Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package netty for openSUSE:Factory checked in at 2026-11-03 17:59:07 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/netty (Old) and /work/SRC/openSUSE:Factory/.netty.new.1257 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "netty" Tue Nov 3 17:59:07 2026 rev:18 rq:1394637 version:4.1.140 Changes: -------- --- /work/SRC/openSUSE:Factory/netty/netty.changes 2026-09-24 23:02:06.852906665 +0200 +++ /work/SRC/openSUSE:Factory/.netty.new.1257/netty.changes 2026-11-03 18:03:19.093871351 +0100 @@ -1,0 +2,296 @@ +Tue Nov 3 08:09:50 UTC 2026 - Fridrich Strba <[email protected]> + +- Upgrade to upstream version 4.1.140 + * Security fixes: + + GHSA-m77g-r4c7-3w77, bsc#1289154: out-of-bounds read in + netty-buffer + + GHSA-rx4g-qxm6-238r, bsc#1289155: out-of-bounds read in + netty-buffer + + GHSA-cqmg-wc9g-fpj8, bsc#1289156: insufficient entropy in + netty-resolver-dns + + GHSA-hc9x-r52h-gh4x, bsc#1289157: unbounded memory usage in + netty-codec-http2 + + GHSA-42mp-m8rq-6rgj, bsc#1289158: insufficient control + character neutralization in netty-codec-http + + GHSA-qhw9-p586-v948, bsc#1289159: out-of-bounds read in + netty-buffer + + GHSA-84gx-4cj4-rm7q, bsc#1289160: unbounded memory usage in + netty-codec-mqtt + + GHSA-6xv6-9mgg-mfvc, bsc#1289161: mTLS auth bypass via session + resumption in netty-handler + * Other significant changes: + + Reject Redis lines that start with LF #17806 + + Do not let a negatively cached search domain shadow a positive + one #17805 + + Choose server key types from client's signature algorithms for + TLS 1.3 #17809 + + LocalChannel: Deliver data written by the peer before it + closed #17815 + + Validate padding of HEADERS frames without priority #17819 + + Don't spin in SslHandler.wrapMultiple(...) when the engine + consumes nothing #17822 + + Preserve invalid SNI names in ReferenceCountedOpenSslEngine + #17824 + + Optimize redundant bounds checking in ByteBuf.setBytes #17827 + + Release the DNS response when a query future loses a cancel + race #17828 + + Fix HpackDynamicTable losing entries when filled to capacity + #17846 + + Throw UnsupportedOperationException from + AdaptiveByteBuf.memoryAddress() without an address #17842 + + Handle ed25519 and ed448 names in SignatureAlgorithmConverter + #17850 + + HAProxyMessage: validate the length of all TLV types #17845 + + Validate bzip2 Huffman code lengths before building decode + tables #17855 + + Validate header values on DefaultHeaders.copy(), bulk add, + entry setValue and ReadOnlyHttpHeaders #17854 + + Fix typos in comments/javadoc #17863 + + HAProxyMessageEncoder: encode v1 PROXY UNKNOWN headers #17860 + + Throw DecompressionException on JdkZlib preset dictionary + mismatch #17864 + + Apply certificate list size floor #17861 + + Reject HTTP version numbers that overflow int #17859 + + HAProxyMessage: decode TLVs with an empty value at the end of + the header #17877 + + Honor maxAllocation for brotli in + DelegatingDecompressorFrameListener #17881 + + Reject invalid content-length in PUSH_PROMISE with a stream + error #17875 + + HAProxyMessageDecoder: fix v2 header framing with a non-zero + reader index #17882 + + Skip JNDI nameserver lookup on IBM i #17892 + + Reset the h2c upgrade stream if the request can not be + converted #17893 + + Fix NPE in Http2FrameCodec when h2c upgrade fails #17899 + + Don't size ZstdDecoder output buffers from the frame content + size #17900 + + Don't lose frames