Skip to content

Comments

Bump netty to 4.2.10.Final#20586

Merged
reta merged 1 commit intoopensearch-project:mainfrom
reta:netty.4.2.10
Feb 10, 2026
Merged

Bump netty to 4.2.10.Final#20586
reta merged 1 commit intoopensearch-project:mainfrom
reta:netty.4.2.10

Conversation

@reta
Copy link
Contributor

@reta reta commented Feb 10, 2026

Description

Bump netty to 4.2.10.Final

Related Issues

N/A

Check List

  • Functionality includes testing.
  • API changes companion pull request created, if applicable.
  • Public documentation issue/PR created, if applicable.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

@reta reta requested review from a team and peternied as code owners February 10, 2026 13:30
@reta reta added dependencies Pull requests that update a dependency file skip-changelog labels Feb 10, 2026
@coderabbitai
Copy link
Contributor

coderabbitai bot commented Feb 10, 2026

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Netty dependency updated from version 4.2.9.Final to 4.2.10.Final across the project. The version change is declared in gradle/libs.versions.toml, documented in CHANGELOG.md, and reflected through updated SHA-1 checksum files for all Netty JAR artifacts in multiple license directories.

Changes

Cohort / File(s) Summary
Version Declaration and Documentation
CHANGELOG.md, gradle/libs.versions.toml
Updated Netty version from 4.2.9.Final to 4.2.10.Final in dependency catalog and changelog.
License Checksums
libs/netty4/licenses/*, modules/transport-netty4/licenses/*, plugins/arrow-flight-rpc/licenses/*, plugins/ingestion-kinesis/licenses/*, plugins/repository-azure/licenses/*, plugins/repository-hdfs/licenses/*, plugins/repository-s3/licenses/*, plugins/transport-reactor-netty4/licenses/*, test/framework/licenses/*
Replaced SHA-1 checksum files for Netty 4.2.9.Final artifacts with corresponding 4.2.10.Final checksums across all license directories. Old checksums removed, new checksums added for each Netty module and variant (buffer, codec, handler, transport, native binaries, etc.).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

  • Bump netty to 4.2.9.Final #20230 — Performs identical Netty version upgrade from 4.2.9.Final to 4.2.10.Final with matching gradle/libs.versions.toml and license checksum file updates.
🚥 Pre-merge checks | ✅ 2 | ❌ 1
❌ Failed checks (1 inconclusive)
Check name Status Explanation Resolution
Description check ❓ Inconclusive The description is minimal and only states 'Bump netty to 4.2.10.Final' without explaining the motivation, impact, or reason for the upgrade. Provide additional context such as why this upgrade is necessary, any breaking changes, security fixes, or bug fixes included in 4.2.10.Final, and whether testing was performed.
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The title 'Bump netty to 4.2.10.Final' is concise, clear, and directly describes the main change—updating the netty dependency version from 4.2.9.Final to 4.2.10.Final.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Fix all issues with AI agents
In `@plugins/repository-azure/licenses/netty-codec-http2-4.2.10.Final.jar.sha1`:
- Line 1: The SHA1 file for io.netty:netty-codec-http2:4.2.10.Final cannot be
verified against Maven Central; add a provenance note documenting where this
artifact was obtained and how its integrity was verified: reference the artifact
id "io.netty:netty-codec-http2:4.2.10.Final" and the existing SHA1 string,
include the exact source URL or repository/mirror used, any PGP signature or
checksum sources, steps you ran to verify (e.g., downloaded file fingerprinting,
comparison to vendor-supplied signatures, or rebuild-and-hash instructions), and
link to the authoritative Netty release announcement or committer that confirms
the module’s release; place this documentation alongside the license/sha1 entry
for netty-codec-http2 so reviewers can validate the provenance.
📜 Review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between ebc51dc and bab01a5.

