[rennf93]

lettuce-core 6.8.2 declares netty 4.1.125, which carries twelve advisories, all fixed by 4.1.137 at the latest. This pins netty through implementation(platform(io.netty:netty-bom:4.1.139.Final)) and removes the netty osv-scanner suppressions.

• Two stale code comments that said the guard-agent-jvm artifact "ships in W7" now describe the injected agentHandler.

Why it is pinned here and not only in the engine (Guard-Core/guard-core-jvm#47): the engine's new BOM enters this repo's graph, and a lockfile without io.netty:netty-bom fails resolution. That is what the engine PR's ecosystem gate hit. With the pin declared here too, this lockfile is identical whichever engine revision the build resolves.

Verified locally:

• Lockfile regenerated with --update-locks 'io.netty:*' against the pinned engine (2415a77), with ./gradlew build passing.
• The same lockfile, unchanged, with ./gradlew build passing against the engine branch of #47.
• GUARD_CORE_USE_COMPOSITE=false ./gradlew assemble (the publish path) passes.
• osv-scanner 2.6.0 reports no issues and no unused ignores.

This merges before guard-core-jvm#47 so that its ecosystem gate passes. Nothing is released.

[github-actions]

Thanks for opening your first pull request on ktor-guard!

Quick checklist before review (most of these are enforced by CI, but worth a glance):

• The PR body says Closes #N for an open issue (the issue-link check enforces it); chores take the no-issue label
• ./gradlew spotlessCheck detekt is clean
• ./gradlew build passes
• No blanket @Suppress in non-test code

See README.md for the adapter status. Welcome aboard - a maintainer will review shortly.