softwaremill / softwaremill/sttp
Bump netty version to 4.1.118.Final for client3
Nobody has claimed this yet.
- Dominant language
- Scala
- Stars
- 1.5k
- Forks
- 338
- Avg merge
- 8h 59m
- Merged PRs (30d)
- 13
Description
The current netty version used in client3 has vulnerabilities. i.e. CVE-2025-24970. Its resolved in netty 4.1.118.Final. Is it viable to override/bump the netty version for client3, or even better use newer version of armeria?
The netty version is propogated transitevely through armeria 1.26.4
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the client3 dependency definition and checking how Armeria 1.26.4 brings Netty transitively. Verify whether Netty 4.1.118.Final can be selected without conflicts, or whether a newer Armeria version is required; done means client3 resolves a non-vulnerable Netty version and its dependency checks pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- scala
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100