Skip to content

Bump the gradle group across 1 directory with 4 updates - #254

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/gradle/gradle-4d41284ae2
Open

dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/gradle/gradle-4d41284ae2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 16, 2026

Copy link
Copy Markdown

Bumps the gradle group with 4 updates in the / directory: io.netty:netty-codec, io.netty:netty-codec-http, io.netty:netty-codec-http2 and org.jetbrains.kotlin:kotlin-gradle-plugin.

Updates io.netty:netty-codec from 4.1.125.Final to 4.1.136.Final

Release notes

Sourced from io.netty:netty-codec's releases.

netty-4.1.136.Final

What's Changed

Full Changelog: netty/netty@netty-4.1.135.Final...netty-4.1.136.Final

netty-4.1.135.Final

Security fixes

  • CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).
  • CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).
  • CVE-2026-50560: DDoS in io.netty:netty-codec-http2.
  • CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis (high).
  • CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).
  • CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).
  • CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).
  • CVE-2026-50020: request smuggling in io.netty:netty-codec-http.
  • CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).
  • CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).
  • CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.
  • CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).

... (truncated)

Commits
  • fca0764 [maven-release-plugin] prepare release netty-4.1.136.Final
  • bb2ff68 Merge branches from forks (#17063) (#17065)
  • 7b44dc9 Pin github actions to reduce risk (#17043) (#17044)
  • 50e6e1d Update lz4-java to 1.11.1 (#17060)
  • d7dcf6c Auto-port 4.1: Reject non-token characters in HTTP/2 header names (#17022)
  • b12bd11 Backport 4.1 Fix propagation of startTls for client SslContext handler (#17020)
  • 7fd5cc7 FastLz: Guard decompression against truncated input (#17000) (#17015)
  • 42e7103 Auto-port 4.1: HTTP2: Pass the correct number of arguments when logging goawa...
  • 666c3b2 Auto-port 4.1: Reset UTF-8 decode state on CR in StompSubframeDecoder (#17003)
  • df54c37 Reject control characters at the boundary of the HTTP version token (#16971) ...
  • Additional commits viewable in compare view

Updates io.netty:netty-codec-http from 4.1.125.Final to 4.1.136.Final

Release notes

Sourced from io.netty:netty-codec-http's releases.

netty-4.1.136.Final

What's Changed

Full Changelog: netty/netty@netty-4.1.135.Final...netty-4.1.136.Final

netty-4.1.135.Final

Security fixes

  • CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).
  • CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).
  • CVE-2026-50560: DDoS in io.netty:netty-codec-http2.
  • CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis (high).
  • CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).
  • CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).
  • CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).
  • CVE-2026-50020: request smuggling in io.netty:netty-codec-http.
  • CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).
  • CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).
  • CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.
  • CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).

... (truncated)

Commits
  • fca0764 [maven-release-plugin] prepare release netty-4.1.136.Final
  • bb2ff68 Merge branches from forks (#17063) (#17065)
  • 7b44dc9 Pin github actions to reduce risk (#17043) (#17044)
  • 50e6e1d Update lz4-java to 1.11.1 (#17060)
  • d7dcf6c Auto-port 4.1: Reject non-token characters in HTTP/2 header names (#17022)
  • b12bd11 Backport 4.1 Fix propagation of startTls for client SslContext handler (#17020)
  • 7fd5cc7 FastLz: Guard decompression against truncated input (#17000) (#17015)
  • 42e7103 Auto-port 4.1: HTTP2: Pass the correct number of arguments when logging goawa...
  • 666c3b2 Auto-port 4.1: Reset UTF-8 decode state on CR in StompSubframeDecoder (#17003)
  • df54c37 Reject control characters at the boundary of the HTTP version token (#16971) ...
  • Additional commits viewable in compare view

Updates io.netty:netty-codec-http2 from 4.1.125.Final to 4.1.136.Final

Release notes

Sourced from io.netty:netty-codec-http2's releases.

netty-4.1.136.Final

What's Changed

Full Changelog: netty/netty@netty-4.1.135.Final...netty-4.1.136.Final

netty-4.1.135.Final

Security fixes

  • CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).
  • CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).
  • CVE-2026-50560: DDoS in io.netty:netty-codec-http2.
  • CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis (high).
  • CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).
  • CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).
  • CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).
  • CVE-2026-50020: request smuggling in io.netty:netty-codec-http.
  • CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).
  • CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).
  • CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.
  • CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).

