Please upgrade dependencies because of io.netty:netty-codec-http vulnerability

[viktoridzojtic-dynatrace]

Describe the bug

The versions of the dependencies rds and sts that are currently included depend on io.netty:netty-codec-http@4.1.124.Final, which has a vulnerability (see https://nvd.nist.gov/vuln/detail/CVE-2025-58056). The latest version of those packages depend on the fixed version of netty.

Expected Behavior

Upgrade io.netty:netty-codec-http to 4.1.125.Final or 4.2.5.Final.

What plugins are used? What other connection properties were set?

rds, sts

Current Behavior

The current version 2.6.3 includes io.netty:netty-codec-http@4.1.124.Final, which has a vulnerability.

Reproduction Steps

Include dependency on aws-advanced-jdbc-wrapper 2.6.3 in project.

Possible Solution

Upgrade the versions of the dependencies.

Additional Information/Context

No response

The AWS Advanced JDBC Driver version used

2.6.3

JDK version used

openjdk 21.0.7 2025-04-15 LTS OpenJDK Runtime Environment Temurin-21.0.7+6 (build 21.0.7+6-LTS) OpenJDK 64-Bit Server VM Temurin-21.0.7+6 (build 21.0.7+6-LTS, mixed mode, sharing)

Operating System and version

MacOs Version 15.6

[sergiyvamz]

Hi @viktoridzojtic-dynatrace

Unfortunately the latest AWS SDK rds adn sts version 2.33.3 transitively require io.netty:netty-codec-http@4.1.124.Final. We'll be monitoring AWS SDK new releases and upgrade the driver dependencies as soon as possible.