Shipping project (open the issue → right sidebar → Projects). After you set them, re-run this check (or push a commit) — issue/project changes do not re-trigger it automatically.

Maintainers can bypass this check by adding the skip-pr-checks label.

[gitar-bot]

Code Review ✅ Approved

Bumps netty-bom to 4.1.136.Final and jetty to 12.1.10 across the codebase to resolve security findings. No issues found.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}