deps:(deps): bump io.netty:netty-codec-http2 from 4.1.137.Final to 4.2.18.Final

[dependabot]

Bumps io.netty:netty-codec-http2 from 4.1.137.Final to 4.2.18.Final.

Release notes

Sourced from io.netty:netty-codec-http2's releases.

netty-4.2.18.Final

Security fixes

• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (SPDY)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
• CVE-2026-XXXXX : denial of service vector in io.netty:netty-codec-stomp
• CVE-2026-XXXXX : parser desync/response smuggling in io.netty:netty-codec-memcache
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-http3
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : memory leak in io.netty:netty-codec-haproxy
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (RTSP)
• CVE-2026-XXXXX : request smuggling in io.netty:netty-codec-http (HTTP/1)
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1)
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http3 and in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2
• CVE-2026-XXXXX : improper hostname verification in io.netty:netty-codec-classes-quic
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-redis
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : request smuggling vector in io.netty:netty-codec-http (HTTP/1.1)
• CVE-2026-XXXXX : unbounded resource usage in io.netty:netty-codec-mqtt
• CVE-2026-XXXXX : improper CRLF neutralization in io.netty:netty-codec-smtp
• CVE-2026-XXXXX : improper certificate validation in io.netty:netty-handler-ssl-ocsp
• CVE-2026-XXXXX : improper header validation in io.netty:netty-codec-http2

Compatibility Notes

A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade.

Two specific changes are worth calling out:

QUIC now explicitly requires X509ExtendedTrustManager when hostname verification is enabled. Previously, when configuring QUIC with an endpoint identification algorithm and an X509TrustManager, hostname verification would be silently skipped. This is now considered a misconfiguration and an exception will be thrown.

HTTP/2 header value validation is now enabled by default. HTTP/2 header name validation has always been enabled by default, with an option to disable it, but HTTP/2 header value validation has been disabled by default until now. Configuration options still exist to disable this, but validation of HTTP header names and values are now both opt-in by default rather than opt-out.

What's Changed

• Use X509ExtendedTrustManager in SSLErrorTest by @​normanmaurer in netty/netty#17221
• Update setup-testlens to v1.9.4 by @​marcphilipp in netty/netty#17223

... (truncated)

Commits

• 2521f49 [maven-release-plugin] prepare release netty-4.2.18.Final
• 6fd5327 HTTP/1 absolute-form Host mismatch is translated to HTTP/3 :authority, overri...
• c44a052 SPDY: SpdySessionHandler must limit the concurrent streams
• 374d965 HTTP: Limit the maximum number of concurrent pipelined requests
• 7e8b325 HTTP/2: Limit HPACK encoding table size
• e3ebf70 OCSP: Correctly handle that nextUpdate is optional
• 5388535 STOMP: Correctly release partial content on handler removal
• 3a80f5a WebSockets: Enforce a limit for the max pipelined requests in WebSocketServer...
• 1b6ea48 HTTP3: Correctly handle ":authority" and "host" headers
• 3630659 STOMP codec content-length long-to-int truncation causes infinite decode loop...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Labels

The following labels could not be found: gradle. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[sethusrinivasan]

Closing as discarded:

• Duplicate: This PR is one of 6 duplicate Dependabot PRs (deps:(deps): bump io.netty:netty-handler-proxy from 4.1.137.Final to 4.2.18.Final #57, deps:(deps): bump io.netty:netty-common from 4.1.137.Final to 4.2.18.Final #58, deps:(deps): bump io.netty:netty-codec-http from 4.1.137.Final to 4.2.18.Final #59, deps:(deps): bump io.netty:netty-codec-http2 from 4.1.137.Final to 4.2.18.Final #60, deps:(deps): bump io.netty:netty-codec from 4.1.137.Final to 4.2.18.Final #61, deps:(deps): bump io.netty:netty-handler from 4.1.137.Final to 4.2.18.Final #63) proposing identical bumps across the Netty suite.
• Compatibility: Netty 4.2.x introduces breaking API changes and package structural changes that are incompatible with io.grpc:grpc-netty:1.57.2 (used by Android Test Platform / AGP 8.13 tooling).
• Security: The current version 4.1.137.Final is the latest LTS release on the 4.1.x branch with zero known CVEs and full binary compatibility.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.