📒 Files selected for processing (182)
  • CHANGELOG.md
  • gradle/libs.versions.toml
  • libs/netty4/licenses/netty-buffer-4.2.10.Final.jar.sha1
  • libs/netty4/licenses/netty-buffer-4.2.9.Final.jar.sha1
  • libs/netty4/licenses/netty-codec-classes-quic-4.2.10.Final.jar.sha1
  • libs/netty4/licenses/netty-codec-classes-quic-4.2.9.Final.jar.sha1
  • libs/netty4/licenses/netty-common-4.2.10.Final.jar.sha1
  • libs/netty4/licenses/netty-common-4.2.9.Final.jar.sha1
  • libs/netty4/licenses/netty-handler-4.2.10.Final.jar.sha1
  • libs/netty4/licenses/netty-handler-4.2.9.Final.jar.sha1
  • libs/netty4/licenses/netty-transport-4.2.10.Final.jar.sha1
  • libs/netty4/licenses/netty-transport-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-buffer-4.2.10.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-buffer-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-4.2.10.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-base-4.2.10.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-base-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-classes-quic-4.2.10.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-classes-quic-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-compression-4.2.10.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-compression-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-http-4.2.10.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-http-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-http2-4.2.10.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-http2-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-http3-4.2.10.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-http3-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-native-quic-4.2.10.Final-linux-aarch_64.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-native-quic-4.2.10.Final-linux-x86_64.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-native-quic-4.2.10.Final-osx-aarch_64.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-native-quic-4.2.10.Final-osx-x86_64.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-native-quic-4.2.10.Final-windows-x86_64.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-native-quic-4.2.10.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-native-quic-4.2.9.Final-linux-aarch_64.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-native-quic-4.2.9.Final-linux-x86_64.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-native-quic-4.2.9.Final-osx-aarch_64.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-native-quic-4.2.9.Final-osx-x86_64.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-native-quic-4.2.9.Final-windows-x86_64.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-native-quic-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-common-4.2.10.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-common-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-handler-4.2.10.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-handler-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-resolver-4.2.10.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-resolver-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-transport-4.2.10.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-transport-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-transport-native-unix-common-4.2.10.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-transport-native-unix-common-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-buffer-4.2.10.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-buffer-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-codec-4.2.10.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-codec-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-codec-base-4.2.10.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-codec-base-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-codec-compression-4.2.10.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-codec-compression-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-codec-http-4.2.10.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-codec-http-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-codec-http2-4.2.10.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-codec-http2-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-common-4.2.10.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-common-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-handler-4.2.10.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-handler-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-resolver-4.2.10.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-resolver-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-transport-4.2.10.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-transport-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-transport-classes-epoll-4.2.10.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-transport-classes-epoll-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-transport-native-unix-common-4.2.10.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-transport-native-unix-common-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-buffer-4.2.10.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-buffer-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-codec-4.2.10.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-codec-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-codec-base-4.2.10.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-codec-base-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-codec-compression-4.2.10.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-codec-compression-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-codec-http-4.2.10.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-codec-http-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-codec-http2-4.2.10.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-codec-http2-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-common-4.2.10.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-common-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-handler-4.2.10.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-handler-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-resolver-4.2.10.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-resolver-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-transport-4.2.10.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-transport-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-transport-classes-epoll-4.2.10.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-transport-classes-epoll-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-transport-native-unix-common-4.2.10.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-transport-native-unix-common-4.2.9.Final.jar.sha1
  • plugins/repository-azure/licenses/netty-codec-base-4.2.10.Final.jar.sha1
  • plugins/repository-azure/licenses/netty-codec-base-4.2.9.Final.jar.sha1
  • plugins/repository-azure/licenses/netty-codec-dns-4.2.10.Final.jar.sha1
  • plugins/repository-azure/licenses/netty-codec-dns-4.2.9.Final.jar.sha1
  • plugins/repository-azure/licenses/netty-codec-http2-4.2.10.Final.jar.sha1
  • plugins/repository-azure/licenses/netty-codec-http2-4.2.9.Final.jar.sha1
  • plugins/repository-azure/licenses/netty-codec-socks-4.2.10.Final.jar.sha1
  • plugins/repository-azure/licenses/netty-codec-socks-4.2.9.Final.jar.sha1
  • plugins/repository-azure/licenses/netty-handler-proxy-4.2.10.Final.jar.sha1
  • plugins/repository-azure/licenses/netty-handler-proxy-4.2.9.Final.jar.sha1
  • plugins/repository-azure/licenses/netty-resolver-dns-4.2.10.Final.jar.sha1
  • plugins/repository-azure/licenses/netty-resolver-dns-4.2.9.Final.jar.sha1
  • plugins/repository-azure/licenses/netty-transport-native-unix-common-4.2.10.Final.jar.sha1
  • plugins/repository-azure/licenses/netty-transport-native-unix-common-4.2.9.Final.jar.sha1
  • plugins/repository-hdfs/licenses/netty-all-4.2.10.Final.jar.sha1
  • plugins/repository-hdfs/licenses/netty-all-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-buffer-4.2.10.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-buffer-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-codec-4.2.10.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-codec-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-codec-base-4.2.10.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-codec-base-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-codec-compression-4.2.10.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-codec-compression-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-codec-http-4.2.10.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-codec-http-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-codec-http2-4.2.10.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-codec-http2-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-common-4.2.10.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-common-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-handler-4.2.10.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-handler-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-resolver-4.2.10.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-resolver-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-transport-4.2.10.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-transport-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-transport-classes-epoll-4.2.10.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-transport-classes-epoll-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-transport-native-unix-common-4.2.10.