Bump io.netty:netty-codec from 4.1.133.Final to 4.1.136.Final

[dependabot]

Bumps io.netty:netty-codec from 4.1.133.Final to 4.1.136.Final.

Release notes

Sourced from io.netty:netty-codec's releases.

netty-4.1.136.Final

What's Changed

• SingleThreadEventExecutor: document Throwable safety contract on run() by @​daguimu in netty/netty#16814
• Make HTTP/2 frame hashCode consistent with equals by @​daguimu in netty/netty#16692
• Add BlockHound exception for DnsQueryIdSpace (#16896) by @​chrisvest in netty/netty#16915
• FlowControlHandler: Fix autoRead behavior by @​chrisvest in netty/netty#16912
• Auto-port 4.1: Fix incorrect bounds in error message of HpackDecoder.setMaxHeaderListSize by @​netty-project-bot in netty/netty#16911
• MQTT: Fix MQTT decoder size check after variable header replay by @​daguimu in netty/netty#16916
• MQTT: Make the decodeProperties early-REPLAY check actually fire by @​daguimu in netty/netty#16813
• Reject control characters at the boundary of HTTP method names (#16723) by @​chrisvest in netty/netty#16933
• Auto-port 4.1: Update to latest tcnative release by @​netty-project-bot in netty/netty#16941
• Auto-port 4.1: Fix HTTP 2 PUSH_PROMISE stream association validation by @​netty-project-bot in netty/netty#16955
• Auto-port 4.1: Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder by @​netty-project-bot in netty/netty#16957
• Auto-port 4.1: Add opt-in validation of mandatory pseudo-header fields for HTTP/2 by @​netty-project-bot in netty/netty#16964
• Strictly validate MQTT UTF-8 Encoded String (#16939) by @​chrisvest in netty/netty#16965
• Auto-port 4.1: Stop DateFormatter trailing token from running past the parse end by @​netty-project-bot in netty/netty#16968
• Auto-port 4.1: IpFilter: Deprecate constructor which use accept by default by @​netty-project-bot in netty/netty#16973
• Add RFC 10008 QUERY Method support (#16966) by @​normanmaurer in netty/netty#16978
• Correctly release and fail queued traffic-shaping writes on close (#16959) by @​normanmaurer in netty/netty#16976
• Auto-port 4.1: FlowControlHandler: respect auto-read when toggled while dequeueing by @​netty-project-bot in netty/netty#16983
• IdleStateHandler: reset firstWriter/ReaderIdleEvent in resetWriteTimeout/resetReadTimeout (#16982) by @​chrisvest in netty/netty#16989
• Auto-port 4.1: Fix typo in AbstractSniHandler Javadoc by @​netty-project-bot in netty/netty#16995
• Auto-port 4.1: Reconcile AbstractCoalescingBufferQueue readableBytes when it drains, and fail stuck HTTP/2 streams instead of spinning empty DATA frames by @​netty-project-bot in netty/netty#16997
• Reject control characters at the boundary of the HTTP version token (#16971) by @​normanmaurer in netty/netty#16986
• Auto-port 4.1: Reset UTF-8 decode state on CR in StompSubframeDecoder by @​netty-project-bot in netty/netty#17003
• Auto-port 4.1: HTTP2: Pass the correct number of arguments when logging goaway by @​netty-project-bot in netty/netty#17017
• FastLz: Guard decompression against truncated input (#17000) by @​chrisvest in netty/netty#17015
• Backport 4.1 Fix propagation of startTls for client SslContext handler by @​skyguard1 in netty/netty#17020
• Auto-port 4.1: Reject non-token characters in HTTP/2 header names by @​netty-project-bot in netty/netty#17022
• Update lz4-java to 1.11.1 by @​yawkat in netty/netty#17060
• Pin github actions to reduce risk (#17043) by @​normanmaurer in netty/netty#17044
• Merge branches from forks (#17063) by @​normanmaurer in netty/netty#17065

Full Changelog: netty/netty@netty-4.1.135.Final...netty-4.1.136.Final

netty-4.1.135.Final

Security fixes

• CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).
• CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).
• CVE-2026-50560: DDoS in io.netty:netty-codec-http2.
• CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).
• CVE-2026-50020: request smuggling in io.netty:netty-codec-http.
• CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).
• CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).
• CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.
• CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).

... (truncated)

Commits

• fca0764 [maven-release-plugin] prepare release netty-4.1.136.Final
• bb2ff68 Merge branches from forks (#17063) (#17065)
• 7b44dc9 Pin github actions to reduce risk (#17043) (#17044)
• 50e6e1d Update lz4-java to 1.11.1 (#17060)
• d7dcf6c Auto-port 4.1: Reject non-token characters in HTTP/2 header names (#17022)
• b12bd11 Backport 4.1 Fix propagation of startTls for client SslContext handler (#17020)
• 7fd5cc7 FastLz: Guard decompression against truncated input (#17000) (#17015)
• 42e7103 Auto-port 4.1: HTTP2: Pass the correct number of arguments when logging goawa...
• 666c3b2 Auto-port 4.1: Reset UTF-8 decode state on CR in StompSubframeDecoder (#17003)
• df54c37 Reject control characters at the boundary of the HTTP version token (#16971) ...
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.