Skip to content

netty + bouncycastle deps upgraded to pass Sonatype Repository Firewall compliance (DBeaver issue) - #161

Open
denixx wants to merge 1 commit into
aws:masterfrom
denixx:master
Open

netty + bouncycastle deps upgraded to pass Sonatype Repository Firewall compliance (DBeaver issue)#161
denixx wants to merge 1 commit into
aws:masterfrom
denixx:master

Conversation

@denixx

@denixx denixx commented Aug 28, 2026

Copy link
Copy Markdown

Upgraded software.amazon.awssdk:bom to 2.49.6 to bump netty.version to 4.1.136.Final to address CVE-2026-42581 (CVSS 9.8) and CVE-2026-42584 (CVSS 9.1), Upgraded org.bouncycastle deps to 1.85 to address CVE-2026-59646 (CVSS 8.7)

Description

We tried to use the driver in a network guarded by the Sonatype Repository Firewall, and having Netty 4.1.118 quarantined + BouncyCastle 1.84 also already quarantined.
This change bumps those libraries to safe version levels. This is not the last version bump, I feel, and later I will be bumping versions further.
Also, I changed the sourceCompatibility usage in a build.gradle file to support the build in gradle 9.7+.
I can see the project effectively has no tests that could be run locally.
I'll appreciate guidance to fulfill the requirements.

Motivation and Context

Sonatype Repository Firewall quarantines Netty 4.1.118 and BouncyCastle 1.84

Testing

I don't have an Amazon Redshift account, but I know who does. I checked in fast meetings that the driver works in DBeaver 26.1+.
We got schema browsing working and a response to a single-select on existing data.

Screenshots (if appropriate)

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Security compliance (fixing some vulnerabilities with high CVSS by version bump).

Checklist

  • Local run of mvn install succeeds
  • My code follows the code style of this project
  • My change requires a change to the Javadoc documentation
  • I have updated the Javadoc documentation accordingly
  • I have read the README document
  • I have added tests to cover my changes
  • All new and existing tests passed
  • A short description of the change has been added to the CHANGELOG

License

  • By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

…o 4.1.136.Final to address CVE-2026-42581 (CVSS 9.8) and CVE-2026-42584 (CVSS 9.1), Upgraded org.bouncycastle deps to 1.85 to address CVE-2026-59646 (CVSS 8.7)
@denixx

denixx commented Aug 28, 2026

Copy link
Copy Markdown
Author

Okay, it is ideally done now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant