Security vulnerability reported for io.netty:netty-codec

[narayar]

Bug Report

Security vulnerability reported for io.netty:netty-codec
The latest io.lettuce:lettuce-core:5.2.2.RELEASE has a hard dependency on io.netty:netty-handler:4.1.45.Final. But it in turn depends on io.netty:netty-codec:4.1.45.Final which has the following security vulnerability reported on 4/8/2020

Please upgrade your lib to depend on the later versions of io.netty libs where the vulnerability is fixed.

Current Behavior

Stack trace

// your stack trace here;

Input Code

Input Code

// your code here;

Expected behavior/code

Environment

• Lettuce version(s): [e.g. 5.0.0.RELEASE, 4.2.2.Final]
• Redis version: [e.g. 4.0.9]

Possible Solution

Additional context

[narayar]

The following is the dependency tree for your latest version -

[mp911de]

Lettuce isn't exposing a netty server and it's not using any netty ZLib codecs so there's no vulnerability when using Lettuce. In any case, we upgraded to Netty 4.1.48 already a while ago (see #1259).

[narayar]

@mp911de I dont see 5.3.0 available in maven central (https://repo1.maven.org/maven2/io/lettuce/lettuce-core/). Is it coming anytime soon?