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-transport-native-unix-common-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-buffer-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-buffer-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-base-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-base-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-classes-quic-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-classes-quic-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-compression-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-compression-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-dns-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-dns-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-http-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-http-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-http2-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-http2-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-http3-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-http3-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.10.Final-linux-aarch_64.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.10.Final-linux-x86_64.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.10.Final-osx-aarch_64.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.10.Final-osx-x86_64.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.10.Final-windows-x86_64.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.9.Final-linux-aarch_64.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.9.Final-linux-x86_64.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.9.Final-osx-aarch_64.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.9.Final-osx-x86_64.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.9.Final-windows-x86_64.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-common-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-common-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-handler-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-handler-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-resolver-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-resolver-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-resolver-dns-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-resolver-dns-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-transport-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-transport-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-transport-native-unix-common-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-transport-native-unix-common-4.2.9.Final.jar.sha1
  • test/framework/licenses/netty-pkitesting-4.2.10.Final.jar.sha1
  • test/framework/licenses/netty-pkitesting-4.2.9.Final.jar.sha1
💤 Files with no reviewable changes (90)
  • modules/transport-netty4/licenses/netty-handler-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-handler-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-codec-http2-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-transport-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-http3-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-handler-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.9.Final-linux-x86_64.jar.sha1
  • plugins/repository-azure/licenses/netty-codec-socks-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-codec-http-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-resolver-dns-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-buffer-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-dns-4.2.9.Final.jar.sha1
  • plugins/repository-azure/licenses/netty-codec-http2-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-native-quic-4.2.9.Final-osx-aarch_64.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-transport-classes-epoll-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-transport-native-unix-common-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-codec-compression-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-native-quic-4.2.9.Final-windows-x86_64.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-transport-classes-epoll-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-resolver-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-codec-base-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-http-4.2.9.Final.jar.sha1
  • plugins/repository-azure/licenses/netty-resolver-dns-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-common-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-common-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-transport-native-unix-common-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-http2-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-handler-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-transport-classes-epoll-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-resolver-4.2.9.Final.jar.sha1
  • libs/netty4/licenses/netty-buffer-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-codec-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-codec-base-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-transport-native-unix-common-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-codec-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-transport-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-base-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-transport-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-base-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-codec-compression-4.2.9.Final.jar.sha1
  • plugins/repository-azure/licenses/netty-handler-proxy-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-common-4.2.9.Final.jar.sha1
  • plugins/repository-azure/licenses/netty-transport-native-unix-common-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-native-quic-4.2.9.Final-linux-aarch_64.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-resolver-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-http2-4.2.9.Final.jar.sha1
  • libs/netty4/licenses/netty-codec-classes-quic-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-http-4.2.9.Final.jar.sha1
  • plugins/arrow-flight-rpc/licenses/netty-transport-native-unix-common-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-buffer-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-buffer-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-http3-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-buffer-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-common-4.2.9.Final.jar.sha1
  • libs/netty4/licenses/netty-handler-4.2.9.Final.jar.sha1
  • libs/netty4/licenses/netty-common-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-common-4.2.9.Final.jar.sha1
  • plugins/repository-azure/licenses/netty-codec-base-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-classes-quic-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-compression-4.2.9.Final.jar.sha1
  • test/framework/licenses/netty-pkitesting-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-transport-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.9.Final-osx-x86_64.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.9.Final-windows-x86_64.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-transport-native-unix-common-4.2.9.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.9.Final-osx-aarch_64.jar.sha1
  • plugins/repository-s3/licenses/netty-codec-http2-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-codec-http-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-codec-http2-4.2.9.Final.jar.sha1
  • plugins/repository-hdfs/licenses/netty-all-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-codec-base-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-native-quic-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-codec-4.2.9.Final.jar.sha1
  • libs/netty4/licenses/netty-transport-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-compression-4.2.9.Final.jar.sha1
  • plugins/repository-s3/licenses/netty-handler-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-buffer-4.2.9.Final.jar.sha1
  • plugins/repository-azure/licenses/netty-codec-dns-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-codec-http-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-resolver-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-resolver-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-native-quic-4.2.9.Final-osx-x86_64.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-transport-4.2.9.Final.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-native-quic-4.2.9.Final-linux-x86_64.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.9.Final-linux-aarch_64.jar.sha1
  • modules/transport-netty4/licenses/netty-codec-classes-quic-4.2.9.Final.jar.sha1
  • plugins/ingestion-kinesis/licenses/netty-codec-compression-4.2.9.Final.jar.sha1
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-12-12T18:40:08.452Z
Learnt from: reta
Repo: opensearch-project/OpenSearch PR: 20017
File: plugins/transport-reactor-netty4/src/test/java/org/opensearch/http/reactor/netty4/ssl/SecureReactorNetty4HttpServerTransportTests.java:256-256
Timestamp: 2025-12-12T18:40:08.452Z
Learning: In the OpenSearch ReactorNetty4 secure HTTP transport tests (plugins/transport-reactor-netty4/src/test/java/org/opensearch/http/reactor/netty4/ssl/SecureReactorNetty4HttpServerTransportTests.java), URI limit validation has been moved from the protocol layer to the transport layer, making it protocol-agnostic. The random protocol selection in ReactorHttpClient.https(settings) is intentional to ensure all tests validate correct behavior across HTTP/1.1, HTTP/2, and HTTP/3.

