Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughThis change updates dependency versions for Netty (4.1.127.Final) and Commons Lang3 (3.18.0) in the parent POM, while modifying the feature build configuration to copy Commons Lang3 into a lib/launcher directory and include it via build resources instead of as a P2 bundle. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@poms/parent/pom.xml`:
- Line 794: The POM defines netty.version as 4.1.127.Final which is vulnerable;
update the netty.version Maven property to 4.1.129.Final (or later) to address
CVE-2025-67735, ensure any modules referencing the netty.version property
(search for netty.version) inherit the new value, keep netty-tcnative at
2.0.54.Final (it remains compatible), then rebuild and run tests to verify
compatibility.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 11083791-57e0-43f6-af61-4286cc419d22
📒 Files selected for processing (2)
features/org.wso2.msf4j.feature/pom.xmlpoms/parent/pom.xml
poms/parent/pom.xml
Outdated
|
|
||
| <!-- Dependencies --> | ||
| <netty.version>4.1.118.Final</netty.version> | ||
| <netty.version>4.1.127.Final</netty.version> |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check if Netty 4.1.127.Final exists on Maven Central
curl -s "https://repo1.maven.org/maven2/io/netty/netty-common/4.1.127.Final/netty-common-4.1.127.Final.pom" -o /dev/null -w "%{http_code}"
echo ""
# Check for Netty security advisories via GitHub
gh api graphql -f query='
{
securityVulnerabilities(first: 5, ecosystem: MAVEN, package: "io.netty:netty-common") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'Repository: wso2/msf4j
Length of output: 218
🌐 Web query:
Netty 4.1.127 security vulnerabilities CVE
💡 Result:
Netty 4.1.127.Final includes fixes for CVE-2025-58056 and CVE-2025-58057, which were addressed in the prior 4.1.125.Final release. It has a known vulnerability: CVE-2025-67735 (CRLF injection in HttpRequestEncoder), affecting versions before 4.1.129.Final. Upgrade to 4.1.129.Final or later to resolve it. No other CVEs specifically affect this exact version; older CVEs (e.g., request smuggling from 2019-2021) were fixed in much earlier releases.
Citations:
- 1: https://security.snyk.io/package/maven/io.netty%3Anetty-codec-http/4.1.127.Final
- 2: https://netty.io/news/2025/09/08/4-1-127-Final.html
- 3: GHSA-3p8m-j85q-pgmj
- 4: https://netty.io/news/2025/12/11/4-1-129-Final.html
- 5: https://nvd.nist.gov/vuln/detail/cve-2025-58057
- 6: https://nvd.nist.gov/vuln/detail/CVE-2025-58056
- 7: https://github.com/netty/netty/security/advisories
- 8: https://www.opencve.io/cve?vendor=netty
🌐 Web query:
netty-tcnative 2.0.54 compatible Netty versions
💡 Result:
netty-tcnative 2.0.54.Final is compatible with Netty 4.1.86.Final and likely other Netty 4.1.x versions around that time (Netty 4.1.80+). This is evidenced by real-world usage where users upgraded to netty-tcnative 2.0.54.Final alongside Netty 4.1.86.Final without inherent version incompatibility (though they faced a missing dependency issue resolved by adding netty-tcnative-classes). Netty treats tcnative as an internal dependency, and compatibility is generally maintained across minor releases within the 4.1 series, as per project maintainers' statements on backward compatibility for recent versions. No official compatibility matrix was found, but practical evidence and project practices support broad 4.1.x compatibility. For official confirmation, check the netty-tcnative GitHub tags or Netty BOM aligned versions.
Citations:
- 1: Issue encountered in tcnative 2.0.54.Final java.lang.ClassNotFoundException: io.netty.internal.tcnative.SSLPrivateKeyMethod netty/netty-tcnative#765
- 2: tcnative compatibility netty/netty-tcnative#366
- 3: https://github.com/netty/netty/wiki/Forked-Tomcat-Native
- 4: https://netty.io/wiki/requirements-for-4.x.html
🏁 Script executed:
# Check the pom.xml for context on netty-tcnative dependency
fd pom.xml | head -5Repository: wso2/msf4j
Length of output: 238
🏁 Script executed:
head -800 poms/parent/pom.xml | tail -20Repository: wso2/msf4j
Length of output: 1330
🏁 Script executed:
# Also check around line 795 to see netty-tcnative version
sed -n '790,800p' poms/parent/pom.xmlRepository: wso2/msf4j
Length of output: 667
Upgrade Netty to 4.1.129.Final or later to address CVE-2025-67735.
Netty 4.1.127.Final has a known vulnerability (CVE-2025-67735 - CRLF injection in HttpRequestEncoder). Upgrade to 4.1.129.Final or later. The netty-tcnative 2.0.54.Final dependency remains compatible with the updated version.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@poms/parent/pom.xml` at line 794, The POM defines netty.version as
4.1.127.Final which is vulnerable; update the netty.version Maven property to
4.1.129.Final (or later) to address CVE-2025-67735, ensure any modules
referencing the netty.version property (search for netty.version) inherit the
new value, keep netty-tcnative at 2.0.54.Final (it remains compatible), then
rebuild and run tests to verify compatibility.
CVE-2025-67735 is a CRLF injection vulnerability in HttpRequestEncoder affecting all Netty versions before 4.1.129.Final. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 participant
Purpose
$ subject
Goals
Approach
User stories
Release note
Documentation
Training
Certification
Marketing
Automation tests
Security checks
Samples
Related PRs
Migrations (if applicable)
Test environment
Learning
Summary by CodeRabbit