when a delimiter is split across reads + #17909 + + Read SOCKS5 length octets unsigned in the legacy socks + decoders #17916 + + Fix truncated output in Brotli decoders #17923 + + Port: Wrap trailing ';' in Content-Disposition as + ErrorDataDecoderException #17931 + + Kqueue: Deregister filters before closing the fd to avoid + hitting a reused fd #17939 + + Keep WINDOW_UPDATE credit of reserved HTTP/2 streams on + activation #17935 + + Accept empty non-final fragments in PerMessageDeflateEncoder + #17953 + + HTTP/2: Don't pass the close promise to a deferred close + #17959 + + Fix endless value iterators in ReadOnlyHttpHeaders #17978 + + Don't drop the last character in + AsciiString.trim(CharSequence) #17993 + + Fix the region copied by Unpooled.copiedBuffer(CharSequence, + int, int, Charset) #17995 + + Add HpackDecoder test for non-token HTTP/2 header names #17992 + + Fix AsciiString.contains(...) false negatives after a partial + match #17986 + + Treat DATA frames on reserved HTTP/2 streams as a connection + error #17998 + + Reject reply codes with non-digit characters in + SmtpResponseDecoder #18005 + + Don't loop forever in AbstractDiskHttpData when the file is + short #18004 + + Http2: reject generic frames whose payload exceeds + SETTINGS_MAX_FRAME_SIZE #18000 + + Return null or the default from read-only headers for invalid + values #18017 + + Check the second gzip magic byte in JdkZlibDecoder #18007 + + Fix server-initiated WebSocket close handshake failing with + "promise already done" #18032 + + Fix Snappy.encode(...) for input with a non-zero reader index + #18031 + + MqttEncoder: Reject Variable Byte Integers larger than + 268435455 #18025 + + Only delete socket files when binding and closing UDS channels + #18044 + + Return the haystack's reader index from + ByteBufUtil.indexOf(...) for an empty needle #18082 + + Return -1 from StringUtil.decodeHexNibble(byte) for non-ASCII + bytes #18083 + + Fail to encode DNS messages that are too large for TCP #18081 + + Don't return an entry twice when removing while iterating a + primitive map #18087 + + Mark disk-based HttpData as completed after setting empty + content #18088 + + Fix out-of-bounds read when validating UDS paths in the native + code #18016 + + Release a SPDY DATA frame that exceeds the session window + #18094 + + Send zero-length datagrams instead of dropping or duplicating + them #18107 + + Reject request-only and response-only pseudo-headers in + invalid contexts (RFC 9113) #18113 + + Read all pending data when the EOF is received before the + connect is complete in kqueue #18116 + + Read the 4 byte Snappy literal length as unsigned #18120 + + Deliver all data a LocalChannel peer wrote before it closed + #18128 + + Close an HTTP/2 stream only after its last merged DATA frame + was written #18144 + + Use IP_MULTICAST_IF in leaveGroup and block without an + interface #18152 + + Don't lose the alert when the handshake fails in + ReferenceCountedOpen… #18157 + + Send bad_certificate alert when the TrustManager rejects the + certificate #18181 + + SslHandler: Size the unwrap output buffer for the plaintext, + not the record #18182 + + Add opt-in Origin validation to WebSocketServerProtocolHandler + (hardening) #18184 + + Fix reporting of the wrong error when setting flags on an + accepted fd fails #18196 + + Epoll: Verify the FileChannel is a FileChannelImpl before + reading its fd #18190 + + KQueue: Verify the FileChannel is a FileChannelImpl before + reading its fd #18191 + + Do not send uninitialized stack memory when sending a fd over + a domain socket #18197 + + Fix read of uninitialized memory when accepting a connection + on a domain socket #18195 + + Epoll: Fix signed integer overflow when calculating the + epoll_wait timeout #18194 + + Fix underflow detection in + netty_unix_util_timespec_subtract_ns #18193 + + Don't encode Snappy copies with an offset that does not fit + into 16 bits #18224 + + Don't truncate binary memcache key and extras lengths #18225 + + Update to latest netty-tcnative release #18236 + + Security fixes #18238 +- Modified patches: + * 0001-Remove-optional-dep-Blockhound.patch + * 0002-Remove-optional-dep-conscrypt.patch + * 0004-Disable-Brotli-and-ZStd-compression.patch + + rebase + +------------------------------------------------------------------- +Wed Oct 14 11:07:34 UTC 2026 - Fridrich Strba <[email protected]> + +- Upgrade to upstream version 4.1.139 + * Security fixes: + + GHSA-frq3-7pw6-36cg, bsc#1285691: parser desync in + io.netty:netty-codec-haproxy + + GHSA-6g26-xhvx-g5w3, bsc#1285692: improper CRLF neutralization + (request/response smuggling) in io.netty:netty-codec-http + + GHSA-x9f7-rg73-4rp6, bsc#1285693: origin validation error in + io.netty:netty-codec-http + + GHSA-2p3h-phr9-jf38, bsc#1285694: unbounded resource + consumption in io.netty:netty-codec-http2 + + GHSA-vwgc-hvc9-2j59, bsc#1285695: request/response smuggling + in io.netty:netty-codec-http + + GHSA-m3w2-2657-46g8, bsc#1285696: time-of-check/time-of-use + error in io.netty:netty-handler-ssl-ocsp + + GHSA-jp47-57pp-4qpp, bsc#1285697: SNI routing bypass in + io.netty:netty-handler + + GHSA-35qr-v9mm-35c5, bsc#1285698: unbounded resource + consumption in io.netty:netty-codec-xml + + GHSA-5h6f-wp3f-6hmv, bsc#1285699: unbounded resource + consumption in io.netty:netty-codec-base + + GHSA-x436-m93c-g2q9, bsc#1285700: unbounded resource + consumption in io.netty:netty-codec-http + + GHSA-c7hc-m259-xhcr, bsc#1285701: input misinterpretation in + io.netty:netty-codec-socks + + GHSA-268p-9r42-7qp4, bsc#1285702: improper access control in + io.netty:netty-handler + + GHSA-3h79-3wcf-5whr, bsc#1285703: unbounded resource + consumption in io.netty:netty-codec-dns + * Other significant changes: + + Perf: Use LinkedHashSet to deduplicate search domains #17407 + + Handle non-positive skip lengths in ByteBufInputStream #17410 + + Protobuf: Update protobuf-javanano to non alpha release #17335 + + HttpUtil.getCharset() must accept whitespace before the next + Content-Type parameter #17436 + + Codec-dns: Add SMIMEA, CDS, CDNSKEY, OPENPGPKEY, CSYNC, ZONEMD + records #17459 + + HttpUtil.getMimeType() must not include whitespace before the + next Content-Type parameter #17494 + + Fix buffer leak when recvmmsg returns single UDP_GRO batch + #17500 + + Guard ChunkedWriteHandler.doFlush() against re-entrant + invocation from user code #17501 + + Add regression test for close() cascade reentering flush() + #17505 + + Fix UDP_GRO segment size is lost when reading with recvmmsg + #17506 + + Add workflow that will cancel running workflows for merged PRs + #17519 + + HTTP/2: Remove failed SETTINGS from ACK queue #17534 + + ProtobufVarint32FrameDecoder must wait for more data when the + length prefix is incomplete #17553 + + Fix missing readable-bytes check in SmtpResponseDecoder #17556 + + Guard against out-of-bounds reads when parsing ClientHello SNI + extension #17558 + + Http2: Reserve promised