Merge pull request #1140 from Bhashinee/2201.6.x

Update Netty version

ballerina/Ballerina.toml

@@ -1,7 +1,7 @@
 [package]
 org = "ballerina"
 name = "websocket"
-version = "2.8.1"
+version = "2.8.2"
 authors = ["Ballerina"]
 keywords = ["ws", "network", "bi-directional", "streaming", "service", "client"]
 repository = "https://github.com/ballerina-platform/module-ballerina-websocket"
@@ -12,14 +12,14 @@ distribution = "2201.5.0"
 [[platform.java11.dependency]]
 groupId = "io.ballerina.stdlib"
 artifactId = "websocket-native"
-version = "2.8.1"
-path = "../native/build/libs/websocket-native-2.8.1.jar"
+version = "2.8.2"
+path = "../native/build/libs/websocket-native-2.8.2-SNAPSHOT.jar"
 
 [[platform.java11.dependency]]
 groupId = "io.ballerina.stdlib"
 artifactId = "http-native"
-version = "2.8.0"
-path = "./lib/http-native-2.8.0.jar"
+version = "2.8.3"
+path = "./lib/http-native-2.8.3-20231012-153400-b73fc00.jar"
 
 [[platform.java11.dependency]]
 groupId = "io.ballerina.stdlib"
@@ -36,51 +36,51 @@ path = "./lib/constraint-native-1.2.0.jar"
 [[platform.java11.dependency]]
 groupId = "io.netty"
 artifactId = "netty-common"
-version = "4.1.94.Final"
-path = "./lib/netty-common-4.1.94.Final.jar"
+version = "4.1.100.Final"
+path = "./lib/netty-common-4.1.100.Final.jar"
 
 [[platform.java11.dependency]]
 groupId = "io.netty"
 artifactId = "netty-buffer"
-version = "4.1.94.Final"
-path = "./lib/netty-buffer-4.1.94.Final.jar"
+version = "4.1.100.Final"
+path = "./lib/netty-buffer-4.1.100.Final.jar"
 
 [[platform.java11.dependency]]
 groupId = "io.netty"
 artifactId = "netty-transport"
-version = "4.1.94.Final"
-path = "./lib/netty-transport-4.1.94.Final.jar"
+version = "4.1.100.Final"
+path = "./lib/netty-transport-4.1.100.Final.jar"
 
 [[platform.java11.dependency]]
 groupId = "io.netty"
 artifactId = "netty-resolver"
-version = "4.1.94.Final"
-path = "./lib/netty-resolver-4.1.94.Final.jar"
+version = "4.1.100.Final"
+path = "./lib/netty-resolver-4.1.100.Final.jar"
 
 [[platform.java11.dependency]]
 groupId = "io.netty"
 artifactId = "netty-handler"
-version = "4.1.94.Final"
-path = "./lib/netty-handler-4.1.94.Final.jar"
+version = "4.1.100.Final"
+path = "./lib/netty-handler-4.1.100.Final.jar"
 
 [[platform.java11.dependency]]
 groupId = "io.netty"
 artifactId = "netty-codec-http"
-version = "4.1.94.Final"
-path = "./lib/netty-codec-http-4.1.94.Final.jar"
+version = "4.1.100.Final"
+path = "./lib/netty-codec-http-4.1.100.Final.jar"
 
 [[platform.java11.dependency]]
 groupId = "io.netty"
 artifactId = "netty-codec"
-version = "4.1.94.Final"
-path = "./lib/netty-codec-4.1.94.Final.jar"
+version = "4.1.100.Final"
+path = "./lib/netty-codec-4.1.100.Final.jar"
 
 [[platform.java11.dependency]]
 groupId = "io.netty"
 artifactId = "netty-handler-proxy"
-version = "4.1.94.Final"
-path = "./lib/netty-handler-proxy-4.1.94.Final.jar"
+version = "4.1.100.Final"
+path = "./lib/netty-handler-proxy-4.1.100.Final.jar"
 
 [[platform.java11.dependency]]
-path = "../test-utils/build/libs/websocket-test-utils-2.8.1.jar"
+path = "../test-utils/build/libs/websocket-test-utils-2.8.2-SNAPSHOT.jar"
 scope = "testOnly"

ballerina/CompilerPlugin.toml

@@ -3,4 +3,4 @@ id = "websocket-compiler-plugin"
 class = "io.ballerina.stdlib.websocket.plugin.WebSocketCompilerPlugin"
 
 [[dependency]]
-path = "../compiler-plugin/build/libs/websocket-compiler-plugin-2.8.1.jar"
+path = "../compiler-plugin/build/libs/websocket-compiler-plugin-2.8.2-SNAPSHOT.jar"

changelog.md

@@ -4,6 +4,8 @@ This file contains all the notable changes done to the Ballerina WebSocket packa
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Fixed
+- [Address netty vulnerability: CVE-2023-4586](https://github.com/ballerina-platform/ballerina-standard-library/issues/4908)
 
 ## [2.8.1] - 2023-06-30
 - [Address netty vulnerability](https://github.com/ballerina-platform/ballerina-standard-library/issues/4599)

gradle.properties

@@ -3,7 +3,7 @@ group=io.ballerina.stdlib
 version=2.8.2-SNAPSHOT
 ballerinaLangVersion=2201.5.0
 ballerinaTomlParserVersion=1.2.2
-nettyVersion=4.1.94.Final
+nettyVersion=4.1.100.Final
 slf4jVersion=1.7.30
 puppycrawlCheckstyleVersion=8.18
 unirestVersion=1.4.9
@@ -36,7 +36,7 @@ stdlibJwtVersion=2.8.0
 stdlibOAuth2Version=2.8.0
 
 # Level 05
-stdlibHttpVersion=2.8.0
+stdlibHttpVersion=2.8.3
 
 # Ballerinax Observer
 observeVersion=1.0.7