Bump Netty version to 4.2.10.Final

[AzaleeX]

Update Gradle versions catalog to use Netty 4.2.10.Final (was 4.1.101.Final). This ensures projects referencing the catalog will resolve the newer Netty release.

[Copilot]

Pull request overview

Updates the repository’s Gradle version catalog to reference a newer Netty release, so modules using the shared libs catalog resolve the updated Netty dependency set.

Changes:

• Bump netty version in the Gradle versions catalog from 4.1.101.Final to 4.2.10.Final.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[AzaleeX]

Currently, the netty-codec used by CloudBust Network has a vulnerability.

Dependency maven:io.netty:netty-codec:4.1.101.Final is vulnerable

Update to unaffected version 4.1.125.Final

CVE-2025-58057, Score: 7.5

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.

Read More: https://www.mend.io/vulnerability-database/CVE-2025-58057?utm_source=Jetbrains

Results powered by Mend.io

[SupremeMortal]

Worth noting that the dependency you mention in Netty we don't use, so the attack area is non-existent. I think this is less about security and more about upgrading to Netty 4.2.x. I know people have had issues with 4.2.x, so I'm not keen to move onto it unless people have confirmed the issues are resolved.