stream before running the request + verifier #17563 + + Use random generated LocalAddress in tests that use local + transport #17579 + + Use isLengthEqual method in HttpObjectDecoder #17575 + + Reject incomplete PUSH_PROMISE request headers when + validateRequiredPseudoHeaders is enabled #17582 + + POOL: Release Channel when SimpleChannelPool acquire is + cancelled #17578 + + Http2ConnectionHandler: report at most one stream error for a + CompositeStreamException #17595 + + Support creating a PropertyKey that is not tied to a specific + Http2Connection #17615 + + Reset LengthFieldBasedFrameDecoder state when the frame is + shorter than initialBytesToStrip #17621 + + Fix ByteBuf.setBytes(int, ByteBuffer) when the source is the + buffer's own internal NIO buffer #17626 + + Fix connection error scope for SETTINGS_INITIAL_WINDOW_SIZE + overflow issue #17640 + + Add missing bounds check to AdaptiveByteBuf.getBytes(...) + channel variants #17629 + + Update lz4-java to 1.12.0 #17638 + + HTTP/2: Fix stream stall when toggling auto-read on a child + channel #17646 + + No need to call clear() on ByteBuffer after AdaptiveByteBuf + .internalNioBuffer() #17653 + + PendingWriteQueue: unlink the write before failing it in + removeAndFail #17658 + + Don't lose HashedWheelTimer timeouts that race with stop() + #17660 + + LocalChannel: complete connect() when the accepted channel + dies before registration #17666 + + Don't leak FixedChannelPool slots on unrelated + IllegalArgumentException #17668 + + Don't corrupt the pipeline when a handler context is removed + twice #17670 + + Don't leak queued writes in ChunkedWriteHandler on removal or + cancel #17676 + + Honour the needle's reader index in ByteBufUtil + .indexOf(ByteBuf, ByteBuf) #17687 + + Close idle outbound HTTP/2 child channels when the parent + closes #17694 + + Only fail in ZlibDecoder when the decompression buffer is full + #17698 + + Add script that allows to check if a user has signed the ICLA + #17713 + + Fail pending writes of ProxyHandler when it is removed #17707 + + Complete HTTP/2 graceful close when the connection closes the + last stream #17720 + + Don't count STOMP headers again when the header block is + replayed #17716 + + Don't corrupt ChannelOutboundBuffer when a cancelled write + makes the channel writable #17733 + + Fail ChunkedNioFile instead of spinning when the file is + shorter than requested #17734 + + Arm force-close timeout when an inbound CLOSE frame is echoed + #17710 + + MqttDecoder accepts malformed MQTT 5 property sections and + reclassifies payload bytes as properties #17732 + + Validate bzip2 Huffman table selector index before use #17738 + + Fix retainedSlice() of non-retained pooled derived buffers + #17761 + + Reset the per-message-deflate compressor after an empty final + fragment #17741 + + Bulk merge changes for 4.1 #17771 +- Modified patches: + * 0001-Remove-optional-dep-Blockhound.patch + * no-werror.patch + + rebase + +------------------------------------------------------------------- Old: ---- netty-4.1.138.Final.tar.gz New: ---- netty-4.1.140.Final.