Skip to content

chore(deps): pin netty to 4.1.139.Final through the netty BOM #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rennf93 merged 3 commits into from
Oct 13, 2026
Merged

chore(deps): pin netty to 4.1.139.Final through the netty BOM #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7684701
chore(deps): pin netty to 4.1.139.Final through the netty BOM
rennf93 Oct 13, 2026
5cd5ce8
docs(ktor): describe the null agent handler without the old W7 wording
rennf93 Oct 13, 2026
69c741a
style(ktor): reflow the agent handler KDoc
rennf93 Oct 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,13 @@
All notable changes to this project are documented in this file. The format follows
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/).

## Unreleased

### Changed

- Dependencies: netty is pinned to 4.1.139.Final through `platform(io.netty:netty-bom)`. lettuce-core 6.8.2 declares netty 4.1.125, which carries twelve advisories fixed by 4.1.137 at the latest. The pin is declared here as well as in the guard-core-jvm facade, so this lockfile stays the same whichever engine revision the build resolves. All twelve netty osv-scanner suppressions are removed.
- Two stale code comments that said the guard-agent-jvm artifact "ships in W7" now describe the injected `agentHandler` (`GuardCorePlugin.kt`, `GuardCoreMiddleware.kt`).

## [1.0.0] - 2026-10-13

### Changed (release train)
Expand Down
1 change: 1 addition & 0 deletions build.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ dependencies {
// repositories in composite-OFF (release) mode. ktor-guard wires the
// facade only; no security logic lives here.
api(libs.guard.core)
implementation(platform(libs.netty.bom))

testImplementation(libs.ktor.server.test.host)
testImplementation(libs.kotlin.test)
Expand Down
19 changes: 10 additions & 9 deletions gradle.lockfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,15 +73,16 @@ io.ktor:ktor-websocket-serialization:3.6.0=testCompileClasspath,testRuntimeClass
io.ktor:ktor-websockets-jvm:3.6.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.ktor:ktor-websockets:3.6.0=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.lettuce:lettuce-core:6.8.2.RELEASE=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.netty:netty-buffer:4.1.125.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.netty:netty-codec-dns:4.1.125.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.netty:netty-codec:4.1.125.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.netty:netty-common:4.1.125.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.netty:netty-handler:4.1.125.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.netty:netty-resolver-dns:4.1.125.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.netty:netty-resolver:4.1.125.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.netty:netty-transport-native-unix-common:4.1.125.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.netty:netty-transport:4.1.125.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.netty:netty-bom:4.1.139.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.netty:netty-buffer:4.1.139.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.netty:netty-codec-dns:4.1.139.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.netty:netty-codec:4.1.139.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.netty:netty-common:4.1.139.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.netty:netty-handler:4.1.139.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.netty:netty-resolver-dns:4.1.139.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.netty:netty-resolver:4.1.139.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.netty:netty-transport-native-unix-common:4.1.139.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.netty:netty-transport:4.1.139.Final=compileClasspath,testCompileClasspath,testRuntimeClasspath
io.projectreactor:reactor-core:3.6.6=compileClasspath,testCompileClasspath,testRuntimeClasspath
net.bytebuddy:byte-buddy-agent:1.17.6=testRuntimeClasspath
net.bytebuddy:byte-buddy:1.17.6=testRuntimeClasspath
Expand Down
2 changes: 2 additions & 0 deletions gradle/libs.versions.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,15 @@ kotlin = "2.4.21"
coroutines = "1.11.0"
ktor = "3.6.0"
guardCore = "4.3.3"
netty = "4.1.139.Final"
spotless = "8.10.4"
detekt = "1.23.8"

[libraries]
kotlin-stdlib = { module = "org.jetbrains.kotlin:kotlin-stdlib", version.ref = "kotlin" }
kotlinx-coroutines-core = { module = "org.jetbrains.kotlinx:kotlinx-coroutines-core", version.ref = "coroutines" }
guard-core = { module = "com.guard-core:guard-core", version.ref = "guardCore" }
netty-bom = { module = "io.netty:netty-bom", version.ref = "netty" }
ktor-server-core = { module = "io.ktor:ktor-server-core", version.ref = "ktor" }
ktor-server-test-host = { module = "io.ktor:ktor-server-test-host", version.ref = "ktor" }
kotlin-test = { module = "org.jetbrains.kotlin:kotlin-test", version.ref = "kotlin" }
Expand Down
59 changes: 0 additions & 59 deletions osv-scanner.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,62 +5,3 @@
# reason, and each names its removal trigger. Nothing is disabled wholesale.
# When the triggering dependency moves, delete the matching entries in the
# same PR - the audit must fail again the moment a suppression is stale.

# io.netty 4.1.125.Final is the transitive graph of io.lettuce:lettuce-core
# 6.8.2.RELEASE, the pinned Redis client of the facade the adapter ships. The
# adapter itself wires only Ktor server-core (CIO); the netty artifacts ride
# the facade's Redis surface, and Guard usage connects Lettuce to a single
# user-configured Redis endpoint, so the affected netty surfaces (SniHandler
# traversal, compressed-decode paths, DNS-resolver spoofing) are not
# attacker-reachable in this deployment shape. The lettuce 6.8.2 upgrade
# cleared GHSA-3p8m-j85q-pgmj only; each entry below goes once a lettuce
# upgrade brings a fixed netty (consumers on a Boot BOM already resolve patched netty via
# their own dependency management).