... (truncated)

Commits
  • fca0764 [maven-release-plugin] prepare release netty-4.1.136.Final
  • bb2ff68 Merge branches from forks (#17063) (#17065)
  • 7b44dc9 Pin github actions to reduce risk (#17043) (#17044)
  • 50e6e1d Update lz4-java to 1.11.1 (#17060)
  • d7dcf6c Auto-port 4.1: Reject non-token characters in HTTP/2 header names (#17022)
  • b12bd11 Backport 4.1 Fix propagation of startTls for client SslContext handler (#17020)
  • 7fd5cc7 FastLz: Guard decompression against truncated input (#17000) (#17015)
  • 42e7103 Auto-port 4.1: HTTP2: Pass the correct number of arguments when logging goawa...
  • 666c3b2 Auto-port 4.1: Reset UTF-8 decode state on CR in StompSubframeDecoder (#17003)
  • df54c37 Reject control characters at the boundary of the HTTP version token (#16971) ...
  • Additional commits viewable in compare view

Updates org.jetbrains.kotlin:kotlin-gradle-plugin from 2.2.10 to 2.4.20

Release notes

Sourced from org.jetbrains.kotlin:kotlin-gradle-plugin's releases.

Kotlin 2.4.20

Changelog

Analysis API

  • KT-86546 Check suspicious when over ConeKotlinType in ConeTypeCompatibilityChecker
  • KT-85418 Implement an API for accessing deserialized file annotations in Analysis API
  • KT-74448 K2. False positive MISSING_DEPENDENCY_SUPERCLASS in LinkedListTest.kt, kotlinx.coroutines
  • KT-85856 containingSymbol of constructor property differs for local and non-local classes
  • KT-65417 K2 IDE: KTOR false positive expect-actual matching error on enum class because of implicit clone() in non-JVM source sets

Analysis API. Code Compilation

  • KT-76457 K2 IDE / KMP Debugger: KISEWA “Cannot compile a common source without a JVM counterpart” on evaluating inline fun from common module inside jvm

Analysis API. FIR

  • KT-70552 No expects for actual
  • KT-69727 K2 IDE. Wrong error in the editor on calling clone function of actual enum instance in non-jvm platform
  • KT-69726 FP errors on declaring fun clone() in actual enum in not-jvm source-set
  • KT-86014 Types are broken after remove parameter through change signature
  • KT-86363 KotlinIllegalArgumentExceptionWithAttachments: No dangling modifier found on companion blocks
  • KT-86147 Drop kotlin.parallel.resolve.under.global.lock registry key
  • KT-85543 Avoid lazy resolve for the contracts phase if no constracts might be resolved

Analysis API. Infrastructure

  • KT-84914 Do not publish analysis-api-test-framework
  • KT-86986 kotlin-compiler-common-for-ide bundles unrelated Analysis API modules
  • KT-86186 Analysis API: Codebase tests run twice in some analysis modules — pick a single JUnit runner and migrate
  • KT-85360 Drop kotlin-compiler-testdata-for-ide artifact
  • KT-85585 Simplify the dependencies graph for the Analysis API modules
  • KT-85381 Remove tests for the FE10 implementation

Analysis API. Light Classes

New Features

  • KT-84645 Support resolving to companion block members & extensions from Java (light classes)
  • KT-80775 Support PsiClass#getRecordComponents in light classes

Fixes

  • KT-57537 SLC: propagate default parameter value from (@JvmOverloads) expect declarations to actual declarations
  • KT-85040 [Analysis API] Improve Java / Kotlin interop in KMP projects
  • KT-87301 SymbolLightAccessorMethod#isValid returns false for delegated properties
  • KT-87171 SLC: non-mapped Kotlin collection supertype is dropped from supertype list
  • KT-87250 JvmExposeBoxed: light classes shouldn't be autogenerated for private declarations
  • KT-70428 AA: good code is red when a Java class extends a Kotlin class implementing MutableList by delegation
  • KT-63568 Symbol Light Classes: KtAnnotationApplicationWithArgumentsInfo.normalizedArguments() may work incorrectly when psi is not set

... (truncated)

Changelog

Sourced from org.jetbrains.kotlin:kotlin-gradle-plugin's changelog.

2.4.20

Analysis API

  • KT-86546 Check suspicious when over ConeKotlinType in ConeTypeCompatibilityChecker
  • KT-85418 Implement an API for accessing deserialized file annotations in Analysis API
  • KT-74448 K2. False positive MISSING_DEPENDENCY_SUPERCLASS in LinkedListTest.kt, kotlinx.coroutines
  • KT-85856 containingSymbol of constructor property differs for local and non-local classes
  • KT-65417 K2 IDE: KTOR false positive expect-actual matching error on enum class because of implicit clone() in non-JVM source sets

Analysis API. Code Compilation

  • KT-76457 K2 IDE / KMP Debugger: KISEWA “Cannot compile a common source without a JVM counterpart” on evaluating inline fun from common module inside jvm