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ netty.spec ++++++ --- /var/tmp/diff_new_pack.uIaobd/_old 2026-11-03 18:03:22.204001542 +0100 +++ /var/tmp/diff_new_pack.uIaobd/_new 2026-11-03 18:03:22.206001626 +0100 @@ -17,10 +17,10 @@ %global namedreltag .Final -%global namedversion %{version}%{?namedreltag} Name: netty -Version: 4.1.138 +Version: 4.1.140 Release: 0 +%global namedversion %{version}%{?namedreltag} Summary: An asynchronous event-driven network application framework and tools for Java License: Apache-2.0 URL: https://netty.io/ ++++++ 0001-Remove-optional-dep-Blockhound.patch ++++++ --- /var/tmp/diff_new_pack.uIaobd/_old 2026-11-03 18:03:22.233002756 +0100 +++ /var/tmp/diff_new_pack.uIaobd/_new 2026-11-03 18:03:22.239003007 +0100 @@ -1,19 +1,19 @@ -From d5606cecbf163f382329702272a9b1095bed95db Mon Sep 17 00:00:00 2001 +From c0fc20a2d93750728a511f5967670811c803fee6 Mon Sep 17 00:00:00 2001 From: Mat Booth <[email protected]> Date: Mon, 7 Sep 2020 12:17:31 +0100 Subject: [PATCH 1/4] Remove optional dep Blockhound --- common/pom.xml | 5 - - .../java/io/netty/util/internal/Hidden.java | 208 ------ + .../java/io/netty/util/internal/Hidden.java | 213 ------ ...ockhound.integration.BlockHoundIntegration | 14 - pom.xml | 8 - - transport-blockhound-tests/pom.xml | 228 ------- - .../NettyBlockHoundIntegrationTest.java | 638 ------------------ + transport-blockhound-tests/pom.xml | 237 ------- + .../NettyBlockHoundIntegrationTest.java | 641 ------------------ .../netty/util/internal/localhost_server.key | 28 - .../netty/util/internal/localhost_server.pem | 17 - .../io/netty/util/internal/mutual_auth_ca.pem | 19 - - 9 files changed, 1165 deletions(-) + 9 files changed, 1182 deletions(-) delete mode 100644 common/src/main/java/io/netty/util/internal/Hidden.java delete mode 100644 common/src/main/resources/META-INF/services/reactor.blockhound.integration.BlockHoundIntegration delete mode 100644 transport-blockhound-tests/pom.xml @@ -23,7 +23,7 @@ delete mode 100644 transport-blockhound-tests/src/test/resources/io/netty/util/internal/mutual_auth_ca.pem diff --git a/common/pom.xml b/common/pom.xml -index 5b96ed0977..9482101126 100644 +index 672e04a645..f1e494fc9d 100644 --- a/common/pom.xml +++ b/common/pom.xml @@ -89,11 +89,6 @@ @@ -40,10 +40,10 @@ <artifactId>mockito-core</artifactId> diff --git a/common/src/main/java/io/netty/util/internal/Hidden.java b/common/src/main/java/io/netty/util/internal/Hidden.java deleted file mode 100644 -index bdc32dad60..0000000000 +index e6ee3d9521..0000000000 --- a/common/src/main/java/io/netty/util/internal/Hidden.java +++ /dev/null -@@ -1,208 +0,0 @@ +@@ -1,213 +0,0 @@ -/* - * Copyright 2019 The Netty Project - * @@ -152,6 +152,11 @@ - ); - - builder.allowBlockingCallsInside( +- "io.netty.buffer.AdaptivePoolingAllocator$Magazine", +- "free" +- ); +- +- builder.allowBlockingCallsInside( - "io.netty.handler.ssl.SslHandler", - "handshake" - ); @@ -274,10 +279,10 @@ -io.netty.util.internal.Hidden$NettyBlockHoundIntegration \ No newline at end of file diff --git a/pom.xml b/pom.xml -index f524fe8665..bc9d0f0b43 100644 +index 51d5a10498..6a9f848e2e 100644 --- a/pom.xml +++ b/pom.xml -@@ -909,7 +909,6 @@ +@@ -923,7 +923,6 @@ <module>testsuite-native-image</module> <module>testsuite-native-image-client</module> <module>testsuite-native-image-client-runtime-init</module> @@ -285,7 +290,7 @@ <module>microbench</module> <module>bom</module> </modules> -@@ -1338,13 +1337,6 @@ +@@ -1352,13 +1351,6 @@ <version>${log4j2.version}</version> <scope>test</scope> </dependency> @@ -301,10 +306,10 @@ diff --git a/transport-blockhound-tests/pom.xml b/transport-blockhound-tests/pom.xml deleted file mode 100644 -index 971aa5b7be..0000000000 +index 5e881fc5f9..0000000000 --- a/transport-blockhound-tests/pom.xml +++ /dev/null -@@ -1,228 +0,0 @@ +@@ -1,237 +0,0 @@ -<?xml version="1.0" encoding="UTF-8"?