Repository navigation
fix(deps): bump netty to 4.1.136.Final and micrometer to 1.15.12 (#1528) - #1598
Merged
Merged
Conversation
Resolves the remaining high-severity Java CVEs flagged in #1528: - netty 4.1.135.Final -> 4.1.136.Final CVE-2026-56819 (netty-codec-http2), CVE-2026-55831/55833/56745 (netty-codec-http), CVE-2026-59901 (netty-codec) - micrometer-core 1.15.11 -> 1.15.12 via revMicrometer + a BOM override CVE-2026-40983, CVE-2026-40984 micrometer-core was resolved to 1.15.11 by the Spring Boot BOM while the explicitly-declared registry artifacts were pinned at revMicrometer=1.14.6. Bumping revMicrometer to 1.15.12 and adding ext['micrometer.version'] = revMicrometer keeps core and the registries aligned on the patched version.
v1r3n
approved these changes
Sep 2, 2026
Bumping the whole micrometer family to 1.15.12 pulled micrometer-registry-otlp 1.15.x, which brings opentelemetry-proto 1.5.0-alpha. That gencode requires protobuf-java 4.x (com.google.protobuf.RuntimeVersion$RuntimeDomain), but protobuf-java is pinned to 3.25.5 (#964, GraalVM), so OtlpMeterRegistry failed at runtime with NoClassDefFoundError and OtlpMetricsConfigurationTest broke. Decouple the versions: micrometer-core still bumps to 1.15.12 (the CVE fix, via the BOM property), while the registry artifacts (otlp/cloudwatch2/azure-monitor/ prometheus) stay on 1.14.6 -> opentelemetry-proto 1.3.2-alpha (protobuf 3.x). This matches the working main baseline for the registries.
matteius
pushed a commit
to opensensor/conductor
that referenced
this pull request
Sep 13, 2026
…ductor-oss#1528) (conductor-oss#1598) * fix(deps): bump netty to 4.1.136.Final and micrometer to 1.15.12 (conductor-oss#1528) Resolves the remaining high-severity Java CVEs flagged in conductor-oss#1528: - netty 4.1.135.Final -> 4.1.136.Final CVE-2026-56819 (netty-codec-http2), CVE-2026-55831/55833/56745 (netty-codec-http), CVE-2026-59901 (netty-codec) - micrometer-core 1.15.11 -> 1.15.12 via revMicrometer + a BOM override CVE-2026-40983, CVE-2026-40984 micrometer-core was resolved to 1.15.11 by the Spring Boot BOM while the explicitly-declared registry artifacts were pinned at revMicrometer=1.14.6. Bumping revMicrometer to 1.15.12 and adding ext['micrometer.version'] = revMicrometer keeps core and the registries aligned on the patched version. * fix(deps): keep micrometer registries on 1.14.6 to preserve protobuf 3.x Bumping the whole micrometer family to 1.15.12 pulled micrometer-registry-otlp 1.15.x, which brings opentelemetry-proto 1.5.0-alpha. That gencode requires protobuf-java 4.x (com.google.protobuf.RuntimeVersion$RuntimeDomain), but protobuf-java is pinned to 3.25.5 (conductor-oss#964, GraalVM), so OtlpMeterRegistry failed at runtime with NoClassDefFoundError and OtlpMetricsConfigurationTest broke. Decouple the versions: micrometer-core still bumps to 1.15.12 (the CVE fix, via the BOM property), while the registry artifacts (otlp/cloudwatch2/azure-monitor/ prometheus) stay on 1.14.6 -> opentelemetry-proto 1.3.2-alpha (protobuf 3.x). This matches the working main baseline for the registries. (cherry picked from commit 8d4c376)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Knocks out the remaining high-severity Java CVEs flagged in #1528 (the residual set after #1490/#1502). This is the "low-hanging fruit" Peter identified.
Changes
4.1.135.Final→4.1.136.Final(BOM override inspringboot-bom-overrides.gradle)CVE-2026-56819— netty-codec-http2CVE-2026-55831,CVE-2026-55833,CVE-2026-56745— netty-codec-httpCVE-2026-59901— netty-codec1.15.11→1.15.12CVE-2026-40983,CVE-2026-40984revMicrometerto1.15.12and addedext['micrometer.version'] = revMicrometer.Why the micrometer change is two-part
micrometer-corewas pulled in transitively and pinned by the Spring Boot BOM to1.15.11, while the explicitly-declared registry artifacts (cloudwatch2 / azure-monitor / prometheus / otlp) were onrevMicrometer = 1.14.6. That left core and the registries on different minor lines. Settingext['micrometer.version'] = revMicrometerand bumpingrevMicrometerto1.15.12patches core and realigns the whole micrometer family on one version.Verification
Resolved against
:conductor-serverruntimeClasspath with GradledependencyInsight:io.micrometer:micrometer-core:1.15.11 -> 1.15.12 (selected by rule)io.netty:netty-codec,netty-codec-http,netty-codec-http2all resolve to4.1.136.FinalcompileJavapasses for every module that consumes micrometer (conductor-core,conductor-server,conductor-redis-configuration,conductor-scheduler-core).Not addressed here (see #1528)
CVE-2025-37731) — there is no fix on the 7.x line (7.17.29 is the last 7.x). The ES8 build path already uses8.19.11(patched). Moving the default off ES7 is a separate policy decision, not a version bump.CVE-2026-13221,CVE-2026-57432,CVE-2026-58050,CVE-2026-60005) — these are Debian base-image OS packages, not Java deps. The Dockerfile already runsapt-get updateat build time, so they resolve when Debian publishes patched packages (most are fresh 2026 CVEs with no upstream fix yet).And i did not look into (just acknowledging): A lighter base image, per Peter's question 2.
Closes the netty + micrometer portion of #1528.