From b94e78578a5b6a056d19884951d09013f7a7cb26 Mon Sep 17 00:00:00 2001
From: chrislu <chris.lu@gmail.com>
Date: Mon, 24 Nov 2025 22:15:52 -0800
Subject: [PATCH] Update pom.xml

---
 test/java/spark/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/java/spark/pom.xml b/test/java/spark/pom.xml
index 0f27698a8..e28a67db6 100644
--- a/test/java/spark/pom.xml
+++ b/test/java/spark/pom.xml
@@ -22,7 +22,7 @@
         <junit.version>4.13.2</junit.version>
         <seaweedfs.hadoop3.client.version>3.80.1-SNAPSHOT</seaweedfs.hadoop3.client.version>
         <jackson.version>2.18.2</jackson.version> <!-- Upgraded from 2.15.3 -->
-        <netty.version>4.1.115.Final</netty.version> <!-- Match Spark 3.5.3 -->
+        <netty.version>4.1.124.Final</netty.version> <!-- Upgraded to 4.1.124.Final for security fix (CVE in netty-codec-http2 <= 4.1.123.Final) -->
         <parquet.version>1.15.2</parquet.version> <!-- Upgraded to 1.15.2 for security fix -->
         <parquet.format.version>2.12.0</parquet.format.version>
         <surefire.jvm.args>