Applied to files:

  • plugins/transport-reactor-netty4/licenses/netty-codec-classes-quic-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.10.Final-linux-aarch_64.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-common-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.10.Final-osx-aarch_64.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-handler-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.10.Final-osx-x86_64.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-http2-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-transport-native-unix-common-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-compression-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-resolver-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-transport-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.10.Final-windows-x86_64.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-dns-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-http-4.2.10.Final.jar.sha1
  • plugins/transport-reactor-netty4/licenses/netty-codec-http3-4.2.10.Final.jar.sha1
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (19)
  • GitHub Check: Mend Security Check
  • GitHub Check: assemble (21, ubuntu-latest)
  • GitHub Check: assemble (25, ubuntu-24.04-arm)
  • GitHub Check: precommit (25, macos-15-intel)
  • GitHub Check: precommit (21, ubuntu-latest)
  • GitHub Check: precommit (25, windows-latest)
  • GitHub Check: precommit (21, macos-15)
  • GitHub Check: assemble (21, ubuntu-24.04-arm)
  • GitHub Check: precommit (21, ubuntu-24.04-arm)
  • GitHub Check: precommit (21, macos-15-intel)
  • GitHub Check: precommit (21, windows-latest)
  • GitHub Check: Analyze (java)
  • GitHub Check: assemble (25, ubuntu-latest)
  • GitHub Check: precommit (25, macos-15)
  • GitHub Check: precommit (21, windows-2025, true)
  • GitHub Check: assemble (21, windows-latest)
  • GitHub Check: precommit (25, ubuntu-24.04-arm)
  • GitHub Check: precommit (25, ubuntu-latest)
  • GitHub Check: assemble (25, windows-latest)
🔇 Additional comments (81)
modules/transport-netty4/licenses/netty-handler-4.2.10.Final.jar.sha1 (1)

1-1: Checksum entry looks correct.

plugins/ingestion-kinesis/licenses/netty-codec-4.2.10.Final.jar.sha1 (1)

1-1: SHA-1 checksum is correct. The provided hash matches the official netty-codec-4.2.10.Final.jar artifact from Maven Central, confirming build integrity and security.

plugins/transport-reactor-netty4/licenses/netty-codec-http2-4.2.10.Final.jar.sha1 (1)

1-1: The SHA-1 checksum is correct and matches the official Maven Central artifact. Netty 4.2.10.Final has no active security advisories—any prior CVEs in earlier 4.2.x versions are fixed in this release.

plugins/transport-reactor-netty4/licenses/netty-codec-http3-4.2.10.Final.jar.sha1 (3)

1-1: Verify the old SHA-1 file for version 4.2.9.Final was removed.

When upgrading dependencies, the previous version's checksum file should be cleaned up to avoid confusion.

#!/bin/bash
# Description: Check if the old netty-codec-http3-4.2.9.Final.jar.sha1 file still exists.

fd -t f "netty-codec-http3-4.2.9.Final.jar.sha1" plugins/transport-reactor-netty4/licenses/

1-1: Netty 4.2.10.Final is a valid, patched release with no known vulnerabilities.

Verification confirms 4.2.10.Final is a legitimate release (Feb 5, 2026) available on Maven Central. The version is not affected by any CVEs in the 4.2.x line—all earlier CVEs (CVE-2025-55163, CVE-2025-58056, CVE-2025-58057, CVE-2025-59419, CVE-2025-67735) are patched as of this version. The release notes describe it as a bug-fix release with regression fixes. No action needed.