> -<!-- - ~ Copyright 2019 The Netty Project @@ -327,7 +332,7 @@ - <parent> - <groupId>io.netty</groupId> - <artifactId>netty-parent</artifactId> -- <version>4.1.138.Final</version> +- <version>4.1.140.Final</version> - </parent> - - <artifactId>netty-transport-blockhound-tests</artifactId> @@ -465,6 +470,15 @@ - <argLine.common>-XX:+AllowRedefinitionToAddDeleteMethods -XX:+EnableDynamicAgentLoading</argLine.common> - </properties> - </profile> +- <profile> +- <id>java27</id> +- <activation> +- <jdk>27</jdk> +- </activation> +- <properties> +- <argLine.common>-XX:+AllowRedefinitionToAddDeleteMethods -XX:+EnableDynamicAgentLoading</argLine.common> +- </properties> +- </profile> - </profiles> - - <properties> @@ -535,10 +549,10 @@ -</project> diff --git a/transport-blockhound-tests/src/test/java/io/netty/util/internal/NettyBlockHoundIntegrationTest.java b/transport-blockhound-tests/src/test/java/io/netty/util/internal/NettyBlockHoundIntegrationTest.java deleted file mode 100644 -index 66e169a11d..0000000000 +index adc08da37a..0000000000 --- a/transport-blockhound-tests/src/test/java/io/netty/util/internal/NettyBlockHoundIntegrationTest.java +++ /dev/null -@@ -1,638 +0,0 @@ +@@ -1,641 +0,0 @@ -/* - * Copyright 2019 The Netty Project - @@ -597,6 +611,7 @@ -import org.junit.jupiter.api.BeforeAll; -import org.junit.jupiter.api.Test; -import org.junit.jupiter.api.Timeout; +-import org.junit.jupiter.api.function.Executable; -import reactor.blockhound.BlockHound; -import reactor.blockhound.BlockingOperationError; -import reactor.blockhound.integration.BlockHoundIntegration; @@ -626,6 +641,7 @@ -import static org.junit.jupiter.api.Assertions.assertEquals; -import static org.junit.jupiter.api.Assertions.assertInstanceOf; -import static org.junit.jupiter.api.Assertions.assertNull; +-import static org.junit.jupiter.api.Assertions.assertThrows; -import static org.junit.jupiter.api.Assertions.assertTrue; -import static org.junit.jupiter.api.Assertions.fail; -import static org.junit.jupiter.api.Assumptions.assumeTrue; @@ -659,12 +675,13 @@ - }); - GlobalEventExecutor.INSTANCE.execute(future); - -- try { -- future.get(5, TimeUnit.SECONDS); -- fail("Expected an exception due to a blocking call but none was thrown"); -- } catch (ExecutionException e) { -- assertInstanceOf(BlockingOperationError.class, e.getCause()); -- } +- ExecutionException e = assertThrows(ExecutionException.class, new Executable() { +- @Override +- public void execute() throws Throwable { +- future.get(5, TimeUnit.SECONDS); +- } +- }); +- assertInstanceOf(BlockingOperationError.class, e.getCause()); - } - - @Test @@ -1260,6 +1277,6 @@ -hH82y9bBeflqroOeztqMpONpWoZjlz0sWbJNvXztXINL7LaNmVYOcoUrCcxPS54T ------END CERTIFICATE----- -- -2.55.0 +2.56.0 ++++++ 0002-Remove-optional-dep-conscrypt.patch ++++++ --- /var/tmp/diff_new_pack.uIaobd/_old 2026-11-03 18:03:22.253003593 +0100 +++ /var/tmp/diff_new_pack.uIaobd/_new 2026-11-03 18:03:22.257003760 +0100 @@ -1,4 +1,4 @@ -From b0dd10b09e56b70aaab1d2c969f39033ff332104 Mon Sep 17 00:00:00 2001 +From 5c2fabe50a2990f442c6621b2e546a4b79789cef Mon Sep 17 00:00:00 2001 From: Mat Booth <[email protected]> Date: Mon, 7 Sep 2020 13:24:30 +0100 Subject: [PATCH 2/4] Remove optional dep conscrypt @@ -8,14 +8,14 @@ .../java/io/netty/handler/ssl/Conscrypt.java | 75 ------- .../handler/ssl/ConscryptAlpnSslEngine.java | 212 ------------------ .../JdkAlpnApplicationProtocolNegotiator.java | 8 +- - .../java/io/netty/handler/ssl/SslHandler.java | 52 +---- + .../java/io/netty/handler/ssl/SslHandler.java | 58 +---- pom.xml | 10 - - 6 files changed, 2 insertions(+), 361 deletions(-) + 6 files changed, 2 insertions(+), 367 deletions(-) delete mode 100644 handler/src/main/java/io/netty/handler/ssl/Conscrypt.java delete mode 100644 handler/src/main/java/io/netty/handler/ssl/ConscryptAlpnSslEngine.java diff --git a/handler/pom.xml b/handler/pom.xml -index a217c1934e..bf50b8686d 100644 +index b105c4280e..eb781dbd7e 100644 --- a/handler/pom.xml +++ b/handler/pom.xml @@ -96,12 +96,6 @@ @@ -364,10 +364,10 @@ return new BouncyCastleAlpnSslEngine(engine, applicationNegotiator, isServer); } diff --git a/handler/src/main/java/io/netty/handler/ssl/SslHandler.java b/handler/src/main/java/io/netty/handler/ssl/SslHandler.java -index 8b8b88d4da..32ad13a25d 100644 +index 4e41183e03..f4cfc7af23 100644 --- a/handler/src/main/java/io/netty/handler/ssl/SslHandler.java +++ b/handler/src/main/java/io/netty/handler/ssl/SslHandler.java -@@ -250,55 +250,6 @@ public class SslHandler extends ByteToMessageDecoder implements ChannelOutboundH +@@ -267,61 +267,6 @@ public class SslHandler extends ByteToMessageDecoder implements ChannelOutboundH return ((ReferenceCountedOpenSslEngine) engine).jdkCompatibilityMode; } }, @@ -416,6 +416,12 @@ - } - - @Override +- int calculateInitialUnwrapBufSize(SslHandler handler, int length) { +- // Conscrypt does not need more space than the plaintext, which is at most MAX_PLAINTEXT_LENGTH. +- return Math.min(length, MAX_PLAINTEXT_LENGTH); +- } +- +- @Override - boolean jdkCompatibilityMode(SSLEngine engine) { - return true; - } @@ -423,7 +429,7 @@ JDK(false, MERGE_CUMULATOR) { @Override SSLEngineResult unwrap(SslHandler handler, ByteBuf in, int len, ByteBuf out) throws SSLException { -@@ -357,8 +308,7 @@ public class SslHandler extends ByteToMessageDecoder implements ChannelOutboundH +@@ -387,8 +332,7 @@ public class SslHandler extends ByteToMessageDecoder implements ChannelOutboundH }; static SslEngineType forEngine(SSLEngine engine) { @@ -434,10 +440,10 @@ SslEngineType(boolean wantsDirectBuffer, Cumulator cumulator) { diff --git a/pom.xml b/pom.xml -index 82a056eeaf..29294b1fac 100644 +index 6a9f848e2e..d2aaf3d1bb 100644 --- a/pom.xml +++ b/pom.xml -@@ -988,16 +988,6 @@ +@@ -1002,16 +1002,6 @@ <optional>true</optional> </dependency> @@ -455,6 +461,6 @@ <dependency> <groupId>software.amazon.cryptools</groupId> -- -2.55.0 +2.56.0 ++++++ 0004-Disable-Brotli-and-ZStd-compression.patch ++++++ --- /var/tmp/diff_new_pack.uIaobd/_old 2026-11-03 18:03:22.278004640 +0100 +++ /var/tmp/diff_new_pack.uIaobd/_new 2026-11-03 18:03:22.282004807 +0100 @@ -1,4 +1,4 @@ -From de62fe918f089700d6ee68eaf397933300438edf Mon Sep 17 00:00:00 2001 +From e0c009881d31be95d26ce62e1435df6daf0ad0a7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fridrich=20=C5=A0trba?= <[email protected]> Date: Thu, 30 Mar 2023 13:19:04 +0200 Subject: [PATCH 4/4] Disable Brotli and ZStd compression @@ -240,7 +240,7 @@ return null; } diff --git a/codec-http2/src/main/java/io/netty/handler/codec/http2/CompressorHttp2ConnectionEncoder.java b/codec-http2/src/main/java/io/netty/handler/codec/http2/CompressorHttp2ConnectionEncoder.java -index b12213dff6..23d719c32e 100644 +index 957708526b..150016854d 100644 --- a/codec-http2/src/main/java/io/netty/handler/codec/http2/CompressorHttp2ConnectionEncoder.java +++ b/codec-http2/src/main/java/io/netty/handler/codec/http2/CompressorHttp2ConnectionEncoder.java @@ -21,18 +21,12 @@ import io.netty.channel.ChannelHandlerContext; @@ -316,7 +316,7 @@ } else if (compressionOptions instanceof SnappyOptions) { snappyOptions = (SnappyOptions) compressionOptions; } else { -@@ -286,15 +266,6 @@ public class CompressorHttp2ConnectionEncoder extends DecoratingHttp2ConnectionE +@@ -300,15 +280,6 @@ public class CompressorHttp2ConnectionEncoder extends DecoratingHttp2ConnectionE if (DEFLATE.contentEqualsIgnoreCase(contentEncoding) || X_DEFLATE.contentEqualsIgnoreCase(contentEncoding)) { return newCompressionChannel(ctx, ZlibWrapper.ZLIB); } @@ -333,7 +333,7 @@ return new EmbeddedChannel(ctx.channel().id(), ctx.channel().metadata().hasDisconnect(), ctx.channel().config(), new SnappyFrameEncoder()); diff --git a/codec-http2/src/main/java/io/netty/handler/codec/http2/DelegatingDecompressorFrameListener.java b/codec-http2/src/main/java/io/netty/handler/codec/http2/DelegatingDecompressorFrameListener.java -index 6975c6f9e6..8486c83e58 100644 +index 1dd0fb4474..8486c83e58 100644 --- a/codec-http2/src/main/java/io/netty/handler/codec/http2/DelegatingDecompressorFrameListener.java +++ b/codec-http2/src/main/java/io/netty/handler/codec/http2/DelegatingDecompressorFrameListener.java @@ -20,10 +20,6 @@ import io.netty.channel.ChannelHandlerContext; @@ -368,7 +368,7 @@ } - if (Brotli.isAvailable() && BR.contentEqualsIgnoreCase(contentEncoding)) { - return new EmbeddedChannel(ctx.channel().id(), ctx.channel().metadata().hasDisconnect(), -- ctx.channel().config(), new BrotliDecoder(maxAllocation)); +- ctx.channel().config(), BrotliDecoder.newDecoderWithMaxAllocation(maxAllocation)); - } if (SNAPPY.contentEqualsIgnoreCase(contentEncoding)) { return new EmbeddedChannel(ctx.channel().id(), ctx.channel().metadata().hasDisconnect(), @@ -466,6 +466,6 @@ * Create a new {@link SnappyOptions} */ -- -2.55.0 +2.56.0 ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.uIaobd/_old 2026-11-03 18:03:22.325006607 +0100 +++ /var/tmp/diff_new_pack.uIaobd/_new 2026-11-03 18:03:22.329006775 +0100 @@ -1,6 +1,6 @@ -mtime: 1790249469 -commit: 62d22f494960cc68de93b401c8a0a25f74077f1ca35740b4af7c883755e49ca5 +mtime: 1793696785 +commit: 7a9a33b4dad543e394ed2e7648e8692e170d7a2ed08638cd423193ff29cbeee9 url: https://src.opensuse.org/java-packages/netty -revision: 62d22f494960cc68de93b401c8a0a25f74077f1ca35740b4af7c883755e49ca5 +revision: 7a9a33b4dad543e394ed2e7648e8692e170d7a2ed08638cd423193ff29cbeee9 projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-11-03 10:06:25.000000000 +0100 @@ -0,0 +1 @@ +.osc ++++++ netty-4.1.138.Final.tar.gz -> netty-4.1.140.Final.tar.gz ++++++ ++++ 34782 lines of diff (skipped) ++++++ no-werror.patch ++++++ --- /var/tmp/diff_new_pack.uIaobd/_old 2026-11-03 18:03:23.561058349 +0100 +++ /var/tmp/diff_new_pack.uIaobd/_new 2026-11-03 18:03:23.565058516 +0100 @@ -6,7 +6,7 @@ <env key="JNI_PLATFORM" value="${jni.platform}" /> - <env key="CFLAGS" value="-O3 -Werror -Wno-attributes -fPIC -fno-omit-frame-pointer -Wunused-variable -fvisibility=hidden" /> + <env key="CFLAGS" value="-O3 -Wno-attributes -fPIC -fno-omit-frame-pointer -Wunused-variable -fvisibility=hidden" /> - <env key="LDFLAGS" value="-Wl,--no-as-needed -lrt -Wl,-platform_version,macos,10.9,10.9" /> + <env key="LDFLAGS" value="-Wl,--no-as-needed -lrt -Wl,-platform_version,macos,11.0,11.0" /> <env key="LIB_NAME" value="${nativeLibName}" /> <!-- support for __attribute__((weak_import)) by the linker was added in 10.2 so ensure we @@ -228,7 +228,7 @@
