From 76847019bc62fd4843b2b8e2ac572c88a80cf8e0 Mon Sep 17 00:00:00 2001 From: Renn F Date: Tue, 13 Oct 2026 18:55:36 +0200 Subject: [PATCH 1/3] chore(deps): pin netty to 4.1.139.Final through the netty BOM --- CHANGELOG.md | 7 +++ build.gradle.kts | 1 + gradle.lockfile | 19 +++--- gradle/libs.versions.toml | 2 + osv-scanner.toml | 59 ------------------- .../com/guardcore/ktor/GuardCoreMiddleware.kt | 6 +- .../com/guardcore/ktor/GuardCorePlugin.kt | 2 +- 7 files changed, 24 insertions(+), 72 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7dc8c50..4056aa3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,13 @@ All notable changes to this project are documented in this file. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). +## Unreleased + +### Changed + +- Dependencies: netty is pinned to 4.1.139.Final through `platform(io.netty:netty-bom)`. lettuce-core 6.8.2 declares netty 4.1.125, which carries twelve advisories fixed by 4.1.137 at the latest. The pin is declared here as well as in the guard-core-jvm facade, so this lockfile stays the same whichever engine revision the build resolves. All twelve netty osv-scanner suppressions are removed. +- Two stale code comments that said the guard-agent-jvm artifact "ships in W7" now describe the injected `agentHandler` (`GuardCorePlugin.kt`, `GuardCoreMiddleware.kt`). + ## [1.0.0] - 2026-10-13 ### Changed (release train) diff --git a/build.gradle.kts b/build.gradle.kts index 7fa6e83..6556cef 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -43,6 +43,7 @@ dependencies { // repositories in composite-OFF (release) mode. ktor-guard wires the // facade only; no security logic lives here. api(libs.guard.core) + implementation(platform(libs.netty.bom)) testImplementation(libs.ktor.server.test.host) testImplementation(libs.kotlin.test) diff --git a/gradle.lockfile b/gradle.lockfile index 4c9c409..a791056 100644 --- a/gradle.lockfile +++ b/gradle.lockfile @@ -73,15 +73,16 @@ io.ktor:ktor-websocket-serialization:3.6.0=testCompileClasspath,testRuntimeClass io.ktor:ktor-websockets-jvm:3.6.0=compileClasspath,testCompileClasspath,testRuntimeClasspath io.ktor:ktor-websockets:3.6.0=compileClasspath,testCompileClasspath,testRuntimeClasspath io.lettuce:lettuce-core:6.8.2.RELEASE=compileClasspath,testCompileClasspath,testRuntimeClasspath -io.netty:netty-buffer:4.1.125.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath -io.netty:netty-codec-dns:4.1.125.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath -io.netty:netty-codec:4.1.125.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath -io.netty:netty-common:4.1.125.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath -io.netty:netty-handler:4.1.125.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath -io.netty:netty-resolver-dns:4.1.125.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath -io.netty:netty-resolver:4.1.125.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath -io.netty:netty-transport-native-unix-common:4.1.125.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath -io.netty:netty-transport:4.1.125.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath +io.netty:netty-bom:4.1.139.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath +io.netty:netty-buffer:4.1.139.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath +io.netty:netty-codec-dns:4.1.139.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath +io.netty:netty-codec:4.1.139.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath +io.netty:netty-common:4.1.139.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath +io.netty:netty-handler:4.1.139.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath +io.netty:netty-resolver-dns:4.1.139.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath +io.netty:netty-resolver:4.1.139.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath +io.netty:netty-transport-native-unix-common:4.1.139.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath +io.netty:netty-transport:4.1.139.