1-1: Hash format is valid and version is legitimate, but actual hash correctness cannot be confirmed in automated verification.

The SHA-1 hash uses correct format (40 hexadecimal characters, 40-byte file size), matches the structure of other netty dependency checksums, and Netty 4.2.10.Final is a stable release with no known security vulnerabilities. However, verification against the actual Maven Central JAR cannot be completed in this environment. Manual verification by downloading the JAR from Maven Central and confirming the checksum is required to ensure this dependency matches the intended artifact.

Additionally, the old 4.2.9.Final SHA-1 file has been properly removed, and all netty libraries in the directory have been consistently upgraded to 4.2.10.Final.

plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.10.Final-osx-x86_64.jar.sha1 (1)

1-1: LGTM!

The checksum update for the native QUIC codec (OSX x86_64) aligns with the Netty 4.2.10.Final upgrade. This artifact supports HTTP/3 functionality in the ReactorNetty4 transport layer.

modules/transport-netty4/licenses/netty-buffer-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

The checksum is correctly formatted and consistent with the same artifact in other modules (e.g., plugins/ingestion-kinesis).

plugins/ingestion-kinesis/licenses/netty-buffer-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

The checksum is correctly formatted and matches the same artifact in modules/transport-netty4, confirming consistency across modules.

plugins/ingestion-kinesis/licenses/netty-common-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

The checksum is correctly formatted and will be verified for consistency with the same artifact in other modules.

modules/transport-netty4/licenses/netty-codec-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

The checksum is correctly formatted for the netty-codec artifact upgrade.

plugins/arrow-flight-rpc/licenses/netty-common-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

The checksum is correctly formatted and matches the same artifact in plugins/ingestion-kinesis, confirming consistency across modules.

plugins/repository-s3/licenses/netty-codec-compression-4.2.10.Final.jar.sha1 (1)

1-1: Checksums verified and version is secure.

The SHA-1 checksums for the Netty 4.2.10.Final artifacts match those from Maven Central. This is a stable release from February 5, 2026. Known security vulnerabilities in earlier 4.2.x versions (CVE-2025-55163 and CVE-2025-58056) are fixed in 4.2.10.Final.

modules/transport-netty4/licenses/netty-codec-native-quic-4.2.10.Final-osx-x86_64.jar.sha1 (1)

1-1: Verify SHA-1 checksum against official Maven Central repository.

As part of the Netty 4.2.10.Final dependency bump, all checksum files should be verified against the official Maven Central artifacts to ensure integrity and prevent supply chain attacks.

I'll provide a consolidated verification script after reviewing all checksum files.

plugins/repository-s3/licenses/netty-transport-native-unix-common-4.2.10.Final.jar.sha1 (1)

1-1: Verify SHA-1 checksum against official Maven Central repository.

This checksum should be verified as part of the dependency update verification process.

modules/transport-netty4/licenses/netty-codec-native-quic-4.2.10.Final-windows-x86_64.jar.sha1 (1)

1-1: Verify SHA-1 checksum against official Maven Central repository.

plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.10.Final-linux-x86_64.jar.sha1 (1)

1-1: Verify SHA-1 checksum against official Maven Central repository.

plugins/repository-s3/licenses/netty-transport-4.2.10.Final.jar.sha1 (1)

1-1: Verify SHA-1 checksum against official Maven Central repository.

plugins/ingestion-kinesis/licenses/netty-resolver-4.2.10.Final.jar.sha1 (1)

1-1: No action required. The SHA-1 checksum in the file matches the official Maven Central artifact for netty-resolver-4.2.10.Final.jar.

plugins/repository-s3/licenses/netty-buffer-4.2.10.Final.jar.sha1 (1)

1-1: The SHA-1 checksum in the file is correct. The official Maven Central repository confirms that netty-buffer-4.2.10.Final.jar.sha1 has the checksum b9b67175347d45b1caa5525440258904e01fac22, which matches exactly what is committed in the file. There is no security-critical issue or checksum discrepancy to resolve.