Analysis API. FIR

  • KT-70552 No expects for actual
  • KT-69727 K2 IDE. Wrong error in the editor on calling clone function of actual enum instance in non-jvm platform
  • KT-69726 FP errors on declaring fun clone() in actual enum in not-jvm source-set
  • KT-86014 Types are broken after remove parameter through change signature
  • KT-86363 KotlinIllegalArgumentExceptionWithAttachments: No dangling modifier found on companion blocks
  • KT-86147 Drop kotlin.parallel.resolve.under.global.lock registry key
  • KT-85543 Avoid lazy resolve for the contracts phase if no constracts might be resolved

Analysis API. Infrastructure

  • KT-84914 Do not publish analysis-api-test-framework
  • KT-86986 kotlin-compiler-common-for-ide bundles unrelated Analysis API modules
  • KT-86186 Analysis API: Codebase tests run twice in some analysis modules — pick a single JUnit runner and migrate
  • KT-85360 Drop kotlin-compiler-testdata-for-ide artifact
  • KT-85585 Simplify the dependencies graph for the Analysis API modules
  • KT-85381 Remove tests for the FE10 implementation

Analysis API. Light Classes

New Features

  • KT-84645 Support resolving to companion block members & extensions from Java (light classes)
  • KT-80775 Support PsiClass#getRecordComponents in light classes

Fixes

  • KT-57537 SLC: propagate default parameter value from (@JvmOverloads) expect declarations to actual declarations
  • KT-85040 [Analysis API] Improve Java / Kotlin interop in KMP projects
  • KT-87301 SymbolLightAccessorMethod#isValid returns false for delegated properties
  • KT-87171 SLC: non-mapped Kotlin collection supertype is dropped from supertype list
  • KT-87250 JvmExposeBoxed: light classes shouldn't be autogenerated for private declarations
  • KT-70428 AA: good code is red when a Java class extends a Kotlin class implementing MutableList by delegation
  • KT-63568 Symbol Light Classes: KtAnnotationApplicationWithArgumentsInfo.normalizedArguments() may work incorrectly when psi is not set
  • KT-36740 MPP: False-positive incompatible types in .java when using expect-class returned by non-expect member from common when actual is actual typealias

... (truncated)

Commits
  • 890ac1d Add Changelog for 2.4.20-RC3
  • 8860aed 🍒 [FIR] Fix suspend conversion when expected type is nullable (#7769)
  • ab5bcd9 Edit ChangeLog for 2.4.20-RC2
  • 9464edc Add ChangeLog for 2.4.20-RC2
  • 0261e43 Cherry-pick "Fix asBodyAndResultVar call in `visitInlinedLambdaInComposable...
  • 0763513 [box-tests] Workaround for klib compatibility tests (#7626)
  • 045aec6 [Wasm] Append scripts from webpack.config.d in the end of the file (#7615)
  • cd7173b 🍒 [2.4.20] [K/JS] Keep associated obj annotation only if getInstance survives...
  • d36a2ff CastsOptimizationPass: break aliases cycles (#7578)
  • 8664983 [CLI] Restore custom IC search scope creation
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the gradle group with 4 updates in the / directory: [io.netty:netty-codec](https://github.com/netty/netty), [io.netty:netty-codec-http](https://github.com/netty/netty), [io.netty:netty-codec-http2](https://github.com/netty/netty) and [org.jetbrains.kotlin:kotlin-gradle-plugin](https://github.com/JetBrains/kotlin).


Updates `io.netty:netty-codec` from 4.1.125.Final to 4.1.136.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.125.Final...netty-4.1.136.Final)

Updates `io.netty:netty-codec-http` from 4.1.125.Final to 4.1.136.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.125.Final...netty-4.1.136.Final)

Updates `io.netty:netty-codec-http2` from 4.1.125.Final to 4.1.136.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.125.Final...netty-4.1.136.Final)

Updates `org.jetbrains.kotlin:kotlin-gradle-plugin` from 2.2.10 to 2.4.20
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.2.10...v2.4.20)

---
updated-dependencies:
- dependency-name: io.netty:netty-codec
  dependency-version: 4.1.136.Final
  dependency-type: direct:production
  dependency-group: gradle
- dependency-name: io.netty:netty-codec-http
  dependency-version: 4.1.136.Final
  dependency-type: direct:production
  dependency-group: gradle
- dependency-name: io.netty:netty-codec-http2
  dependency-version: 4.1.136.Final
  dependency-type: direct:production
  dependency-group: gradle
- dependency-name: org.jetbrains.kotlin:kotlin-gradle-plugin
  dependency-version: 2.4.20
  dependency-type: direct:production
  dependency-group: gradle
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Sep 16, 2026
@coderabbitai

coderabbitai Bot commented Sep 16, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 40fa6f01-5d1c-440e-bc2b-7e71f6fb6d96

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Development

Successfully merging this pull request may close these issues.

0 participants