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath io.projectreactor:reactor-core:3.6.6=compileClasspath,testCompileClasspath,testRuntimeClasspath net.bytebuddy:byte-buddy-agent:1.17.6=testRuntimeClasspath net.bytebuddy:byte-buddy:1.17.6=testRuntimeClasspath diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 62ff5c7..e039120 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -3,6 +3,7 @@ kotlin = "2.4.21" coroutines = "1.11.0" ktor = "3.6.0" guardCore = "4.3.3" +netty = "4.1.139.Final" spotless = "8.10.4" detekt = "1.23.8" @@ -10,6 +11,7 @@ detekt = "1.23.8" kotlin-stdlib = { module = "org.jetbrains.kotlin:kotlin-stdlib", version.ref = "kotlin" } kotlinx-coroutines-core = { module = "org.jetbrains.kotlinx:kotlinx-coroutines-core", version.ref = "coroutines" } guard-core = { module = "com.guard-core:guard-core", version.ref = "guardCore" } +netty-bom = { module = "io.netty:netty-bom", version.ref = "netty" } ktor-server-core = { module = "io.ktor:ktor-server-core", version.ref = "ktor" } ktor-server-test-host = { module = "io.ktor:ktor-server-test-host", version.ref = "ktor" } kotlin-test = { module = "org.jetbrains.kotlin:kotlin-test", version.ref = "kotlin" } diff --git a/osv-scanner.toml b/osv-scanner.toml index 55e0fe4..2026dd7 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -5,62 +5,3 @@ # reason, and each names its removal trigger. Nothing is disabled wholesale. # When the triggering dependency moves, delete the matching entries in the # same PR - the audit must fail again the moment a suppression is stale. - -# io.netty 4.1.125.Final is the transitive graph of io.lettuce:lettuce-core -# 6.8.2.RELEASE, the pinned Redis client of the facade the adapter ships. The -# adapter itself wires only Ktor server-core (CIO); the netty artifacts ride -# the facade's Redis surface, and Guard usage connects Lettuce to a single -# user-configured Redis endpoint, so the affected netty surfaces (SniHandler -# traversal, compressed-decode paths, DNS-resolver spoofing) are not -# attacker-reachable in this deployment shape. The lettuce 6.8.2 upgrade -# cleared GHSA-3p8m-j85q-pgmj only; each entry below goes once a lettuce -# upgrade brings a fixed netty (consumers on a Boot BOM already resolve patched netty via -# their own dependency management). - -[[IgnoredVulns]] -id = "GHSA-c4c3-7fpv-j4q5" -reason = "netty-handler 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; single-endpoint Redis usage, SniHandler path not attacker-reachable; removed once the lettuce graph reaches a fixed netty" - -[[IgnoredVulns]] -id = "GHSA-558v-64gr-wgg4" -reason = "netty-codec 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; single-endpoint Redis usage, codec path not attacker-reachable; removed once the lettuce graph reaches a fixed netty" - -[[IgnoredVulns]] -id = "GHSA-5pvg-856g-cp85" -reason = "netty-resolver-dns 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; no DNS-resolver usage (single configured endpoint); removed once the lettuce graph reaches a fixed netty" - -[[IgnoredVulns]] -id = "GHSA-676x-f7gg-47vc" -reason = "netty-resolver-dns 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; no DNS-resolver usage (single configured endpoint); removed once the lettuce graph reaches a fixed netty" - -[[IgnoredVulns]] -id = "GHSA-3qp7-7mw8-wx86" -reason = "netty-handler 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; single-endpoint Redis usage, handler path not attacker-reachable; removed once the lettuce graph reaches a fixed netty" - -[[IgnoredVulns]] -id = "GHSA-c653-97m9-rcg9" -reason = "netty-handler 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; single-endpoint Redis usage, handler path not attacker-reachable; removed once the lettuce graph reaches a fixed netty" - -[[IgnoredVulns]] -id = "GHSA-x4gw-5cx5-pgmh" -reason = "netty-handler 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; single-endpoint Redis usage, handler path not attacker-reachable; removed once the lettuce graph reaches a fixed netty" - -[[IgnoredVulns]] -id = "GHSA-cm33-6792-r9fm" -reason = "netty-codec-dns 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; no DNS-resolver usage (single configured endpoint); removed once the lettuce graph reaches a fixed netty" - -[[IgnoredVulns]] -id = "GHSA-mj4r-2hfc-f8p6" -reason = "netty-codec 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; single-endpoint Redis usage, codec path not attacker-reachable; removed once the lettuce graph reaches a fixed netty" - -[[IgnoredVulns]] -id = "GHSA-fccg-mwvh-qqg4" -reason = "netty-handler 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; single-endpoint Redis usage, handler