Likely an incorrect or invalid review comment.

libs/netty4/licenses/netty-buffer-4.2.10.Final.jar.sha1 (1)

1-1: Checksum artifact looks good.

plugins/arrow-flight-rpc/licenses/netty-transport-4.2.10.Final.jar.sha1 (1)

1-1: Checksum artifact looks good.

plugins/transport-reactor-netty4/licenses/netty-codec-dns-4.2.10.Final.jar.sha1 (1)

1-1: Checksum artifact looks good.

plugins/repository-s3/licenses/netty-codec-base-4.2.10.Final.jar.sha1 (1)

1-1: Checksum artifact looks good.

plugins/repository-azure/licenses/netty-handler-proxy-4.2.10.Final.jar.sha1 (1)

1-1: Checksum artifact looks good.

modules/transport-netty4/licenses/netty-codec-classes-quic-4.2.10.Final.jar.sha1 (1)

1-1: Checksum artifact looks good.

plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.10.Final-osx-aarch_64.jar.sha1 (1)

1-1: Checksum artifact looks good.

plugins/arrow-flight-rpc/licenses/netty-transport-classes-epoll-4.2.10.Final.jar.sha1 (1)

1-1: Checksum verified against Maven Central.

The SHA-1 checksum 6d3396999238ce440c15c5258381f23b5f6083f3 matches the official Netty 4.2.10.Final release from Maven Central, confirming artifact integrity.

plugins/transport-reactor-netty4/licenses/netty-common-4.2.10.Final.jar.sha1 (1)

1-1: Checksum verified against Maven Central.

The SHA-1 checksum matches the official netty-common-4.2.10.Final.jar release on Maven Central (c55e97d9bd061a2d88418d2d831e1fa39cb975e7).

plugins/repository-azure/licenses/netty-codec-base-4.2.10.Final.jar.sha1 (1)

1-1: SHA-1 checksum verified and matches official Maven Central artifact.

The local checksum e81b71d93024736f174397bff1fdd590e0aa9c44 matches the official Netty 4.2.10.Final release artifact from Maven Central. Artifact integrity is confirmed.

plugins/transport-reactor-netty4/licenses/netty-transport-native-unix-common-4.2.10.Final.jar.sha1 (1)

1-1: SHA-1 checksum validated against Maven Central.

The netty-transport-native-unix-common-4.2.10.Final.jar.sha1 checksum (8a8495c494ab2f5b0fdd93d2f670a1ea50a6b7de) matches the official Maven Central artifact. Artifact integrity is confirmed.

plugins/ingestion-kinesis/licenses/netty-codec-compression-4.2.10.Final.jar.sha1 (1)

1-1: Checksum verified against Maven Central.

The SHA-1 checksum 5cc88546ee2ac730041eb33dff868037c8e85e78 matches the official netty-codec-compression-4.2.10.Final.jar artifact. Artifact integrity confirmed.

plugins/repository-azure/licenses/netty-resolver-dns-4.2.10.Final.jar.sha1 (1)

1-1: Checksum is valid and matches the official Netty 4.2.10.Final release.

The SHA-1 in this file correctly matches the Maven Central artifact.

CHANGELOG.md (1)

27-27: CHANGELOG entry is accurate and properly formatted.

Netty 4.2.10.Final is a valid bug-fix release (February 5, 2026) that fixes a regression from 4.2.9.Final, including io_uring updates, DNS improvements, and performance fixes. The release introduces no new security advisories. Earlier 4.2.x versions include fixes for CVE-2025-55163, CVE-2025-58057, CVE-2025-58056, CVE-2025-59419, and CVE-2025-67735, all of which are carried forward in 4.2.10.Final. The upgrade is sound.

plugins/arrow-flight-rpc/licenses/netty-transport-native-unix-common-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

Valid SHA-1 checksum format. The hash is consistent with the same artifact in modules/transport-netty4/licenses/.

test/framework/licenses/netty-pkitesting-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

Valid SHA-1 checksum for the test framework PKI testing artifact.

plugins/transport-reactor-netty4/licenses/netty-codec-classes-quic-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

Valid SHA-1 checksum format for QUIC codec classes.

modules/transport-netty4/licenses/netty-transport-native-unix-common-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

Valid SHA-1 checksum, consistent with the same artifact in plugins/arrow-flight-rpc/licenses/.

plugins/transport-reactor-netty4/licenses/netty-codec-base-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

Valid SHA-1 checksum format for the codec base artifact.

modules/transport-netty4/licenses/netty-codec-native-quic-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

Valid SHA-1 checksum format for the native QUIC codec artifact.

plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.10.Final-linux-aarch_64.jar.sha1 (1)

1-1: SHA-1 checksum is correct and matches Maven Central.

The checksum has been verified against the official Netty 4.2.10.Final artifact on Maven Central and matches exactly. All platform variants of netty-codec-native-quic (linux-aarch_64, linux-x86_64, osx-aarch_64, osx-x86_64, windows-x86_64) are also correctly checksummed.

plugins/arrow-flight-rpc/licenses/netty-codec-http2-4.2.10.Final.jar.sha1 (2)

1-1: Verify that existing Netty-dependent tests pass with the 4.2.10 upgrade.

