⬆️ deps:(deps): bump io.netty:netty-transport-native-epoll from 4.2.17.Final to 4.2.18.Final

[dependabot]

Bumps io.netty:netty-transport-native-epoll from 4.2.17.Final to 4.2.18.Final.

Release notes

Sourced from io.netty:netty-transport-native-epoll's releases.

netty-4.2.18.Final

Security fixes

• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1)
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
• CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility Notes

A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.

Two specific changes are worth calling out:

QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown.

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

• Use X509ExtendedTrustManager in SSLErrorTest by @​normanmaurer in netty/netty#17221
• Update setup-testlens to v1.9.4 by @​marcphilipp in netty/netty#17223

... (truncated)

Commits

• 2521f49 [maven-release-plugin] prepare release netty-4.2.18.Final
• 6fd5327 HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...
• c44a052 SPDY: SpdySessionHandler must limit the concurrent streams
• 374d965 HTTP: Limit the maximum number of concurrent pipelined requests
• 7e8b325 HTTP/2: Limit HPACK encoding table size
• e3ebf70 OCSP: Correctly handle that nextUpdate is optional
• 5388535 STOMP: Correctly release partial content on handler removal
• 3a80f5a WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...
• 1b6ea48 HTTP3: Correctly handle ":authority" and "host" headers
• 3630659 STOMP codec content-length long-to-int truncation causes infinite decode loop...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[kshivang]

@claude Please review this dependency update against current dev for substantive compatibility, security and regression issues. Check version constraints, Kotlin/Compose alignment, native classifiers where applicable, and CI coverage.

[claude]

Claude finished @kshivang's task in 3m 30s —— View job

---

Review: netty 4.2.17.Final → 4.2.18.Final

Verdict: safe to merge — but be aware it fixes none of the CVEs its release notes advertise. No compatibility or regression risk found in the code that consumes these artifacts. Two follow-ups worth opening separately.

• Read the diff against origin/dev
• Version constraints / lockstep across netty coordinates
• Transitive netty alignment (grpc-netty, ktor-server-netty)
• Native classifiers
• Compatibility notes (HTTP/2 header value validation, QUIC trust manager, OCSP)
• CI coverage
• Kotlin/Compose alignment

---

What the diff actually does

All three netty coordinates moved together, which is the part that matters:

-netty-transport-native-epoll        = { ... version = "4.2.17.Final" }
-netty-transport-native-kqueue       = { ... version = "4.2.17.Final" }
-netty-transport-native-unix-common  = { ... version = "4.2.17.Final" }
+                                      ... "4.2.18.Final"  (all three)

netty-transport-native-* is version-coupled to netty-transport/netty-common and to each other; a split (epoll at .18, unix-common at .17) is the classic NoSuchMethodError / UnsatisfiedLinkError at UDS bind. Lockstep here is correct.

But it is accidental, not enforced. Dependabot's metadata names only io.netty:netty-transport-native-epoll (dependency-name: in the commit trailer) — it happened to rewrite all three lines. These are three hardcoded literal version strings in gradle/libs.versions.toml:229-231, not a shared version.ref, so nothing structurally prevents a future bump landing on one and not the others, or three conflicting PRs.

🔧 Worth doing: add netty = "4.2.18.Final" to [versions] and point all three at version.ref = "netty". One PR per bump, drift impossible.
Fix this →

---

1. Security: this bump carries none of the listed CVE fixes 🔴 (informational, not a blocker)

Every advisory in the release notes is in a codec or handler artifact: netty-codec-http, -http2, -http3, -stomp, -smtp, -mqtt, -redis, -memcache, -haproxy, -codec-classes-quic, -handler-ssl-ocsp. None is in transport-native-epoll, -kqueue or -unix-common — those are socket transports with no protocol parsing.

The repo does consume the vulnerable artifacts, transitively:

Consumer	Path	Pinned by
modules/boss-ipc	libs.grpc.netty (build.gradle.kts:35) → netty-codec-http2, netty-handler, netty-codec	grpc 1.84.0
server/	libs.ktor.server.netty (build.gradle.kts:22)	ktor 3.5.2

Neither is moved by this PR, and there is no netty BOM and no dependency constraints anywhere in the build — grep -rn 'platform(' **/*.gradle.kts returns exactly one hit, libs.supabase.bom in boss-service-auth. So merging this closes zero advisories. If the intent is CVE remediation, the bump needs to reach netty-codec-http2.

2. Split-version netty classpath 🟡 (pre-existing, widened by one patch)

Because Gradle resolves highest-wins per module, netty-transport-native-epoll:4.2.18 drags netty-common / netty-buffer / netty-transport / netty-transport-native-unix-common to 4.2.18, while netty-codec-http2 and netty-handler stay wherever grpc 1.84.0 pins them — they are not dependencies of epoll, so nothing lifts them. Netty only guarantees consistency within a single version; that is precisely what netty-bom exists for.

