`netty-codec-http` is flagged by https://github.com/advisories/GHSA-fghv-69vj-qj49 `netty-codec-compression` is flagged by https://github.com/advisories/GHSA-3p8m-j85q-pgmj For the fixed version 4.2.5 there is already a merged pull request: https://github.com/firebase/firebase-admin-java/pull/1127 Are there plans to release this version yet?