[[IgnoredVulns]]
id = "GHSA-c4c3-7fpv-j4q5"
reason = "netty-handler 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; single-endpoint Redis usage, SniHandler path not attacker-reachable; removed once the lettuce graph reaches a fixed netty"

[[IgnoredVulns]]
id = "GHSA-558v-64gr-wgg4"
reason = "netty-codec 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; single-endpoint Redis usage, codec path not attacker-reachable; removed once the lettuce graph reaches a fixed netty"

[[IgnoredVulns]]
id = "GHSA-5pvg-856g-cp85"
reason = "netty-resolver-dns 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; no DNS-resolver usage (single configured endpoint); removed once the lettuce graph reaches a fixed netty"

[[IgnoredVulns]]
id = "GHSA-676x-f7gg-47vc"
reason = "netty-resolver-dns 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; no DNS-resolver usage (single configured endpoint); removed once the lettuce graph reaches a fixed netty"

[[IgnoredVulns]]
id = "GHSA-3qp7-7mw8-wx86"
reason = "netty-handler 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; single-endpoint Redis usage, handler path not attacker-reachable; removed once the lettuce graph reaches a fixed netty"

[[IgnoredVulns]]
id = "GHSA-c653-97m9-rcg9"
reason = "netty-handler 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; single-endpoint Redis usage, handler path not attacker-reachable; removed once the lettuce graph reaches a fixed netty"

[[IgnoredVulns]]
id = "GHSA-x4gw-5cx5-pgmh"
reason = "netty-handler 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; single-endpoint Redis usage, handler path not attacker-reachable; removed once the lettuce graph reaches a fixed netty"

[[IgnoredVulns]]
id = "GHSA-cm33-6792-r9fm"
reason = "netty-codec-dns 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; no DNS-resolver usage (single configured endpoint); removed once the lettuce graph reaches a fixed netty"

[[IgnoredVulns]]
id = "GHSA-mj4r-2hfc-f8p6"
reason = "netty-codec 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; single-endpoint Redis usage, codec path not attacker-reachable; removed once the lettuce graph reaches a fixed netty"

[[IgnoredVulns]]
id = "GHSA-fccg-mwvh-qqg4"
reason = "netty-handler 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; single-endpoint Redis usage, handler path not attacker-reachable; removed once the lettuce graph reaches a fixed netty"

[[IgnoredVulns]]
id = "GHSA-xmv7-r254-6q78"
reason = "netty-resolver-dns 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; no DNS-resolver usage (single configured endpoint); removed once the lettuce graph reaches a fixed netty"

[[IgnoredVulns]]
id = "GHSA-mfg7-5gfp-c4w3"
reason = "netty-codec-dns 4.1.125 transitive via the facade's pinned lettuce-core 6.8.2; no DNS-resolver usage (single configured endpoint); removed once the lettuce graph reaches a fixed netty"
10 changes: 4 additions & 6 deletions src/main/kotlin/com/guardcore/ktor/GuardCoreMiddleware.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,9 +58,7 @@ public class GuardCoreMiddleware(
override val config: SecurityConfig,
/** The user-held per-route decorator adopted by this middleware (may be null). */
public val decorator: GuardRouteDecorator?,
/**
* An externally supplied agent handler (guard-agent-jvm); null until the agent family ships.
*/
/** An externally supplied agent handler (guard-agent-jvm); null when none is installed. */
public val injectedAgentHandler: AgentHandlerProtocol?,
) : GuardMiddlewareProtocol {
override val logger: Logger =
Expand Down Expand Up @@ -161,9 +159,9 @@ public class GuardCoreMiddleware(
behavioralProcessor = contexts.behavioralProcessor

if (config.enableAgent && injectedAgentHandler == null) {
// The guard-agent-jvm artifact ships in W7 (specs/impl/jvm.md family table); until it
// lands, an injected handler is the only agent source. Mirror the reference
// `_on_agent_init_failed` degrade path (middleware.py:301).
// The adapter never builds the agent itself: an injected guard-agent-jvm handler is the
// only agent source. Mirror the reference `_on_agent_init_failed` degrade path
// (middleware.py:301).
val exc =
IllegalStateException(
"Agent enabled but no agent handler was provided. Install guard-agent-jvm and " +
Expand Down
2 changes: 1 addition & 1 deletion src/main/kotlin/com/guardcore/ktor/GuardCorePlugin.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ public class GuardCorePluginConfig {
*/
public var decorator: GuardRouteDecorator? = null

/** The guard-agent-jvm handler; the agent family artifact ships in W7. */
/** The guard-agent-jvm handler, e.g. `GuardAgentTelemetry(agent)` from guard-agent-jvm. */
public var agentHandler: AgentHandlerProtocol? = null

/**
Expand Down
Loading