[dependabot]

Bumps io.netty:netty-codec-http from 4.2.19.Final to 4.2.20.Final.

Release notes

Sourced from io.netty:netty-codec-http's releases.

netty-4.2.20.Final

Security Fixes

• https://github.com/netty/netty/security/advisories/GHSA-m77g-r4c7-3w77 - out-of-bounds read in netty-buffer
• https://github.com/netty/netty/security/advisories/GHSA-v2v6-vch9-4pcg - inefficient CPU computation in netty-codec-http3
• https://github.com/netty/netty/security/advisories/GHSA-rx4g-qxm6-238r - out-of-bounds read in netty-buffer
• https://github.com/netty/netty/security/advisories/GHSA-cqmg-wc9g-fpj8 - insufficient entropy in netty-resolver-dns
• https://github.com/netty/netty/security/advisories/GHSA-hc9x-r52h-gh4x - unbounded memory usage in netty-codec-http2
• https://github.com/netty/netty/security/advisories/GHSA-42mp-m8rq-6rgj - insufficient control character neutralization in netty-codec-http
• https://github.com/netty/netty/security/advisories/GHSA-w53r-xhgx-8582 - use-after-free in netty-codec-classes-quic
• https://github.com/netty/netty/security/advisories/GHSA-qhw9-p586-v948 - out-of-bounds read in netty-buffer
• https://github.com/netty/netty/security/advisories/GHSA-84gx-4cj4-rm7q - unbounded memory usage in netty-codec-mqtt
• https://github.com/netty/netty/security/advisories/GHSA-6xv6-9mgg-mfvc - mTLS auth bypass via session resumption in netty-handler and netty-codec-quic

What's Changed

• IoUring: Fix empty writev submissions after sendmsg_zc by @​dreamlike-ocean in netty/netty#17782
• Do not let a negatively cached search domain shadow a positive one by @​akilegaspi in netty/netty#17623
• Fix musl verify job by @​normanmaurer in netty/netty#17801
• Reject Redis lines that start with LF by @​yawkat in netty/netty#17793
• Choose server key types from client's signature algorithms for TLS 1.3 by @​eager-signal in netty/netty#17764
• Port 4.2: LocalChannel: Deliver data written by the peer before it closed (#17814) by @​normanmaurer in netty/netty#17816
• Validate padding of HEADERS frames without priority by @​bryce-anderson in netty/netty#17817
• Don't spin in SslHandler.wrapMultiple(...) when the engine consumes nothing by @​allthingssecurity in netty/netty#17728
• Preserve invalid SNI names in ReferenceCountedOpenSslEngine by @​gavinbunney in netty/netty#17781
• Optimize redundant bounds checking in ByteBuf.setBytes by @​vpelikh in netty/netty#17023
• Respect SETTINGS_QPACK_BLOCKED_STREAMS for unacknowledged QPACK entries by @​allthingssecurity in netty/netty#17754
• Release the DNS response when a query future loses a cancel race by @​watson-ryan in netty/netty#17475
• Lazily instantiate VarHandle JCTools queues via holder class by @​arnabnandy7 in netty/netty#17750
• Keep reading a closed QUIC stream until the end of its input by @​allthingssecurity in netty/netty#17755
• Throw UnsupportedOperationException from AdaptiveByteBuf.memoryAddress() without an address by @​normanmaurer in netty/netty#17820
• HAProxyMessage: validate the length of all TLV types by @​yawkat in netty/netty#17834
• Fix HpackDynamicTable losing entries when filled to capacity by @​yawkat in netty/netty#17831
• Make AdaptiveByteBuf.memoryAddress() faster by @​lhotari in netty/netty#17767
• Validate bzip2 Huffman code lengths before building decode tables by @​Raghuvardhan-Reddy78 in netty/netty#17812
• Validate header values on DefaultHeaders.copy(), bulk add, entry setValue and ReadOnlyHttpHeaders by @​normanmaurer in netty/netty#17841
• Throw DecompressionException on JdkZlib preset dictionary mismatch by @​yawkat in netty/netty#17838
• Reject HTTP version numbers that overflow int by @​yawkat in netty/netty#17836
• Apply certificate list size floor by @​arnabnandy7 in netty/netty#17674
• HAProxyMessageEncoder: encode v1 PROXY UNKNOWN headers by @​yawkat in netty/netty#17837
• HAProxyMessage: decode TLVs with an empty value at the end of the header by @​yawkat in netty/netty#17835
• Reject invalid content-length in PUSH_PROMISE with a stream error by @​yawkat in netty/netty#17867
• Honor maxAllocation for brotli in DelegatingDecompressorFrameListener by @​yawkat in netty/netty#17866
• HAProxyMessageDecoder: fix v2 header framing with a non-zero reader index by @​yawkat in netty/netty#17832
• IpSubnetFilter: Add tests for overlapping rules by @​Raghuvardhan-Reddy78 in netty/netty#17765
• Avoid allocating NIO buffer views in AdaptiveByteBuf.setBytes(int, ByteBuf, int, int) by @​lhotari in netty/netty#17840
• Skip JNDI nameserver lookup on IBM i by @​manish-9245 in netty/netty#17872
• Reset the h2c upgrade stream if the request can not be converted by @​yawkat in netty/netty#17869
• Don't size ZstdDecoder output buffers from the frame content size by @​Raghuvardhan-Reddy78 in netty/netty#17896
• Fix NPE in Http2FrameCodec when h2c upgrade fails by @​yawkat in netty/netty#17871
• Allow adaptive allocator magazine cleanup in BlockHound by @​cj848 in netty/netty#17849
• GroupsConverter: fix the x25519mlkem768 group name by @​normanmaurer in netty/netty#17898

... (truncated)

Commits

• 4fb6a5f [maven-release-plugin] prepare release netty-4.2.20.Final
• 3da0f5a Reject all control characters and DEL in HTTP request line tokens
• 464cfd7 TLS/QUIC: Scope session resumption via a derived session_id_context
• b85fb0a Don't preallocate the SUBACK and UNSUBACK reason code lists from the remainin...
• c2196f9 Check the index before every numeric accessor on Unpooled buffers
• dbf089b Fix use-after-free when QuicheQuicConnection.free() races an offloaded SSL task
• 52ce8c5 Bound outstandingRemoteSettingsQueue to prevent unbounded heap growth
• d576bd9 Add 0x20 case randomization and DNS cookie support to DnsNameResolver
• fb4736f Check bounds in ByteBuf string accessors
• debfda5 QPACK: Don't decode the name of Insert With Literal Name again for every valu...
• Additional commits viewable in compare view