Bump Netty to 4.1.108.Final due to CVE-2024-29025

[petarov]

This is a simple PR that bumps Netty to 4.1.108.Final. Unit tests seem to run without any issues.

Background:

One of my projects uses Pushy and I'm required to compose an SBOM of all dependencies when shipping builds. CVE-2024-29025 was reported due to Pushy's dependency on Netty.

Vulnerability reported in 0.15.4:

NAME              INSTALLED      FIXED-IN       TYPE          VULNERABILITY        SEVERITY 
netty-codec-http  4.1.104.Final  4.1.108.Final  java-archive  GHSA-5jpm-x58v-624v  Medium

See GHSA-5jpm-x58v-624v

[jchambers]

Hello, and thank you for the contribution! First, for posterity, it's true that the current Pushy does depend on an affected version of Netty, but the specific vulnerability does not apply to Pushy.

That said:

1. Why go to 4.1.108? Why not go all the way to the latest version (4.1.111 at the time of writing)?
2. Could you please also update the README to match?

Thanks!

[petarov]

Thank you for the feedback. I have updated the PR and changed the version to 4.1.111.Final, as well as updated the README.

You're right that Pushy is not affected, but sadly most IT admins I'd deal with, just run the scanner, see the report and then open a ticket on my side. It's annoying, but that's how it is.

[jchambers]

You're right that Pushy is not affected, but sadly most IT admins I'd deal with, just run the scanner, see the report and then open a ticket on my side. It's annoying, but that's how it is.

You have my sympathy, friend ;)