CHK-13425: Fix GHSA-rwm7-x88c-3g2p: Upgrade Netty to 4.2.13.Final

[Copilot]

Addresses HIGH severity DoS vulnerability in io.netty:netty-transport-native-epoll (GHSA-rwm7-x88c-3g2p) — RST on half-closed TCP connections. Spring Boot 4.0.5 BOM pins Netty at 4.2.12.Final (vulnerable); patched version is 4.2.13.Final.

Changes

• build.gradle — Adds resolutionStrategy.eachDependency constraint for io.netty group following the existing CVE-fix pattern. Uses regex-based numeric patch comparison to correctly handle single- vs multi-digit patch versions (e.g. 4.2.9 vs 4.2.13 fails lexicographic comparison):

  if (requested.group == 'io.netty' && requested.version != null) {
      def nettyVersion = requested.version =~ /^4\.2\.(\d+)\./
      if (nettyVersion && nettyVersion[0][1].toInteger() < 13) {
          useVersion('4.2.13.Final')
          because('GHSA-rwm7-x88c-3g2p: ...')
      }
  }

• examples/example-spring-boot-starter-webflux/build.gradle — Adds ext['netty.version'] = '4.2.13.Final' alongside the existing ext['jackson-bom.version'] override. Required because the Spring Dependency Management plugin resolves BOM-managed versions through a separate mechanism that resolutionStrategy alone cannot override.

Implementation Reasoning

• The resolutionStrategy.eachDependency approach works for modules using Gradle-native platform() BOM import; the ext['netty.version'] property is the standard override for the Spring DM plugin.
• All io.netty artifacts in the 4.2.x range are upgraded together to maintain inter-component compatibility.
• Verified via ./gradlew dependencies that netty-transport-native-epoll resolves to 4.2.13.Final across all relevant configurations.

References: CHK-13425 · GitHub Alert #64 · GHSA-rwm7-x88c-3g2p

Original prompt

Requested by: catarina.correia@getyourguide.com

Branch naming: Please prefix your branch with CHK-13425

Create a branch named CHK-13425-fix-netty-transport-native-epoll

Jira Ticket: CHK-13425
Security Alert: Github_Security_Alert - Netty epoll transport denial of service via RST on half-closed TCP connection

Context:
This is a security vulnerability fix for denial of service vulnerability in io.netty:netty-transport-native-epoll used by the openapi-validation-java library.

Vulnerability Details:

• CVE/GHSA: GHSA-rwm7-x88c-3g2p
• Severity: HIGH
• Package: io.netty:netty-transport-native-epoll
• Vulnerable Version/Range: >= 4.2.0.Final, < 4.2.13.Final
• Patched Version: 4.2.13.Final

Work Needed:

• Locate io.netty:netty-transport-native-epoll dependency in settings.gradle or build.gradle files
• Determine if it's a direct or transitive dependency
• Check if fix requires major version upgrade (compare vulnerable vs patched major versions)
• If major version upgrade: Review changelog for breaking changes and assess compatibility
• Apply appropriate fix strategy:
  • If direct: Update version in manifest file
  • If transitive: Upgrade parent dependency that brings it in
  • If needed: Add version constraint/override
• Verify patched version 4.2.13.Final appears in dependency tree using ./gradlew dependencies
• Run tests following repository's documented test process (check README.md and CI workflows)

⚠️ PR Description Requirements:

• ALWAYS include the "Implementation Reasoning" section below in the PR description on GitHub
• If major version upgrade is detected, add a "## ⚠️ Breaking Changes Warning" section with changelog review results

Implementation Reasoning:
[Apply security-specific guidance:]

• {Fix strategy chosen and why - e.g., "Upgrading netty-bom parent dependency rather than override because it ensures all Netty components are compatible"}
• {Security considerations - e.g., "This resolves the denial of service vulnerability by upgrading to a version that properly handles RST on half-closed TCP connections"}
• {Verification approach - e.g., "Verified using ./gradlew dependencies that netty-transport-native-epoll 4.2.13.Final is resolved"}

Note: Include the "Implementation Reasoning" section above in your PR description on GitHub.

Security Considerations:

• Ensure the fix actually resolves GHSA-rwm7-x88c-3g2p
• Verify no breaking changes are introduced
• Test thoroughly to ensure the vulnerability is closed
• Check that all Netty transitive dependencies are compatible

Acceptance Criteria:

• io.netty:netty-transport-native-epoll upgraded to 4.2.13.Final (verified in dependency tree)
• All existing tests pass
• (If major version upgrade) Breaking changes reviewed, documented in PR description, and mitigated
• No unexpected breaking changes introduced
• PR includes links to Jira ticket CHK-13425, GitHub alert Bump io.spring.dependency-management from 1.1.0 to 1.1.4 #64, and security advisory GHSA-rwm7-x88c-3g2p

⚠️ Security Fix: This PR addresses a HIGH severity denial of service vulnerability. Please review carefully.

Ask @catarina-correia for a review.