Merge pull request #1131 from Bhashinee/2201.2.x

[2201.2.x] Update the Netty version

ballerina/Ballerina.toml

@@ -1,7 +1,7 @@
 [package]
 org = "ballerina"
 name = "tcp"
-version = "1.4.0"
+version = "1.4.1"
 authors = ["Ballerina"]
 keywords = ["network", "socket", "service", "client"]
 repository = "https://github.com/ballerina-platform/module-ballerina-tcp"
@@ -12,27 +12,30 @@ distribution = "2201.2.0"
 [[platform.java11.dependency]]
 groupId = "io.ballerina.stdlib"
 artifactId = "tcp-native"
-version = "1.4.0"
-path = "../native/build/libs/tcp-native-1.4.0.jar"
+version = "1.4.1"
+path = "../native/build/libs/tcp-native-1.4.1-SNAPSHOT.jar"
 
 [[platform.java11.dependency]]
-path = "../test-utils/build/libs/tcp-test-utils-1.4.0.jar"
+path = "../test-utils/build/libs/tcp-test-utils-1.4.1-SNAPSHOT.jar"
 scope = "testOnly"
 
 [[platform.java11.dependency]]
-path = "./lib/netty-handler-4.1.77.Final.jar"
+path = "./lib/netty-handler-4.1.100.Final.jar"
 
 [[platform.java11.dependency]]
-path = "./lib/netty-buffer-4.1.77.Final.jar"
+path = "./lib/netty-buffer-4.1.100.Final.jar"
 
 [[platform.java11.dependency]]
-path = "./lib/netty-transport-4.1.77.Final.jar"
+path = "./lib/netty-transport-4.1.100.Final.jar"
 
 [[platform.java11.dependency]]
-path = "./lib/netty-common-4.1.77.Final.jar"
+path = "./lib/netty-common-4.1.100.Final.jar"
 
 [[platform.java11.dependency]]
-path = "./lib/netty-resolver-4.1.77.Final.jar"
+path = "./lib/netty-resolver-4.1.100.Final.jar"
 
 [[platform.java11.dependency]]
-path = "./lib/netty-codec-4.1.77.Final.jar"
+path = "./lib/netty-codec-4.1.100.Final.jar"
+
+[[platform.java11.dependency]]
+path = "./lib/netty-transport-native-unix-common-4.1.100.Final.jar"

ballerina/CompilerPlugin.toml

@@ -3,4 +3,4 @@ id = "tcp-plugin"
 class = "io.ballerina.stdlib.tcp.compiler.TcpCompilerPlugin"
 
 [[dependency]]
-path = "../compiler-plugin/build/libs/tcp-compiler-plugin-1.4.0.jar"
+path = "../compiler-plugin/build/libs/tcp-compiler-plugin-1.4.1-SNAPSHOT.jar"

ballerina/Dependencies.toml

@@ -21,7 +21,7 @@ modules = [
 [[package]]
 org = "ballerina"
 name = "io"
-version = "1.3.0"
+version = "1.3.1"
 scope = "testOnly"
 dependencies = [
 	{org = "ballerina", name = "jballerina.java"},
@@ -63,7 +63,7 @@ dependencies = [
 [[package]]
 org = "ballerina"
 name = "tcp"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
 	{org = "ballerina", name = "crypto"},
 	{org = "ballerina", name = "io"},
@@ -90,7 +90,7 @@ modules = [
 [[package]]
 org = "ballerina"
 name = "time"
-version = "2.2.2"
+version = "2.2.5"
 dependencies = [
 	{org = "ballerina", name = "jballerina.java"}
 ]

ballerina/build.gradle

@@ -87,6 +87,9 @@ dependencies {
     externalJars(group: 'io.netty', name: 'netty-codec', version: "${nettyVersion}") {
         transitive = false
     }
+    externalJars(group: 'io.netty', name: 'netty-transport-native-unix-common', version: "${nettyVersion}") {
+        transitive = false
+    }
 }
 
 task updateTomlFiles {

build-config/resources/Ballerina.toml

@@ -36,3 +36,6 @@ path = "./lib/[email protected]@.jar"
 
 [[platform.java11.dependency]]
 path = "./lib/[email protected]@.jar"
+
+[[platform.java11.dependency]]
+path = "./lib/[email protected]@.jar"

changelog.md

@@ -5,6 +5,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 ## [Unreleased]
 
+### Fixed
+- [Address netty vulnerability: CVE-2023-4586](https://github.com/ballerina-platform/ballerina-standard-library/issues/4908)
+
+## [1.2.0] - 2022-01-28
+
 - [Add resource code snippet generation code action for tooling](https://github.com/ballerina-platform/ballerina-standard-library/issues/2034)
 
 ## [swan-lake-beta5] - 2021-12-01

gradle.properties

@@ -1,13 +1,13 @@
 org.gradle.caching=true
 group=io.ballerina.stdlib
-version=1.4.0
+version=1.4.1-SNAPSHOT
 ballerinaLangVersion=2201.2.0
 puppycrawlCheckstyleVersion=8.18
 githubJohnrengelmanShadowVersion=5.2.0
 checkstyleToolVersion=7.8.2
 githubSpotbugsVersion=4.5.1
 testngVersion=7.4.0
-nettyVersion=4.1.77.Final
+nettyVersion=4.1.100.Final
 underCouchDownloadVersion=4.0.4
 researchgateReleaseVersion=2.8.0
 slf4jVersion=1.7.30

test-utils/build.gradle

@@ -26,6 +26,7 @@ dependencies {
     implementation group: 'io.netty', name: 'netty-buffer', version: "${nettyVersion}"
     implementation group: 'io.netty', name: 'netty-transport', version: "${nettyVersion}"
     implementation group: 'io.netty', name: 'netty-common', version: "${nettyVersion}"
+    implementation group: 'io.netty', name: 'netty-transport-native-unix-common', version: "${nettyVersion}"
     implementation group: 'org.ballerinalang', name: 'ballerina-lang', version: "${ballerinaLangVersion}"
     implementation group: 'org.ballerinalang', name: 'ballerina-runtime', version: "${ballerinaLangVersion}"
     implementation "org.slf4j:slf4j-jdk14:${slf4jVersion}"