That IpcAddressResolver.kt:1 already carries @file:Suppress("DEPRECATION") // Netty EventLoopGroup constructors deprecated in 4.2.x confirms the graph is being pulled to 4.2 by these very artifacts.

Worth confirming on a runner with network (I could not — no Gradle cache in this sandbox and network resolution is unavailable here):

./gradlew :boss-ipc:dependencies --configuration runtimeClasspath | grep io.netty

If netty-codec-http2 comes back on a lower 4.2.x (or 4.1.x), both this and finding #1 are fixed by one line in modules/boss-ipc/build.gradle.kts:

implementation(platform("io.netty:netty-bom:4.2.18.Final"))

Fix this →

Caveat if you take the BOM: that is exactly when 4.2.18's "HTTP/2 header value validation is now enabled by default" would start applying. I checked the blast radius — BOSS IPC defines one custom header, boss-process-token (ProcessIdentityInterceptor.kt:51-52), an opaque hex token on Metadata.ASCII_STRING_MARSHALLER, so it cannot carry a value the new validator would reject. The other two compatibility notes are non-issues: nothing in this repo uses QUIC (X509ExtendedTrustManager change) or netty-handler-ssl-ocsp.

3. CI never exercises the code path this PR changes 🟡

The whole reason these three artifacts exist is Unix domain sockets — and no test in the repo opens one. Every boss-ipc test uses TCP loopback:

• IpcRoundTripTest.kt:85, 129, 157, 216, 247, 272 — tcp://localhost:599xx
• LateServiceRegistrationTest.kt:42 — tcp://localhost:0

Nothing constructs a unix:// address, so IpcAddressResolver.configureServerBuilder's DomainSocketAddress branch (:129-156) — EpollServerDomainSocketChannel, KQueueEventLoopGroup — is compiled against but the native library is never loaded. A wrong classifier, a missing .so/.jnilib in a published artifact, or an UnsatisfiedLinkError would pass ./gradlew test and ./gradlew build cleanly on all three matrix runners (build.yml:190-245) and surface only at runtime, in KERNEL mode, on a user's machine.

That is the substantive regression exposure on any netty native bump, not just this one. A single unix:// round-trip test guarded to Linux/macOS would turn CI into real coverage for these three artifacts.

Fix this →

4. Native classifiers ✅

modules/boss-ipc/build.gradle.kts:42-53 declares four classifier artifacts — osx-x86_64, osx-aarch_64, linux-x86_64, linux-aarch_64. All four are published for 4.2.18.Final, and they match the platforms IpcAddressResolver will actually select (isMacOS → KQueue, isLinux → Epoll, everything else throws). Windows correctly declares nothing, since netty ships no native UDS transport for it and the resolver rejects that platform explicitly (:150-154). No classifier change is needed for this bump.

(Longer-term, NioDomainSocketChannel — JDK 16+ NIO UDS, supported by grpc-netty — would drop all three dependencies and the entire classifier matrix. Out of scope here.)

5. Kotlin / Compose alignment ✅

No interaction. netty is a plain JVM runtime dependency of boss-ipc (a kotlin("jvm") module with no Compose), reached from composeApp only in KERNEL mode. Kotlin 2.4.10 / Compose MP 1.12.0 / coroutines 1.11.0 are untouched, and none of the $stable-field or Compose-compiler concerns in AGENTS.md apply — netty is not one of the duplicated-package api modules. composeApp/build.gradle.kts:1442 already grants sun.misc.Unsafe for netty/protobuf; 4.2.18 does not change that requirement.

6. Deprecation ✅

IpcAddressResolver.kt:1 suppresses the 4.2.x EventLoopGroup constructor deprecations. Still deprecated-not-removed in 4.2.18, so no compile break. Removal is a netty 5 event — the migration is MultiThreadIoEventLoopGroup with EpollIoHandler/KQueueIoHandler, worth a tracking issue but not this PR.

---

Summary

Merge blocker	none
Compatibility risk from this diff	none — the three 4.2.18 behavior changes all land in artifacts this PR does not move, and the one that would apply under a BOM is neutralized by the single hex-token ASCII header
Security value delivered	zero — all 30 advisories are in netty-codec-* / netty-handler-ssl-ocsp, none in the three bumped artifacts
Follow-ups	(a) netty-bom platform in boss-ipc + server to align the graph and actually pick up the CVE fixes; (b) a unix:// round-trip test so CI loads the native library at all; (c) a netty version.ref to stop the three literals drifting

I did not run Gradle — dependency resolution needs network, which is unavailable in this sandbox, so finding #2 is stated as a verification step with the exact command rather than as a confirmed resolved-version claim. No files changed.
• Branch

[kshivang]

@dependabot Thank you for the complete native transport update. Verified that original #658 (bb6283c) and #657 (747497b) have identical Git trees and the same three-module patch, including epoll, kqueue and unix-common. The older replacement #657 preserves explicit Dependabot credit for both PRs in its description. Your current Claude review is retained as input to that review; its runtime-alignment and native-test findings are being addressed there. Closing only this verified duplicate, not a distinct platform update.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.