Description
The optional Cassandra exporter agent shipped by the release build contains shaded Netty 4.1.135.Final. The agent is loaded with -javaagent when metrics are enabled, so its four Netty advisories require a rebuilt artifact rather than a reachability exception.
Affected advisories: GHSA-558v-64gr-wgg4, GHSA-6jqx-86gh-f27w, GHSA-jppx-w49h-x2qq, and GHSA-mvh2-crg5-v77c.
Definition of Done
- Rebuild or replace the exporter agent with Netty 4.1.136.Final or newer.
- Keep the build reproducible and checksum-verified for both architectures.
- Verify the resulting jar no longer contains the affected Netty versions.
- Preserve the existing Java agent startup contract and metrics endpoint.
- Document any release-wiring change needed to consume the rebuilt artifact.
Description
The optional Cassandra exporter agent shipped by the release build contains shaded Netty 4.1.135.Final. The agent is loaded with
-javaagentwhen metrics are enabled, so its four Netty advisories require a rebuilt artifact rather than a reachability exception.Affected advisories: GHSA-558v-64gr-wgg4, GHSA-6jqx-86gh-f27w, GHSA-jppx-w49h-x2qq, and GHSA-mvh2-crg5-v77c.
Definition of Done