The PR checklist shows testing unconfirmed. While comprehensive test infrastructure already exists for transport-netty4, reactor-netty4, and arrow-flight-rpc modules, integration test results should be documented to ensure the Netty upgrade maintains HTTP/2 and HTTP/3 compatibility across these modules.


1-1: SHA-1 checksum is valid and version is secure. The netty-codec-http2-4.2.10.Final.jar.sha1 checksum (ce03862f1ce5e4bd5a8af688ac9f5146a8192867) matches Maven Central. Netty 4.2.10.Final (Feb 5, 2026) is not affected by any known CVEs in the 4.2.x line; all identified vulnerabilities (CVE-2025-55163, CVE-2025-58056, CVE-2025-58057, CVE-2025-59419) were fixed in earlier releases.

modules/transport-netty4/licenses/netty-resolver-4.2.10.Final.jar.sha1 (1)

1-1: SHA-1 checksum format is valid.

The checksum follows the expected 40-character hexadecimal format for SHA-1.

plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.10.Final-windows-x86_64.jar.sha1 (1)

1-1: SHA-1 checksum format is valid.

The checksum follows the expected 40-character hexadecimal format for SHA-1.

plugins/arrow-flight-rpc/licenses/netty-codec-compression-4.2.10.Final.jar.sha1 (1)

1-1: SHA-1 checksum format is valid.

The checksum follows the expected 40-character hexadecimal format for SHA-1.

plugins/ingestion-kinesis/licenses/netty-transport-4.2.10.Final.jar.sha1 (1)

1-1: SHA-1 checksum format is valid.

The checksum follows the expected 40-character hexadecimal format for SHA-1.

libs/netty4/licenses/netty-codec-classes-quic-4.2.10.Final.jar.sha1 (1)

1-1: SHA-1 checksum format is valid.

The checksum follows the expected 40-character hexadecimal format for SHA-1.

plugins/arrow-flight-rpc/licenses/netty-codec-base-4.2.10.Final.jar.sha1 (1)

1-1: SHA-1 checksum format is valid.

The checksum follows the expected 40-character hexadecimal format for SHA-1.

plugins/repository-s3/licenses/netty-handler-4.2.10.Final.jar.sha1 (1)

1-1: Netty 4.2.10.Final checksum is valid and version is secure.

The SHA-1 checksum matches Maven Central's official artifact. Netty 4.2.10.Final (released 2026-02-05) includes patches for all known 4.2.x CVEs, including CVE-2025-67735 (CRLF injection), CVE-2025-58056 (HTTP request smuggling), and CVE-2025-55163 (HTTP/2 DDoS). No security advisories currently affect this version.

plugins/repository-azure/licenses/netty-transport-native-unix-common-4.2.10.Final.jar.sha1 (1)

1-1: Checksum file addition looks good.

plugins/repository-s3/licenses/netty-codec-http2-4.2.10.Final.jar.sha1 (1)

1-1: Checksum file addition looks good.

plugins/repository-hdfs/licenses/netty-all-4.2.10.Final.jar.sha1 (1)

1-1: Checksum file addition looks good.

plugins/ingestion-kinesis/licenses/netty-transport-native-unix-common-4.2.10.Final.jar.sha1 (1)

1-1: Checksum file addition looks good.

plugins/transport-reactor-netty4/licenses/netty-handler-4.2.10.Final.jar.sha1 (1)

1-1: Checksum file addition looks good.

plugins/transport-reactor-netty4/licenses/netty-resolver-dns-4.2.10.Final.jar.sha1 (1)

1-1: Checksum file addition looks good.

plugins/repository-s3/licenses/netty-transport-classes-epoll-4.2.10.Final.jar.sha1 (1)

1-1: Checksum file addition looks good.

plugins/repository-s3/licenses/netty-codec-http-4.2.10.Final.jar.sha1 (1)

1-1: Checksum is consistent across modules.

The SHA-1 hash 93e6b3df76177423742ed10d48612b59e46f0c8c for netty-codec-http-4.2.10.Final.jar matches the same artifact in other modules (transport-reactor-netty4, ingestion-kinesis, transport-netty4).

plugins/transport-reactor-netty4/licenses/netty-codec-http-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

Checksum matches the same artifact across other modules.

plugins/ingestion-kinesis/licenses/netty-transport-classes-epoll-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

Valid SHA-1 checksum for the epoll transport classes artifact.

plugins/ingestion-kinesis/licenses/netty-codec-http-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

Checksum is consistent with the same artifact in other modules.

plugins/repository-s3/licenses/netty-common-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

Valid SHA-1 checksum for netty-common artifact.

plugins/transport-reactor-netty4/licenses/netty-resolver-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

Valid SHA-1 checksum for netty-resolver artifact.

modules/transport-netty4/licenses/netty-codec-http-4.2.10.Final.jar.sha1 (1)

1-1: Checksum verified against Maven Central.

