Skip to content

Upgrade netty and guava libraries - #473

Open
wfouche wants to merge 2 commits into
jython:masterfrom
wfouche:cve/netty-guava
Open

Upgrade netty and guava libraries#473
wfouche wants to merge 2 commits into
jython:masterfrom
wfouche:cve/netty-guava

Conversation

@wfouche

@wfouche wfouche commented Nov 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Closes #472

version="4.1.140.Final"

libnames=("buffer" "codec" "common" "handler" "resolver" "transport" "transport-native-unix-common")

for libname in "${libnames[@]}"; do
    echo "Current library: $libname"
    wget https://repo1.maven.org/maven2/io/netty/netty-$libname/$version/netty-$libname-$version.jar
    sleep 1
done

@jeff5

jeff5 commented Nov 14, 2026

Copy link
Copy Markdown
Member

That's good, apart from the delay to 2.7.5. We would have to roll an rc2, and that uses up some more of our monthly capacity at Sonatype. Tagging for 2.7.6 is the only alternative.

We learned in #349 that one has to test this kind of thing with -u network and (I think) the CI doesn't. Did you try that, and on what platform(s)? I will test on Windows.

@wfouche

wfouche commented Nov 14, 2026

Copy link
Copy Markdown
Member Author

That's good, apart from the delay to 2.7.5.

I'm happy for this to wait until 2.7.6.

@jeff5

jeff5 commented Nov 14, 2026

Copy link
Copy Markdown
Member

It worked for me on Windows. It seems low risk to apply and puts us three CVEs ahead for no more effort than another go round the release process. Thinking ...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

CVEs reported for jython-2.7.5-rc1

2 participants

@wfouche @jeff5