From b018588c141fb7f1512a5c0f5924d23e48ba7a25 Mon Sep 17 00:00:00 2001
From: chrislu <chris.lu@gmail.com>
Date: Sat, 22 Nov 2025 14:22:57 -0800
Subject: [PATCH] security: upgrade Netty to 4.1.124.Final (patched version)

- Upgrade from 4.1.118.Final to 4.1.124.Final
- Fixes GHSA-prj3-ccx8-p6x4: MadeYouReset HTTP/2 DDoS vulnerability
- 4.1.124.Final is the confirmed patched version per GitHub advisory
- All versions <= 4.1.123.Final are vulnerable
---
 test/java/spark/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/java/spark/pom.xml b/test/java/spark/pom.xml
index b70d7b833..1e88c9128 100644
--- a/test/java/spark/pom.xml
+++ b/test/java/spark/pom.xml
@@ -22,7 +22,7 @@
         <junit.version>4.13.2</junit.version>
         <seaweedfs.hadoop3.client.version>3.80</seaweedfs.hadoop3.client.version>
         <jackson.version>2.15.3</jackson.version>
-        <netty.version>4.1.118.Final</netty.version>
+        <netty.version>4.1.124.Final</netty.version>
         <surefire.jvm.args>
             -Xmx2g
             -Dhadoop.home.dir=/tmp