path not attacker-reachable; removed once the lettuce graph reaches a fixed netty" - -[[IgnoredVulns]] -id = "GHSA-xmv7-r254-6q78" -reason = "netty-resolver-dns 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; no DNS-resolver usage (single configured endpoint); removed once the lettuce graph reaches a fixed netty" - -[[IgnoredVulns]] -id = "GHSA-mfg7-5gfp-c4w3" -reason = "netty-codec-dns 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; no DNS-resolver usage (single configured endpoint); removed once the lettuce graph reaches a fixed netty" diff --git a/src/main/kotlin/com/guardcore/ktor/GuardCoreMiddleware.kt b/src/main/kotlin/com/guardcore/ktor/GuardCoreMiddleware.kt index 31d470e..b88e129 100644 --- a/src/main/kotlin/com/guardcore/ktor/GuardCoreMiddleware.kt +++ b/src/main/kotlin/com/guardcore/ktor/GuardCoreMiddleware.kt @@ -161,9 +161,9 @@ public class GuardCoreMiddleware( behavioralProcessor = contexts.behavioralProcessor if (config.enableAgent && injectedAgentHandler == null) { - // The guard-agent-jvm artifact ships in W7 (specs/impl/jvm.md family table); until it - // lands, an injected handler is the only agent source. Mirror the reference - // `_on_agent_init_failed` degrade path (middleware.py:301). + // The adapter never builds the agent itself: an injected guard-agent-jvm handler is the + // only agent source. Mirror the reference `_on_agent_init_failed` degrade path + // (middleware.py:301). val exc = IllegalStateException( "Agent enabled but no agent handler was provided. Install guard-agent-jvm and " + diff --git a/src/main/kotlin/com/guardcore/ktor/GuardCorePlugin.kt b/src/main/kotlin/com/guardcore/ktor/GuardCorePlugin.kt index 3a02fe7..bae48f0 100644 --- a/src/main/kotlin/com/guardcore/ktor/GuardCorePlugin.kt +++ b/src/main/kotlin/com/guardcore/ktor/GuardCorePlugin.kt @@ -59,7 +59,7 @@ public class GuardCorePluginConfig { */ public var decorator: GuardRouteDecorator? = null - /** The guard-agent-jvm handler; the agent family artifact ships in W7. */ + /** The guard-agent-jvm handler, e.g. `GuardAgentTelemetry(agent)` from guard-agent-jvm. */ public var agentHandler: AgentHandlerProtocol? = null /** From 5cd5ce8011db0f344d13f577076aa9cfb582c4db Mon Sep 17 00:00:00 2001 From: Renn F Date: Tue, 13 Oct 2026 19:02:34 +0200 Subject: [PATCH 2/3] docs(ktor): describe the null agent handler without the old W7 wording --- src/main/kotlin/com/guardcore/ktor/GuardCoreMiddleware.kt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/kotlin/com/guardcore/ktor/GuardCoreMiddleware.kt b/src/main/kotlin/com/guardcore/ktor/GuardCoreMiddleware.kt index b88e129..c476e83 100644 --- a/src/main/kotlin/com/guardcore/ktor/GuardCoreMiddleware.kt +++ b/src/main/kotlin/com/guardcore/ktor/GuardCoreMiddleware.kt @@ -59,7 +59,7 @@ public class GuardCoreMiddleware( /** The user-held per-route decorator adopted by this middleware (may be null). */ public val decorator: GuardRouteDecorator?, /** - * An externally supplied agent handler (guard-agent-jvm); null until the agent family ships. + * An externally supplied agent handler (guard-agent-jvm); null when none is installed. */ public val injectedAgentHandler: AgentHandlerProtocol?, ) : GuardMiddlewareProtocol { From 69c741a02175cff9c2b17b3473b4c9386eca1df3 Mon Sep 17 00:00:00 2001 From: Renn F Date: Tue, 13 Oct 2026 19:03:29 +0200 Subject: [PATCH 3/3] style(ktor): reflow the agent handler KDoc --- src/main/kotlin/com/guardcore/ktor/GuardCoreMiddleware.kt | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/main/kotlin/com/guardcore/ktor/GuardCoreMiddleware.kt b/src/main/kotlin/com/guardcore/ktor/GuardCoreMiddleware.kt index c476e83..44ee6cc 100644 --- a/src/main/kotlin/com/guardcore/ktor/GuardCoreMiddleware.kt +++ b/src/main/kotlin/com/guardcore/ktor/GuardCoreMiddleware.kt @@ -58,9 +58,7 @@ public class GuardCoreMiddleware( override val config: SecurityConfig, /** The user-held per-route decorator adopted by this middleware (may be null). */ public val decorator: GuardRouteDecorator?, - /** - * An externally supplied agent handler (guard-agent-jvm); null when none is installed. - */ + /** An externally supplied agent handler (guard-agent-jvm); null when none is installed. */ public val injectedAgentHandler: AgentHandlerProtocol?, ) : GuardMiddlewareProtocol { override val logger: Logger =