From 80ba81ead32289cc5ee5aceb75950ca4e5a9c50e Mon Sep 17 00:00:00 2001
From: PJ Fanning <pjfanning@users.noreply.github.com>
Date: Fri, 19 Sep 2025 01:52:11 +0100
Subject: [PATCH] HADOOP-19689: bump netty to 4.1.127.Final due to
 CVE-2025-58057 (#7969) Contributed by PJ Fanning.

* HADOOP-19689: bump netty to 4.1.127.Final due to CVE-2025-58057

Signed-off-by: Shilun Fan <slfan1989@apache.org>

Update LICENSE-binary
---
 LICENSE-binary         | 60 +++++++++++++++++++++---------------------
 hadoop-project/pom.xml |  2 +-
 2 files changed, 31 insertions(+), 31 deletions(-)

diff --git a/LICENSE-binary b/LICENSE-binary
index 3ad4b30045d91..004b0bc5b1a36 100644
--- a/LICENSE-binary
+++ b/LICENSE-binary
@@ -257,36 +257,36 @@ io.grpc:grpc-netty:1.69.0
 io.grpc:grpc-protobuf:1.69.0
 io.grpc:grpc-protobuf-lite:1.69.0
 io.grpc:grpc-stub:1.69.0
-io.netty:netty-all:4.1.118.Final
-io.netty:netty-buffer:4.1.118.Final
-io.netty:netty-codec:4.1.118.Final
-io.netty:netty-codec-dns:4.1.118.Final
-io.netty:netty-codec-haproxy:4.1.118.Final
-io.netty:netty-codec-http:4.1.118.Final
-io.netty:netty-codec-http2:4.1.118.Final
-io.netty:netty-codec-memcache:4.1.118.Final
-io.netty:netty-codec-mqtt:4.1.118.Final
-io.netty:netty-codec-redis:4.1.118.Final
-io.netty:netty-codec-smtp:4.1.118.Final
-io.netty:netty-codec-socks:4.1.118.Final
-io.netty:netty-codec-stomp:4.1.118.Final
-io.netty:netty-codec-xml:4.1.118.Final
-io.netty:netty-common:4.1.118.Final
-io.netty:netty-handler:4.1.118.Final
-io.netty:netty-handler-proxy:4.1.118.Final
-io.netty:netty-resolver:4.1.118.Final
-io.netty:netty-resolver-dns:4.1.118.Final
-io.netty:netty-transport:4.1.118.Final
-io.netty:netty-transport-rxtx:4.1.118.Final
-io.netty:netty-transport-sctp:4.1.118.Final
-io.netty:netty-transport-udt:4.1.118.Final
-io.netty:netty-transport-classes-epoll:4.1.118.Final
-io.netty:netty-transport-native-unix-common:4.1.118.Final
-io.netty:netty-transport-classes-kqueue:4.1.118.Final
-io.netty:netty-resolver-dns-classes-macos:4.1.118.Final
-io.netty:netty-transport-native-epoll:4.1.118.Final
-io.netty:netty-transport-native-kqueue:4.1.118.Final
-io.netty:netty-resolver-dns-native-macos:4.1.118.Final
+io.netty:netty-all:4.1.127.Final
+io.netty:netty-buffer:4.1.127.Final
+io.netty:netty-codec:4.1.127.Final
+io.netty:netty-codec-dns:4.1.127.Final
+io.netty:netty-codec-haproxy:4.1.127.Final
+io.netty:netty-codec-http:4.1.127.Final
+io.netty:netty-codec-http2:4.1.127.Final
+io.netty:netty-codec-memcache:4.1.127.Final
+io.netty:netty-codec-mqtt:4.1.127.Final
+io.netty:netty-codec-redis:4.1.127.Final
+io.netty:netty-codec-smtp:4.1.127.Final
+io.netty:netty-codec-socks:4.1.127.Final
+io.netty:netty-codec-stomp:4.1.127.Final
+io.netty:netty-codec-xml:4.1.127.Final
+io.netty:netty-common:4.1.127.Final
+io.netty:netty-handler:4.1.127.Final
+io.netty:netty-handler-proxy:4.1.127.Final
+io.netty:netty-resolver:4.1.127.Final
+io.netty:netty-resolver-dns:4.1.127.Final
+io.netty:netty-transport:4.1.127.Final
+io.netty:netty-transport-rxtx:4.1.127.Final
+io.netty:netty-transport-sctp:4.1.127.Final
+io.netty:netty-transport-udt:4.1.127.Final
+io.netty:netty-transport-classes-epoll:4.1.127.Final
+io.netty:netty-transport-native-unix-common:4.1.127.Final
+io.netty:netty-transport-classes-kqueue:4.1.127.Final
+io.netty:netty-resolver-dns-classes-macos:4.1.127.Final
+io.netty:netty-transport-native-epoll:4.1.127.Final
+io.netty:netty-transport-native-kqueue:4.1.127.Final
+io.netty:netty-resolver-dns-native-macos:4.1.127.Final
 io.opencensus:opencensus-api:0.12.3
 io.opencensus:opencensus-contrib-grpc-metrics:0.12.3
 io.reactivex:rxjava:1.3.8
diff --git a/hadoop-project/pom.xml b/hadoop-project/pom.xml
index aa5342232900b..bc26cc949575f 100644
--- a/hadoop-project/pom.xml
+++ b/hadoop-project/pom.xml
@@ -142,7 +142,7 @@
     <jna.version>5.2.0</jna.version>
     <gson.version>2.9.0</gson.version>
     <metrics.version>3.2.4</metrics.version>
-    <netty4.version>4.1.118.Final</netty4.version>
+    <netty4.version>4.1.127.Final</netty4.version>
     <snappy-java.version>1.1.10.4</snappy-java.version>
     <lz4-java.version>1.7.1</lz4-java.version>