The SHA-1 93e6b3df76177423742ed10d48612b59e46f0c8c is consistent across all modules and matches the official Netty 4.2.10.Final release on Maven Central.

plugins/arrow-flight-rpc/licenses/netty-codec-http-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

The SHA1 checksum is in valid format (40 hex characters) and aligns with the Netty 4.2.10.Final upgrade.

modules/transport-netty4/licenses/netty-codec-base-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

Valid SHA1 checksum format for the Netty codec-base artifact.

libs/netty4/licenses/netty-common-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

Valid SHA1 checksum format for the Netty common artifact.

plugins/arrow-flight-rpc/licenses/netty-codec-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

Valid SHA1 checksum format for the Netty codec artifact.

plugins/transport-reactor-netty4/licenses/netty-transport-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

Valid SHA1 checksum format for the Netty transport artifact.

plugins/arrow-flight-rpc/licenses/netty-handler-4.2.10.Final.jar.sha1 (1)

1-1: LGTM!

Valid SHA1 checksum format for the Netty handler artifact.

gradle/libs.versions.toml (1)

40-40: Netty 4.2.10.Final is a valid release with no reported high/critical vulnerabilities.

The version exists on Maven Central and is properly published in the version metadata. The update from 4.2.9.Final is legitimate.

plugins/ingestion-kinesis/licenses/netty-codec-base-4.2.10.Final.jar.sha1 (1)

1-1: Checksum addition looks correct.

plugins/repository-azure/licenses/netty-codec-socks-4.2.10.Final.jar.sha1 (1)

1-1: Checksum addition looks correct.

plugins/arrow-flight-rpc/licenses/netty-buffer-4.2.10.Final.jar.sha1 (1)

1-1: Checksum addition looks correct.

plugins/ingestion-kinesis/licenses/netty-handler-4.2.10.Final.jar.sha1 (1)

1-1: Checksum addition looks correct.

modules/transport-netty4/licenses/netty-codec-native-quic-4.2.10.Final-osx-aarch_64.jar.sha1 (1)

1-1: Checksum addition looks correct.

modules/transport-netty4/licenses/netty-codec-native-quic-4.2.10.Final-linux-x86_64.jar.sha1 (1)

1-1: Checksum addition looks correct.

plugins/transport-reactor-netty4/licenses/netty-codec-4.2.10.Final.jar.sha1 (1)

1-1: Checksum addition looks correct.

plugins/transport-reactor-netty4/licenses/netty-codec-native-quic-4.2.10.Final.jar.sha1 (1)

1-1: Checksum addition looks good.

plugins/arrow-flight-rpc/licenses/netty-resolver-4.2.10.Final.jar.sha1 (1)

1-1: Checksum addition looks good.

plugins/transport-reactor-netty4/licenses/netty-buffer-4.2.10.Final.jar.sha1 (1)

1-1: Checksum addition looks good.

✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.

Signed-off-by: Andriy Redko <drreta@gmail.com>
@reta reta added the skip-diff-analyzer Maintainer to skip code-diff-analyzer check, after reviewing issues in AI analysis. label Feb 10, 2026
@github-actions
Copy link
Contributor

❌ Gradle check result for a99d305: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

@github-actions
Copy link
Contributor

❕ Gradle check result for a99d305: UNSTABLE

Please review all flaky tests that succeeded after retry and create an issue if one does not already exist to track the flaky failure.

@codecov
Copy link

codecov bot commented Feb 10, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.36%. Comparing base (ac911ed) to head (a99d305).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files
@@             Coverage Diff              @@
##               main   #20586      +/-   ##
============================================
+ Coverage     73.28%   73.36%   +0.08%     
- Complexity    72143    72198      +55     
============================================
  Files          5798     5798              
  Lines        329791   329816      +25     
  Branches      47531    47538       +7     
============================================
+ Hits         241681   241972     +291     
+ Misses        68786    68473     -313     
- Partials      19324    19371      +47     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@reta reta merged commit 42abf94 into opensearch-project:main Feb 10, 2026
45 of 62 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file skip-diff-analyzer Maintainer to skip code-diff-analyzer check, after reviewing issues in AI analysis.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants