From 8d1ddf1c42df0546132b84d68bd6e6ef931446a8 Mon Sep 17 00:00:00 2001
From: manas-ctds <Manas.Kaushik@ibm.com>
Date: Fri, 12 Jun 2026 17:06:27 +0530
Subject: [PATCH 1/2] Upgrade netty.version to 4.1.135.Final to remediate CVEs

---
 pom.xml | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 43e5005..d0eaf2c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -57,7 +57,7 @@
     <aircompressor.version>2.0.3</aircompressor.version>
     <jackson.version>2.21.2</jackson.version>
     <snakeyaml.version>2.0</snakeyaml.version>
-    <netty.version>4.1.133.Final</netty.version>
+    <netty.version>4.1.135.Final</netty.version>
   </properties>
   <modules>
     <module>streaming-ai</module>
@@ -214,6 +214,12 @@
         <version>${netty.version}</version>
       </dependency>
       <!-- Override transitive dependency version to fix vulnerability -->
+      <dependency>
+        <groupId>io.netty</groupId>
+        <artifactId>netty-resolver-dns</artifactId>
+        <version>${netty.version}</version>
+      </dependency>
+      <!-- Override transitive dependency version to fix vulnerability -->
       <dependency>
         <groupId>io.netty</groupId>
         <artifactId>netty-codec</artifactId>
@@ -239,6 +245,12 @@
         <artifactId>netty-handler-proxy</artifactId>
         <version>${netty.version}</version>
       </dependency>
+      <!-- Override transitive dependency version to fix vulnerability -->
+      <dependency>
+        <groupId>io.netty</groupId>
+        <artifactId>netty-transport-native-unix-common</artifactId>
+        <version>${netty.version}</version>
+      </dependency>
     </dependencies>
   </dependencyManagement>
   <build>

From 8b3437274f9908f3c34e2a3ccefd6b4bf8ba3889 Mon Sep 17 00:00:00 2001
From: manas-ctds <Manas.Kaushik@ibm.com>
Date: Fri, 12 Jun 2026 17:20:22 +0530
Subject: [PATCH 2/2] Bump reactor-netty-http to 1.2.18 to remediate
 CVE-2026-41715

---
 pom.xml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pom.xml b/pom.xml
index d0eaf2c..887ea1a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -58,6 +58,7 @@
     <jackson.version>2.21.2</jackson.version>
     <snakeyaml.version>2.0</snakeyaml.version>
     <netty.version>4.1.135.Final</netty.version>
+    <reactor-netty-http.version>1.2.18</reactor-netty-http.version>
   </properties>
   <modules>
     <module>streaming-ai</module>
@@ -251,6 +252,12 @@
         <artifactId>netty-transport-native-unix-common</artifactId>
         <version>${netty.version}</version>
       </dependency>
+      <!-- Override transitive dependency version to fix vulnerability -->
+      <dependency>
+        <groupId>io.projectreactor.netty</groupId>
+        <artifactId>reactor-netty-http</artifactId>
+        <version>${reactor-netty-http.version}</version>
+      </dependency>
     </dependencies>
   </dependencyManagement>
   <build>